Legal

Privacy Policy

Last updated: 17 October 2026

This Privacy Policy explains how PLUMCHI LIMITED, Company No. 17328838, registered at 27 Culvert Lane, Uxbridge, UB8 2XB, collects, uses, and protects your personal data when you use plumchi.com and the plumchi mobile app (together, the "Service"). We are the data controller for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Please read this policy carefully.

1. What Data We Collect

Depending on how you interact with the Service, we may collect the following categories of personal data:

Account & Profile Data

Email address, year of birth, sex, account credentials, subscription tier, and transaction status IDs (we do not store full card numbers).

Skin Tone Data (Special Category Data)

Skin colour, recorded using the Fitzpatrick scale, used to personalise product recommendations and power AI features.

Skincare & Wellness Logs

Skin type, concerns, sensitivities, skincare routines, products owned, wishlisted items, product ratings, water consumption, sleep quality, and skincare effectiveness self-assessment scores.

User-Generated Media (Special Category Data)

Facial images and photographs uploaded to track skin progress, via the mobile app.

Usage & Technical Data

Device model, operating system, IP address, general geographic location, notification tokens, merchant price links clicked, and product views (product views are stored via Supabase to power the "Recently Viewed" feature).

Browsing and usage data

Pages you visit, products you view, searches you perform, links you click, and time spent on the Service. This is collected automatically via cookies and analytics tools.

Device and technical data

IP address, browser type and version, operating system, screen resolution, referring URL, and general geographic location (country or city level, derived from IP address).

Payment and subscription data

We do not collect or store your credit card or financial billing details. Subscriptions bought in the app are processed by your mobile platform's app store (Apple App Store or Google Play Store). Subscriptions bought on plumchi.com are processed by Stripe through RevenueCat's web checkout, which receives your email address and payment details directly. We use a third-party service, RevenueCat, to track and verify your subscription status, purchase history, transaction IDs and any discount code you redeem.

2. How We Collect Your Data

  • Directly from you — when you complete a skin quiz, set preferences, upload photos or use search and filtering tools on the Service.
  • Automatically — via cookies and similar tracking technologies as you browse the Service.
  • From your device — technical data is collected as a normal part of serving web pages.

We do not collect data from third parties or purchase marketing lists.

3. How We Use Your Data

We process your data under the following legal bases allowed by the UK GDPR:

Performance of a Contract

Contract

To manage your account, maintain your wishlists and routines, process subscriptions, and send essential transactional emails or system notifications.

Personalised recommendations & marketing

Consent

To provide personalized product recommendations to non-registered users, and to send marketing communications (which you can opt out of at any time).

Special category data

Explicit consent

We require your explicit consent to process facial images, skin colour (Fitzpatrick scale), and health-related skin information. This includes storing and displaying your progress photos to track your skin over time, and processing your skin profile and the text you enter to personalise recommendations and to power AI features such as Plumchi Perspective, AI chat, and your daily tracking review, which send text (not your photos) to third-party AI models via OpenRouter. You can withdraw this consent at any time in Settings, or by deleting your photos or account.

App stability and fraud prevention

Legitimate interests

To analyze aggregate, de-identified application performance data via PostHog to optimize app stability and prevent security fraud or malicious scraping.

4. Sharing Your Data

We do not sell or rent your personal data. To deliver our services, we share specific data with trusted third-party service providers acting as our data processors. We require every third-party processor we share data with to provide the same or an equivalent level of protection for your personal data as set out in this Privacy Policy, under a data processing agreement:

  • OpenRouter: We share your chat messages, skincare logs, and skin profile data with OpenRouter, which routes requests to third-party AI models to power the in-app AI chat, your daily tracking review, and the "Plumchi Perspective" product-suitability feature. We contractually ensure these providers do not use your data to train their models.
  • Infrastructure & Performance Monitoring: We use PostHog to monitor in-app usage, analyse product engagement, and understand how you interact with the Service.
  • Cloud Photo Storage: We store your uploaded facial images and progress photos in a private, access-controlled Amazon Web Services (AWS) S3 bucket. These images are not publicly accessible and are only retrieved to display within your account.
  • Database & App Infrastructure: We use Supabase to host our application database, including your account data, skincare profile, and a record of recently viewed products used to power the "Recently Viewed" feature.
  • Communications & Notifications: We use Postmark to deliver operational and marketing emails, and Expo Notifications to route in-app and push notifications to your mobile device.
  • Legal Obligations: We may disclose data if required by law or law enforcement authorities.
  • Subscription Management & Processing: We share anonymous user identifiers, transaction history, and purchase states with RevenueCat to manage, sync, and validate your paid subscription tier across your mobile devices. For subscriptions bought on plumchi.com, RevenueCat and its payment processor Stripe handle your payment details; we never see your full card number.

5. Cookies, Device Identifiers and Tracking Technologies

On the website, we use browser cookies as set out below. The plumchi mobile app does not use browser cookies, but uses similar device identifiers for the same purposes.

Identifier Purpose Type
plumchi_consent Stores your consent choice Strictly necessary
plumchi_aid Anonymous PostHog identifier used for personalised recommendations and in-app analytics Functional / Analytics

Strictly necessary identifiers are set regardless of your consent choice, as they are required for the Service to function. All other identifiers are only set after you accept via the cookie banner or, in the app, the in-app consent screen. You can withdraw consent at any time by clearing your cookies, adjusting your browser settings, or via the Privacy settings within the app.

We also use PostHog to track aggregate, pseudonymised usage patterns, helping us understand how the Service is used and improve it.

6. How Long We Keep Your Data

We retain personal data only for as long as necessary for the purposes described in this policy, or as required by law.

  • Skin profile data and preferences are retained for as long as you continue to use the Service and for up to 24 months of inactivity, after which they are deleted.
  • Uploaded facial images and progress photos are retained for as long as your account remains active. If you delete a photo or your account, the image — including copies stored via AWS S3 — is permanently deleted from our systems within 30 days.
  • Device identifier and analytics data is retained for up to 12 months.
  • Aggregate analytics data (which cannot identify you) may be retained indefinitely.

7. Your Rights

Under the UK GDPR, you have the following rights in relation to your personal data:

Right of access

Request a copy of the data we hold about you.

Right to rectification

Ask us to correct inaccurate or incomplete data.

Right to erasure

Ask us to delete your personal data ("right to be forgotten").

Right to restriction

Ask us to restrict processing of your data in certain circumstances.

Right to portability

Receive your data in a structured, machine-readable format.

Right to object

Object to processing based on legitimate interests.

Automated decisions

Not be subject solely to automated decisions with significant effects on you.

Withdraw consent

Withdraw consent for consent-based processing at any time.

To exercise any of these rights, please contact us. We will respond within one month. You also have the right to lodge a complaint with the UK's data protection authority, the Information Commissioner's Office (ICO), at ico.org.uk.

8. Data Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or destruction. However, no transmission over the internet is completely secure. While we strive to protect your data, we cannot guarantee the absolute security of information transmitted to the Service.

9. Children's Privacy

The Service is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with a revised "Last updated" date. We encourage you to review this policy periodically. Continued use of the Service after changes are posted constitutes your acceptance of the updated policy.

11. Contact Us

For any questions, requests, or concerns about this Privacy Policy or how we handle your data:

PLUMCHI LIMITED (Data Controller)

Company No. 17328838

27 Culvert Lane, Uxbridge, UB8 2XB

Contact us