Privacy policy

Effective Date: 14 August 2023 

Last Updated: 15 October 2026

Our privacy promise

1. We only collect what we need, and we tell you why.
2. We never sell your personal data.
3. We never use your face photo to identify you, and we never use it for marketing.
4. We only analyse your skin with your explicit consent, and you can withdraw it at any time.
5. We will not send you marketing unless you have asked for it.
6. We only work with trusted providers bound by contract to protect your data.
7. We respect your rights and will make it easy to use them.

1. Who we are

1.1 You're Looking Well Ltd (YLW, we, us, our) is the controller of your personal data. This means we decide how and why it is used, and we are responsible for it under UK data protection law (the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations).

1.2 Company number 14307617 (England and Wales) · Soho Works, The Tea Building, 56 Shoreditch High Street, London E1 6JJ · ICO registration number ZB386724  · Privacy contact: hello@ylwclub.com.

1.3 Our Website, Products and Skin Analysis Tool are offered to customers in the United Kingdom.

1.4 This policy covers the Website www.ylwclub.com, our Skin Analysis Tool, our emails and social media pages, and your dealings with our customer service team. Not every section will apply to you: for example, if you never use the Skin Analysis Tool, section 3 does not apply.

2. What we collect, why, and our legal basis

2.1 The table shows each situation in which we use your data, what we use, why, and the legal basis we rely on. The Skin Analysis Tool is covered separately in section 3.

When	What data	Why we use it	Legal basis (UK GDPR Art. 6)
Placing an order	Name, email, phone, billing and delivery address, order details, payment confirmation (not full card numbers)	Process, deliver and support your order; handle returns and refunds	Contract
	Transaction records	Tax, accounting and consumer-law records	Legal obligation
	Order, device and payment signals	Prevent fraud and secure payments	Legitimate interests (preventing fraud)
Subscriptions	As above, plus frequency and renewal dates	Manage deliveries, charges, reminders and cancellations	Contract; legal obligation (reminder notices)
Creating an account	Name, email, password (hashed), order history, preferences	Run your account	Contract
Marketing emails and SMS	Name, email, phone, preferences, how you interact with our emails	Send you news and offers you asked for; tailor them to your interests	Consent (you can unsubscribe at any time)
	Email address on a suppression list	Ensure we never contact you after you opt out	Legitimate interests (respecting your choice)
Browsing the Website	IP address, device and browser type, pages viewed, referral source, cookie identifiers	Run and secure the Website; understand and improve it	Legitimate interests; consent where required for cookies (section 5)
	Advertising cookies and pixel data	Show you relevant ads on other platforms and measure them	Consent
Contacting customer service	Name, contact details, messages, order details, and any health information you choose to share (for example a reaction)	Answer your query; handle complaints; meet product safety duties	Contract; legitimate interests; for health data, explicit consent or legal claims (Art. 9(2)(a) or (f))
Reviews and user content	Name or alias, review text, photos you submit, rating	Publish your review and show customer feedback	Consent; legitimate interests (showing genuine reviews)
Competitions and surveys	Name, contact details, answers	Run the promotion; improve our products	Contract (promotion terms); legitimate interests
Social media	Handle, public posts and comments that mention us	Respond to you; understand feedback	Legitimate interests
Legal and business needs	Any of the above, as needed	Defend legal claims; comply with regulators; sell or restructure our business	Legitimate interests; legal obligation

2.2 Legitimate interests. Where we rely on legitimate interests, we have balanced our interests against your rights. You can ask us for details of that balancing and you can object at any time (section 6).

2.3 Required data. Fields marked with an asterisk are needed to fulfil your order. Without them, we cannot supply you.

2.4 Sources. Most data comes from you. Some comes from our payment providers (payment confirmation and fraud checks), delivery partners (delivery status), and advertising and social platforms (aggregate campaign data).

2.5 Profiling. We may group customers by purchase history and email engagement to tailor marketing. This never produces legal or similarly significant effects. You can object to profiling for marketing at any time.

2.6 Automated decisions. Our payment providers may use automated fraud checks that can delay or decline a payment. If this happens, you can ask for human review, give your point of view and contest the decision by contacting us.

