Pandew Privacy Policy

Effective Date: 27 July 2026 · Last Updated: 27 July 2026 · Version 1.0

1. Scope and Application

1. This Policy applies to all Personal Information Processed by us in connection with the Pandew mobile application for iOS, the application programming interfaces operated at the domain pandew.app and its subdomains, and any related websites, features, content or functionality made available by us (collectively, the “Services”).
2. This Policy does not apply to information Processed by third parties whose products, services, websites or applications you may access through the Services, including without limitation the third parties identified in Section 8, each of which Processes information pursuant to its own privacy notices and terms.
3. Capitalised terms used but not defined herein shall have the meanings ascribed to them in applicable Data Protection Law.
4. In the event of any conflict between this Policy and a mandatory provision of applicable Data Protection Law, such mandatory provision shall prevail to the extent of the conflict, and the remainder of this Policy shall continue in full force and effect.

2. Definitions

3. Categories of Personal Information

3.1 Skin Profile Information

We Process attributes voluntarily supplied by you, including without limitation skin type, sensitivity level, sun exposure, dermatological concerns, stated goals, self-assessed experience level, available time, budget tier, and product preferences (including fragrance-free, vegan and minimal-ingredient preferences). You acknowledge that such attributes may constitute data concerning health within the meaning of Article 4(15) GDPR and may be treated as a special category of Personal Information under Article 9 GDPR.

3.2 Images

We Process photographic images of product packaging captured through your device camera or selected from your device photo library. Such images are transmitted to our servers and onward to the Processors identified in Section 8 for the purpose of optical identification and ingredient extraction. Images are not retained. Only the product attributes derived from an image are stored.

3.3 Account and Identity Information

Where you establish a Registered Account, we Process your email address, name and profile image as released to us by the applicable Sign-In Provider, together with authentication events, and a system-generated account identifier. Where you use an Anonymous Account, we Process only the system-generated identifier and an associated bearer credential.

3.4 Activity Information

We Process records of products added to your inventory, routine steps completed or omitted, associated timestamps, and derived adherence metrics.

3.5 User-Supplied Corrections

Where you edit, confirm or otherwise amend a product name following an identification attempt, we Process that correction and incorporate it into our shared product catalogue. Such corrections are stored against the product record and not against your Account, and are visible to, and may be relied upon by, other Users. You should not include Personal Information in any such correction.

3.6 Technical Information

We Process your Internet Protocol address and server request logs generated in the ordinary operation of the Services and, where you have enabled notifications, a device push notification token and the associated platform designation. For the avoidance of doubt, the Services do not transmit your device model, operating system version, application version or device language to our servers.

3.7 Anonymous Accounts and Merger of Records

The Services may be used without establishing a Registered Account. An Anonymous Account is nevertheless created on our servers, against which your Skin Profile, routine and product inventory are stored. Where you subsequently authenticate and no Registered Account previously existed for the relevant identity, the records associated with the Anonymous Account are attached to the resulting Registered Account. Where a Registered Account already exists for that identity, the records associated with the Anonymous Account are not merged and remain stored under the anonymous identifier. You may contact us to request erasure of such records.

3.8 Categories Not Collected

We do not Process precise or coarse geolocation data, contact lists, browsing history, payment card or financial account information, biometric identifiers, advertising identifiers, or the special categories of Personal Information enumerated in Article 9 GDPR other than as described in Section 3.1.

4. Sources of Collection

We collect Personal Information (a) directly from you, whether supplied through onboarding, in-application input, image capture or correspondence; (b) automatically through your use of the Services, including server logs; and (c) from Sign-In Providers, where you elect to authenticate through them and to the extent authorised by you.

5. Purposes of Processing

We Process Personal Information for the following purposes, including without limitation:

1. to establish, operate, maintain, secure and administer the Services and any Account;
2. to generate, sequence, adapt, explain and periodically regenerate skincare routines, including by reference to adherence records;
3. to identify products from images and to compile, correct, enrich and maintain our product catalogue;
4. to transmit notifications, reminders and service communications you have enabled or which are necessary to the operation of the Services;
5. to analyse usage of the Services and to develop, test, evaluate and improve existing and future products, features, models and functionality;
6. to provide support and to respond to your enquiries, requests and complaints;
7. to detect, investigate, prevent and remediate fraud, abuse, security incidents and violations of our terms;
8. to establish, exercise or defend legal claims and to comply with legal and regulatory obligations; and
9. any further purpose disclosed to you at the point of collection or to which you consent.

We may create aggregated, anonymised or de-identified information which does not permit the identification of any natural person, and may Process, retain, disclose and commercialise such information for any purpose and for an indefinite period, without restriction under this Policy. We undertake not to attempt to re-identify such information except as permitted by applicable Data Protection Law.

