PERBETE Privacy Policy

Last updated: October 23, 2026

This policy explains what PERBETE collects, why, how long we keep it, and what you can do about it.

"PERBETE", "we" and "us" mean the operator of PERBETE. The service is the website at perbete.com and any app that links to this policy.

Our Face and health data policy explains face photos from the camera and your health answers in more detail. Where this policy and that one differ on face or health data, that one wins.

1. The short version

• We use your answers to suggest skincare products by their ingredients.
• Some answers are about your health. We treat them as sensitive.
• The camera is optional. If you say yes, your photos are encrypted, and your photos and answers help train our skin AI. We keep photos for up to 3 years after your last visit, also if you delete your account, and then delete them. Sooner if you ask.
• We never sell information about you as a person for money. Like many websites, we use ad tools from Meta, Google and TikTok so our ads can reach people who may like PERBETE, including people who have visited our pages. These tools may learn which of our pages you open. Some pages are about a skin concern, such as acne or rosacea, so a page address can hint at what you were reading about. They never get your answers or photos. They stay off on our pregnancy-safe skincare guide and on the pregnancy question in the quiz. They also turn off when the birth year you give us shows you may be under 18.
• California also counts some sharing without money as "selling" or "sharing". Our ad tools are that kind, so we treat them as both. You can turn them off at any time with Your Privacy Choices (section 7).
• Your health answers and your photos are never used for ads. If we ever want to use your health answers in a new way, we will ask you first.
• We may make reports about big groups of people (for example, which concerns are common with oily skin). We may publish them, share them with brands or sell them. A report is never about one person and has no names.
• You can ask to see, fix or delete your information.
• If we make a big change to this policy, we'll tell you before it starts, by email (if we have your address) and on the site. Usually you don't need to do anything.
• PERBETE is for people 13 and older.

2. What we collect

2.1 What you tell us in the quiz

All quiz questions except your main skin concern are optional. You can skip them.

Some of these come from our short daily questions rather than the quiz. We call the bold rows sensitive information. Section 5 explains how we treat it.

2.2 Your account

You can use PERBETE without an account. If you sign in, we use Supabase to handle sign-in. You can sign in with your email address, or with a sign-in provider such as Google. We show only the sign-in buttons that are switched on.

When you sign in with a provider, we receive from it:

• a user ID,
• your email address,
• your name, if the provider shares it.

We show your name on the site to greet you. On My Page you can also type the first name you'd like us to call you. It's optional. It is kept with your answers: in your browser, and on our server when you are signed in. It is never used to choose your products, and it is taken out of the de-identified copy in 2.2A.

When you are signed in, we save your answers on our server so they follow you to other devices (if you are under 18, never your pregnancy answer: section 8). With them we keep the first name above if you typed one, the place you picked for your weather, your shelf, the style tags you picked, your parent-or-guardian tick and when you gave it, and a dated history of your earlier answers, so we can see how your skin and needs change over time.

When you agree to our Terms and this Policy while signed in, we record which version you agreed to, where you agreed (for example, the sign-in screen) and when. We use this record only to show what you agreed to.

2.2A A de-identified copy of each finished quiz

When you finish the quiz, we keep a de-identified copy of your answers to find where our suggestions go wrong and to improve them. It holds your answers, your age in years (90 and over is stored as "90+"), the month (not the day or time), the order in which you changed answers during the quiz, the camera's estimate and your correction, and your free-text note after we automatically remove email addresses, phone numbers, web addresses and street-address-like text. It does not hold your name, email address, IP address, a device identifier, or a link to your account.

Our promise: we will not try to re-identify anyone from these copies, and any company that handles them for us is bound by contract to the same promise. Together with removing the details above, these steps are how we keep the copy de-identified as Washington law describes it (RCW 19.373.010(10)).