3. Skin Analysis Tool: your photo and AI

3.1 In short: with your explicit consent, our AI provider Haut.AI analyses a photo of your face to estimate visible skin characteristics and suggest a routine. It is never used to identify you, never used for marketing, and never used to train AI.

What data the Tool uses

Data	Details	How long we keep it
Your photo	A selfie you take or upload	Deleted after analysis
Anonymised skin image	Before analysis, Haut.AI's technology removes eyes, mouth, hair and background, leaving only skin pixels	Deleted with the photo
Questionnaire answers	Age range, skin type, skin concerns, sensitivity	Session only, unless you save your results
Skin results	Scores for hydration, redness, pores, lines, uneven tone, perceived age and recommended Products	Session only; or until you delete them or your account, if you choose to save them
Technical data	IP address, device and browser type, session ID, consent record	Consent record: 6 years after last use as evidence of consent

Why this data is sensitive

3.2 A photo of your face, and results about your skin, can reveal information about your health (for example acne, rosacea or sun damage) and may allow inferences about your ethnic origin. We therefore treat this data as special category data and apply the highest level of protection, whether or not the law strictly requires it in every case.

3.3 We do not use the Tool to recognise or identify you. No facial template or faceprint is created.

Our legal basis

3.4 We rely on your explicit consent (UK GDPR Art. 6(1)(a) and Art. 9(2)(a)), given by ticking an unticked box on the consent screen before your photo is submitted. If you do not consent, the Tool will not open. Using the Tool is entirely optional.

3.5 You can withdraw consent at any time by emailing hello@ylwclub.com. This will not affect analysis already carried out, but we will delete any Tool data we still hold.

How the analysis works

3.6 Your photo is sent over an encrypted connection to Haut.AI OÜ, based in Estonia, which acts as our processor. Haut.AI may only process it on our written instructions, under a data processing agreement that meets UK GDPR Article 28.

3.7 The results are generated automatically by AI, without human review. They are cosmetic estimates and recommendations only. They do not produce any legal or similarly significant effect on you: you are free to ignore them, and they do not affect prices, eligibility or any service. If you have questions about a result, you can contact us and a member of our team will respond.

3.8 Results can be affected by lighting, camera quality, make-up and skin tone. Haut.AI states that its models are trained on diverse datasets and calibrated across skin tones, but no AI is perfect. Please see our Skin Analysis Tool terms for more on accuracy and why results are not medical advice.

What we never do with Tool data

• sell it or share it with advertisers or social media platforms;
• use it for marketing or to tailor ads, unless you separately opt in to receive results-based recommendations by email;
• use it to train or improve AI models;
• use it to identify you or recognise your face;
• make it available to anyone else, except as required by law.

Age and location

3.9 The Tool is only for people aged 18 or over, located in the UK, using a photo of themselves. We block access to the Tool from outside the UK. If we learn that a photo of a child or another person has been submitted, we will delete it.

4. Sharing, transfers, retention and security

Who we share your data with

4.1 We never sell your personal data. We share it only with the providers below, who act as our processors under contract unless stated otherwise.

Provider	Role	Location of processing
Shopify	E-commerce platform and hosting	Canada, US, Ireland and others
Haut.AI OÜ	Skin Analysis Tool	EEA
Email provider	Marketing emails and SMS	US
Payment providers: Shopify Payments, PayPal, Klarna, Apple Pay, Google Pay	Payments and fraud checks (PayPal and Klarna act as independent controllers)	UK, EEA, US
Delivery partners (Royal Mail, DPD)	Delivering orders	UK and destination country
Google (Analytics, Tag Manager, Ads)	Analytics and advertising	US
Meta (Facebook, Instagram) and TikTok	Advertising (with your consent)	US and others

4.2 Where we use Meta or TikTok advertising tools on the Website, those platforms may be joint controllers with us for collecting data via their pixels. We only load them with your consent.

International transfers

4.3 Some providers process data outside the UK. When they do, we make sure it is protected by: a UK adequacy decision (for example for the EEA, or for US organisations certified under the UK Extension to the EU–US Data Privacy Framework); or the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, with a transfer risk assessment. Contact us for a copy of the relevant safeguards.

