·Privacy policy

Your photos, your data, your rights.

A plain-language account of what is collected, why it is needed, what is never done with it, and how you stay in control.

Last updated ·

On this page

The photos you upload are used to generate your color analysis report and any AI styling images you request. Producing those results requires sending the photos to third-party AI providers that process images on our behalf.

We do not use your photos to train our own models, and we do not sell them. We process them only as described in this policy, including with necessary service providers. Uploaded photos and the images generated from them are stored on secure cloud infrastructure for as long as your account exists, so you can return to your reports.

Your privacy settings let you download the available account-data export. To request account deletion, contact support. We manually verify the request, remove account-linked reports and media, and retain only the minimum payment, refund, dispute, and tax records required by law, without an account link where possible.

Photos you upload for a Complete Report purchase are kept only while that purchase is in progress. If the purchase is not completed, we delete them within a few days.

Hairstyle try-on works differently before and after you generate. A photo you add to the hairstyle tool stays in your browser and is not sent to us until you choose Generate. If you need to sign in or buy credits first, the photo and your chosen styles are kept temporarily on your own device and restored only when you come back from signing in or paying, then deleted right away. If you do not come back, they expire after 24 hours and are deleted the next time you visit our site. Once you generate, the photo and the hairstyle looks created from it are saved to your account until you delete them. You can delete a single look, a whole photo with its looks, or several at once, and account deletion removes them all.

You can also create one hairstyle look without an account, as a guest. The photo is sent to us and to our AI provider only when you press Generate, after you agree to photo processing. We delete the photo and the look from our own storage automatically within 24 hours, and they are never added to an account or to your saved looks. Our AI provider keeps its own copy only briefly under its default retention, currently about 1 hour, and then deletes it. We keep a small record of the guest try itself (that it happened, when, and which hairstyle and color) without any photo, so we can enforce the limit of one guest look per device. If you sign up afterward, the look you made as a guest is not carried into your account; your photo is restored from your own device so you can generate again with the free credit you have left. More detail is in the Guest try section below.

How Old Do I Look tool

The free age tool at /how-old-do-i-look works differently from everything described above. The photo you submit there is sent to our age-estimation service, held in memory only for as long as that single request takes, and discarded as soon as the estimate is returned. It is not written to a database, not saved to disk, not shared with anyone, and never used to train any model. You do not need an account to use the tool, so the photo is not linked to a person. We keep a request log with how long processing took, whether a face was found and how many, the estimated age rounded to a whole number, and the upload size and image dimensions. Your photo is never part of it, and neither is the real age you enter.

If you enter your real age to compare it with the estimate, that number stays in your browser and is never sent to us. The tool is for people aged 13 and over, and the result is an estimate of how old a face looks in one photo — it is not identification, not age verification, and not a health assessment.

When you use Style Look Lab, we collect:

  • Your Google account name, email, and profile picture, which support Google sign-in
  • The photos you upload and the report images we generate for you
  • If you try a hairstyle look as a guest: a random device identifier (kept in a cookie and in your browser's local storage), a one-way hash of your IP address, and your photo-processing consent record (Cloudflare processes browser signals for a human check, but we do not keep its result)
  • Your analysis results, credit balance, and purchase history
  • Standard web analytics through Google Analytics, including page views, referrer, device and browser type, and approximate country-level location
  • Product-usage insights through Microsoft Clarity, including anonymized session replays and heatmaps of mouse movement, clicks, and scrolling; typed input and sensitive fields are masked

Stripe handles payments on its own checkout pages. Style Look Lab never sees or stores your card number. We do not collect precise location, social media accounts, or biometric identifiers; the BIPA section below explains that distinction.

We use cookies that keep you signed in and make the product work, along with analytics cookies from Google Analytics and Microsoft Clarity that help us understand how the site is used.

We do not run advertising or cross-site tracking cookies, and we do not sell the information we collect.