2.2B Your routine history

Each time we make a routine for you, we keep a note of it, so we can learn which suggestions really help and fix the ones that don't. The note holds the answers the routine was made from, the place and weather we used (a nearby city, the ZIP code you typed, or the exact point your browser gave us if you let it share your location), the products we showed you, and which store links you tapped.

The note is linked to the quiz in this browser, to your account if you are signed in, and to your camera photos if you took any. The note itself does not hold your name, email address or IP address, but because it is linked to your account, it is your information and we treat it that way. We keep it only after you have agreed to our Terms and this Policy. Section 6 says how long we keep it.

2.3 The camera (optional)

The camera never turns on unless you slide to agree. One slide saves your answers and starts your AI skin read; sliding it means you consent to our Face and health data policy, which says what we collect, why, and for how long, and agree to our Terms and this Privacy Policy. If you tap Skip for now, no photo and no camera reading is sent. We keep only a short note that you said no: your choice, which version of the text you saw, the language and the time.

If you slide to agree:

• Your browser sends a few photos of your face to our server.
• Our server estimates your age range and a gender estimate from them. Your browser also measures skin tone and sends that number.
• We may keep up to 3 photos, encrypted, and the numbers we measured.
• We may keep the answers you choose after the camera suggests them, so we can see where the camera was wrong.
• We keep a record of your consent: what you agreed to, which version of the text you saw, when, and in which language.

We use the photos to fill in answers you can change, to track your skin age over time, to improve our recommendations, and, together with your answers, to train our skin AI so it reads skin more accurately. The same yes lets you play our face games once they launch; in a game your device follows your face, nothing from that tracking is stored or sent to us, and a game may take a photo for your skin-age tracking. Where your yes is saved to your account, we do not ask again on your other devices where you are signed in, and taking it back takes it back on every linked device. We may keep your photo together with your answers, your location and that day's weather to improve our recommendations. Your location here is the ZIP or postal code you typed, or, if you let your browser share your location, the exact point your browser gave us. We keep photos for up to 3 years after your last visit, then delete them. If you delete your account, we keep them, without your name, for up to 3 years from that day, then delete them. We delete them sooner if we no longer need them for the uses above, or if you ask. What the camera read from them stays after that (section 6). We do not use them to identify you.

To read a photo, our server first finds where your face is, so it can cut out the face area and check that you are facing the camera. While it does this, it notes where a few features are, such as your eyes and nose, for a moment in memory. We never store those positions. We keep only the photos (encrypted) and the numbers listed above, including photo quality.