6. Legal Bases for Processing

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

Where we rely on consent, you may withdraw that consent at any time in accordance with Section 13, without affecting the lawfulness of Processing carried out prior to withdrawal. Where we rely on legitimate interests, we have conducted a balancing assessment and will provide further particulars on request.

7. Automated Processing and Artificial Intelligence

1. The Services employ third-party artificial intelligence Processors to generate routines and to identify products. Your Skin Profile is incorporated into the prompt transmitted for routine generation, and images submitted by you are transmitted for analysis.
2. We do not transmit your name, email address or account identifier to any artificial intelligence Processor. Such transmissions comprise Skin Profile attributes, product data and images only.
3. We utilise the paid commercial tiers of such Processors under terms which, as at the Effective Date, provide that content submitted through the relevant interfaces is not used to train their models. We do not otherwise control the practices of such Processors, whose own terms govern their Processing.
4. We reserve the right to engage, substitute, add or remove artificial intelligence Processors at our sole discretion and at any time, including providers not identified in Section 8, and to transmit to any such Processor the categories of Personal Information described in Section 7.1 for the purposes described in Section 5. The recipients identified in Section 8 reflect those engaged as at the Effective Date and are not a limitation on the foregoing. We will select such Processors with reasonable care and will impose obligations of confidentiality and security no less protective than those described in this Policy.
5. Hosted web search functionality is enabled in respect of routine generation and product enrichment requests, with the consequence that the applicable model may execute a web search in the course of responding. Such functionality is not enabled in respect of image analysis requests.
6. The outputs of such Processing are informational and do not constitute a decision producing legal effects concerning you or similarly significantly affecting you within the meaning of Article 22 GDPR. See further Section 17.

8. Disclosure to Third Parties

We disclose Personal Information to the following categories of recipient, each acting as a Processor or independent controller as indicated:

We may further disclose Personal Information:

1. where required by applicable law, regulation, legal process, subpoena or governmental request, or where we determine in good faith that disclosure is necessary to protect the rights, property or safety of Pandew, our Users or the public;
2. to professional advisers, including legal counsel, auditors and insurers, acting under duties of confidentiality;
3. in connection with any merger, acquisition, reorganisation, financing, insolvency or sale of all or part of our assets, in which case this Policy shall continue to apply to the Personal Information so transferred until superseded; and
4. at your direction or with your consent.

The identity of our Processors may change from time to time in the ordinary course of operating the Services, without prior notice to you and without amendment of this Policy. The foregoing table identifies our Processors as at the Effective Date and is illustrative of the categories of recipient engaged; it does not constitute an exhaustive or binding list. In particular, and without limitation, we may route any Processing described in Section 7 to any artificial intelligence provider we consider appropriate, whether or not named above, in any jurisdiction, subject to Section 10.

9. No Sale of Personal Information; No Tracking

1. We do not sell Personal Information, and have not sold Personal Information in the twelve months preceding the Effective Date.
2. We do not share Personal Information for cross-context behavioural advertising as that term is defined under the CCPA.
3. We do not track Users across applications or websites owned by other undertakings; we do not incorporate advertising or analytics software development kits; and we do not access the Identifier for Advertisers. Accordingly the Services do not present the App Tracking Transparency authorisation request.

10. International Transfers

We are established in Canada. Our Processors are established in the United States and other jurisdictions. Your Personal Information will accordingly be transferred to, stored in and Processed in jurisdictions which may not afford an equivalent level of protection to that of your jurisdiction of residence. Where such transfers are subject to the GDPR or UK GDPR, they are effected pursuant to appropriate safeguards within the meaning of Article 46 GDPR, including standard contractual clauses adopted by the European Commission, or pursuant to a derogation under Article 49 GDPR. A copy of the relevant safeguards may be requested in accordance with Section 20.

11. Retention

We retain Personal Information for such period as is necessary to fulfil the purposes set out in Section 5, including for the duration of the existence of your Account and thereafter for such period as is necessary to comply with our legal obligations, resolve disputes, protect our legal rights and enforce our agreements. Encrypted backups are retained on a rolling schedule and are overwritten in the ordinary course of operations. Aggregated, anonymised and de-identified information may be retained indefinitely.

12. Security

We implement technical and organisational measures appropriate to the risk, including encryption of data in transit, encryption of backups, authenticated access control and the principle of least privilege in respect of administrative access. Notwithstanding the foregoing, you acknowledge that no method of electronic transmission or storage is entirely secure, and that we do not warrant the absolute security of Personal Information. You are responsible for maintaining the confidentiality of any credentials associated with your Registered Account.