4.4 Skin Analysis Tool data stays in the UK and EEA 

4.5 Where Haut.AI processes Tool data in Estonia, the transfer is covered by UK adequacy regulations for the EEA, so no further safeguards are needed.

How long we keep your data

Data	Retention period
Skin Analysis photo	Deleted automatically after analysis
Order and transaction records	6 years from the end of the financial year of purchase (tax law)
Account data	Until you close your account, or 3 years of inactivity
Marketing data	Until you unsubscribe, or 2 years without engaging; suppression list kept indefinitely
Customer service records	3 years from last contact; up to 6 years where a claim is possible
Consent records	For as long as we rely on the consent, plus 6 years
Cookies	See our Cookie Policy

4.6 When data is no longer needed, we delete it securely or anonymise it.

Security

4.7 We use encryption in transit (TLS), access controls limited to staff who need it, and contracts requiring our providers to apply appropriate security. If a breach is likely to put you at high risk, we will tell you without undue delay.

5. Cookies, marketing and children

Cookies

5.1 Cookies are small files placed on your device. We group them as follows. Full details, including each cookie's name, provider and lifespan, are in our Cookie Policy.

Type	Example use	Do we ask first?
Strictly necessary	Basket, checkout, security, remembering your cookie choices	No: the Website cannot work without them
Statistics and website improvement	Counting visits and seeing which pages work, to improve the Website	No, as now permitted by law, but you can switch them off at any time via "Cookie settings" in the footer
Appearance and preferences	Remembering your region, currency or display choices	No, but you can switch them off at any time
Advertising and social media	Meta Pixel, TikTok Pixel, Google Ads: showing and measuring ads	Yes: only with your consent

5.2 You can change your choices at any time through "Cookie settings". Refusing advertising cookies will not affect your ability to shop.

Marketing

5.4 We send marketing by email or SMS only if you opt in. Every message includes an unsubscribe link, or you can reply STOP to SMS, or email us. We do not share your details with third parties for their own marketing.

5.5 With your consent, we may use a hashed version of your email address to show you ads, or exclude you from ads, on social platforms ("custom audiences"). You can withdraw this consent at any time.

Children

5.6 Our Website and Products are not intended for anyone under 16, and we do not knowingly collect data from them. You must be 18 or over to use the Skin Analysis Tool. If you believe a child has given us data, contact us and we will delete it.

6. Your rights

6.1 You have the following rights. Some apply only in certain circumstances.

Right	What it means
To be informed	Clear information about how we use your data, as in this policy
Access	A copy of your data and details of how we use it. We respond within one month, extendable by two months for complex requests, and will make reasonable and proportionate searches
Rectification	Correction of inaccurate or incomplete data
Erasure	Deletion of your data where we no longer have a valid reason to keep it, including all Skin Analysis Tool data on request
Restriction	Limiting how we use your data while a concern is resolved
Portability	Receiving data you gave us in a machine-readable format, where processing is based on consent or contract
Objection	Objecting to processing based on legitimate interests; you have an absolute right to object to direct marketing and related profiling
Withdraw consent	Withdrawing consent at any time, without affecting earlier lawful processing
Automated decisions	Where a significant decision about you is made solely by automated means, you can ask for human intervention, express your view and contest it

6.2 How to exercise them. Email hello@ylwclub.com or write to us at the address in section 1. We may need to verify your identity. There is normally no charge.

7. Complaints

7.1 If you are unhappy with how we have handled your personal data, please complain to us first so we can put it right. You can email hello@ylwclub.com, or write to us.

7.2 We will acknowledge your complaint within 30 days, investigate it without undue delay, keep you informed of progress, and tell you the outcome.

7.3 You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

8. Changes to this policy

8.1 We will update this policy when our practices or the law change. We will post the new version here with its date and, for significant changes (for example any new use of Skin Analysis Tool data), notify you by email or on the Website before they take effect. We will never use your data in a materially new way without telling you and, where required, asking for your consent.

9. Contact us

You're Looking Well Ltd · Soho Works, The Tea Building, 56 Shoreditch High Street, London E1 6JJ · hello@ylwclub.com · Company number 14307617