You can create one hairstyle look without an account. To keep that fair and to remember that you agreed to photo processing, we use the following:

  • A guest device cookie. sll_gid holds a random identifier that links this browser to its guest consent record and its one guest try. It is HttpOnly, so browser JavaScript cannot read it; SameSite=Lax; Secure over HTTPS; and expires after about 400 days. Your browser's local storage also holds a random guest identifier and a flag that says the guest try has been used, so the page can show the right message. Neither contains your name, email, or photo.
  • A consent record. When you agree to photo processing as a guest, we store the time, the version of the consent text, your IP address, and your browser's User-Agent, linked to the guest device identifier, as proof of what you agreed to. We keep the IP address and browser information for at most 12 months, then erase them; the record of when you agreed and to which version stays.
  • An IP hash. To limit repeated guest tries from one network, we store a one-way hash of your IP address (an HMAC with a secret key, with IPv6 addresses shortened to their network part) and the time of the try. We use it only for that limit, and we delete these entries after 48 hours. We do not store your raw IP address for this purpose.
  • A human check. When you press Generate as a guest, Cloudflare Turnstile checks that you are a person. Cloudflare processes browser and device signals to do this, under its own privacy policy. Most visitors see nothing; some are asked to tick a box. We only learn whether the check passed in order to start your try; we do not save the result.
  • Safety checks. Guest photos go through the same automated safety check as other photos. If a photo is rejected, we record that it was rejected (never the photo) against the guest device identifier, so repeated attempts can be limited.
  • Photo and result. Deleted automatically within 24 hours, as described under Your photos. Our AI provider's own short retention (about 1 hour at the time of writing) applies to the copy it receives; we do not control its deletion schedule.

Clearing your cookies and local storage removes the identifiers from your browser. The record of the try itself (without any photo) stays on our side so the one-guest-look limit keeps working. If you then sign up, we use the guest device cookie once, at account creation, to give your new account one free look fewer if you already used the guest try, and to link that device record to your new account. We do not use the guest identifier for advertising or for tracking across other sites.

When a visitor opens a public report through a share link, we write one HTTP-only cookie, sll_attr_share_id, to remember the most recent share-link value they arrived with.

If that value matches a valid share ID and the visitor later creates an account, the cookie lets us credit the original share link as the source of the signup. The person who shared the report can then see which of their links brought new users in.

  • In links generated by Style Look Lab, the value is a 10-character base62 share ID. Style Look Lab does not add a name, email, location, device fingerprint, or other personal information to it. Do not put personal information in a manually constructed s parameter.
  • It is marked HttpOnly, so browser JavaScript cannot read it; SameSite=Lax, so it does not enable cross-site tracking; and Secure, so it is sent only over HTTPS. Only the Style Look Lab server reads it.
  • A valid attribution value is deleted as soon as signup completes. Otherwise, the cookie expires 30 days after it is written.

To estimate how many distinct people opened a share link, the server creates a short anonymous fingerprint at view time.

The algorithm combines the visitor's IP address, browser User-Agent, share-event identifier, and a server-side secret salt. The salt is held only in memory, never written to the database, and never committed to source control. The server hashes that combination with SHA-256 and stores only the first 96 bits, represented by 24 hexadecimal characters.

  • What we never store: the raw IP address, raw User-Agent, server-side secret salt, or another raw field that could be traced back to a specific person.
  • What we store: only the truncated hash. The server-side secret prevents someone with the stored hash alone from testing possible IP and User-Agent combinations offline.
  • How it is scoped: the share-event identifier is part of the hash. The same visitor opening two different share links produces two unrelated values, so this mechanism cannot follow a visitor across share links.

If you reside in California, you have the right to:

  • Know what personal information we hold. Your privacy settings provide an account-data export; for another access or correction request, contact Style Look Lab
  • Request deletion of your account and associated data by contacting support; we manually verify the request
  • Opt out of any "sale" of your data; Style Look Lab does not sell your data
  • Exercise these rights without losing access to other available features

We do not collect or store biometric identifiers. The AI reads color and proportion from a photo to produce style attributes. It does not generate a facial-geometry template or anything designed to identify you from your face.

See the full Biometric Information Policy for what the system does and does not extract.

Style Look Lab is currently focused on the North American market. EU visitors can use the service. The privacy settings provide an account-data export; contact support to request account deletion; for another access or correction request, contact Style Look Lab. We do not run localized EU marketing.

The latest version is always posted on this page. The date at the top shows when the policy was last reviewed, so you can tell when it changes.

For a question about this policy, a privacy request, or help using the account privacy tools, contact Style Look Lab.