13. Your Rights

Subject to and in accordance with applicable Data Protection Law, you may have the right to: (a) obtain confirmation as to whether Personal Information concerning you is Processed and access to such information; (b) obtain rectification of inaccurate Personal Information; (c) obtain erasure of Personal Information; (d) obtain restriction of Processing; (e) object to Processing carried out on the basis of legitimate interests; (f) receive Personal Information in a structured, commonly used and machine-readable format and to transmit it to another controller; (g) withdraw consent at any time; and (h) lodge a complaint with a competent supervisory authority.

Requests may be submitted in accordance with Section 20. We will respond within the period prescribed by applicable Data Protection Law. We may require information reasonably necessary to verify your identity before giving effect to a request, and may decline a request to the extent permitted by law, in which case we will state our reasons.

Notifications. Authorisation for notifications may be withdrawn at any time through iOS Settings. Camera and photo library. Authorisations are granted per-permission at the operating system level and may be withdrawn at any time through iOS Settings; the identification functionality is unavailable absent such authorisation.

14. Deletion of Account

You may effect deletion of your Account and associated Personal Information from within the Services: on the Home tab, select the profile icon in the upper right, then select Delete account. Deletion removes your routine, Skin Profile, product inventory and adherence records from our live systems with immediate effect, and from encrypted backups as those backups are overwritten in accordance with Section 11. You may alternatively submit a deletion request in accordance with Section 20.

15. Regional Disclosures

15.1 European Economic Area and United Kingdom

The controller in respect of Personal Information Processed under this Policy is Pandew. We have not appointed a representative pursuant to Article 27 GDPR. You may lodge a complaint with the supervisory authority of your habitual residence, place of work or place of the alleged infringement.

15.2 Canada

We Process Personal Information in accordance with PIPEDA. You may direct a complaint to the Office of the Privacy Commissioner of Canada. Consent may be withdrawn subject to legal or contractual restrictions and reasonable notice.

15.3 California

The categories of Personal Information collected, the sources thereof, the business purposes for collection and the categories of recipient are set out in Sections 3, 4, 5 and 8 respectively. California residents have the right to know, the right to delete, the right to correct, the right to opt out of sale or sharing (which we do not undertake), and the right to be free from discrimination for the exercise of such rights. We do not use or disclose sensitive personal information for purposes other than those permitted under the CCPA. We do not have actual knowledge of any sale or sharing of the personal information of consumers under sixteen years of age. Authorised agents may submit requests in accordance with Section 20 accompanied by evidence of authority.

15.4 Do Not Track

The Services do not respond to “Do Not Track” signals, there being no tracking of the kind such signals are intended to address.

16. Children

The Services are not directed to, and we do not knowingly Process Personal Information relating to, any natural person under the age of thirteen (13) years. Within the European Economic Area and the United Kingdom, the Services are not directed to any natural person under the age of sixteen (16) years. Where we become aware that we have Processed Personal Information relating to such a person, we will effect erasure without undue delay. Parents and guardians may contact us in accordance with Section 20.

17. No Medical Advice

1. The Services provide general skincare guidance and information only. The Services do not constitute medical advice, do not diagnose, treat, cure or prevent any condition, are not a substitute for consultation with a qualified healthcare professional, and are not reviewed by any such professional.
2. Where you indicate that you possess a prescription product — including a topical retinoid such as tretinoin or adapalene — the Services will incorporate that product into your routine and propose a frequency and an escalation schedule. Any such schedule is generated automatically from information supplied by you. It does not constitute a prescription, a dose or clinical direction, and it does not account for any matter known to your prescriber. You must follow the directions supplied with the product and consult a physician or dermatologist before commencing, altering or discontinuing any prescription treatment.
3. You assume all risk arising from reliance on the Services, to the maximum extent permitted by applicable law.

18. Third-Party Services

The Services may contain links to, or retrieve content from, websites and services operated by third parties. We do not control, and are not responsible for, the privacy practices, content or availability of such third parties. Your access to such websites and services is governed by their respective privacy notices and terms.

19. Amendments

We reserve the right to amend this Policy at any time. Amendments take effect upon publication of the amended Policy bearing a revised Last Updated date. Where an amendment is material, we will provide notice within the Services or by email to the address associated with your Registered Account in advance of the amendment taking effect. Your continued access to or use of the Services following the effective date of any amendment constitutes your acceptance of the amended Policy. Where your consent is required by applicable Data Protection Law, we will obtain it.

20. Contact

Enquiries, requests in respect of the rights described in Section 13, and complaints concerning this Policy or our Processing of Personal Information should be directed to: support@pandew.app.