2.4 Collected automatically

• Browser storage. We store your quiz answers and the changes you made while answering, your camera consent ID and a camera delete key, an email address you started to sign up with, the days you visited (for your streak), your shelf and coin tasks, a random device ID for paid AI checks (`perbete_ai_device`, see IP address below), and a few screen settings in your browser (localStorage). This is how the site remembers you without an account. Clearing your browser data removes them.
• Sign-in cookie. If you sign in, Supabase sets a cookie that keeps you signed in.
• Our own small cookies. `perbete_ref` keeps a friend's invite link for up to 400 days, so your friend gets the credit. `perbete_routine` remembers for up to 400 days that you finished a routine, so our home page can take you back to it. `NEXT_LOCALE` remembers your language. `perbete_reads` is set only while you are signed out and lasts 30 days. It counts how many product and ingredient detail pages you opened and the day you first saw your result, so we know when to ask you to sign up. It holds only the times of those visits, and only our site can read it. `perbete_ai_device` lasts up to 1 year. Our server sets it the first time you use photo search, purchase proofs or reviews, or look at how many AI checks you have left. It holds only a random ID for your device (see IP address below).
• IP address. Our server uses your IP address to limit how many requests one connection can make. This protects the site from abuse. We do not store your IP address itself in our database. Paid AI checks (searching with a product photo, reading a purchase proof and checking a review) have a monthly limit, so one person, device or network cannot use more than its share. To count those uses, we store, for each month, a use count next to three scrambled codes: one made from your IP address, one from your device ID and one from your account. Each is made with a secret key (a method called HMAC), and without that key a code cannot be turned back into your IP address. Our hosting providers (section 4) may keep it in their server logs for a limited time, under their own rules.
• Your rough area, for local weather. On the weather step we use your internet connection (your IP address) to guess the city you're near, so we can show the weather, UV and air around you. It's only a rough guess: a nearby city, never your street or home. We use it just to look up the weather and don't keep your IP address for it. Not right? Tap Change and pick your place, or skip it. Your browser remembers the place you choose, so you don't have to pick it again. The guess uses IP Geolocation by DB-IP (db-ip.com), with place names and time zones from GeoNames (geonames.org). Both are shared under the Creative Commons Attribution 4.0 license (CC BY 4.0, creativecommons.org/licenses/by/4.0/).
• Public weather and map services. To look up your weather, UV and air, our server sends only a ZIP code or a map point, never your name or IP address, to public services: the US Census Bureau's map lookup, the National Weather Service, the EPA's UV index, AirNow and the Norwegian weather service (MET Norway). Credits: the weather forecast is based on data from MET Norway (api.met.no; NLOD 2.0 and CC BY 4.0). Climate averages for your area come from the NASA Langley Research Center (LaRC) POWER Project, funded through the NASA Earth Science Division (power.larc.nasa.gov). Typical UV levels by month come from the TEMIS UV climatology, Copyright © KNMI/ESA (temis.nl). US weather comes from the US National Weather Service (weather.gov; public domain), the US UV forecast from the US EPA UV Index, and US air quality from AirNow (US EPA). None of them endorses PERBETE.
• Camera tool files. When the camera starts, your browser downloads the files that find a face from jsDelivr and from Google's file storage. Like any website you load files from, they see your IP address. No photo goes to them.
• Ingredient list checker. We don't keep the ingredient list you paste. We keep only the names in it that we don't know yet (web and email addresses are dropped), with how many times and on which days they were pasted, so we can add them to our dictionary. They are not linked to you.
• Region from IP (planned, not built). We may later use your IP address to estimate your US state, so we can show the right consent screen for your state. We will update this policy before we do.

• Usage analytics (PostHog). We see which pages people open, where they click and scroll, and where they leave, so we can fix confusing screens. PostHog gets the page address without its query codes, except the `utm_` tags that say which link or ad brought you. It also gets a few steps with a random browser ID: which quiz question you are on (never your answer), when you see your result, which product pages you open, which store you tap to buy and the product, when you make or open a share card, the steps of installing our app, which way in you tap (the quiz or a product search), that a product search started (never the words you typed), and the outcome of a purchase proof (counts and coins only, never the photo or the words on it). Each step also carries one label for the kind of visit: new, back after seeing a result, back with a saved product, or signed in. Some visits are recorded as a screen replay. In replays every typed field and all text on the page are hidden, and photos, video and the camera screen are not recorded. We do not use it for advertising. It stays off if your browser sends Global Privacy Control or Do Not Track, and you can turn it off with the switch at the end of this page.

• Visit counts (Google Analytics). We count visits and see how people move through PERBETE, so we can tell what works. Google Analytics gets the page address with its query codes removed (we keep only the `utm_` tags that say which link or ad brought you, and never the part after a `#`). That includes quiz pages: Google can see which quiz question you are on, for example the allergy question, but never your answers. It also gets five step names with nothing attached (quiz_start, quiz_complete, scan_started, sign_up and promo_video_80, which means most of our short home video was watched), Google's own basic events (first visit, visit start, time on page), and what Google calls enhanced measurement: how far you scroll, which links to other sites you tap (for example a store link, with its address), file downloads and video plays. Google's script also reads, on its own, the page title, the site that sent you here, your browser and device type, screen size and language. It sets its own cookie with a random browser ID, which lasts up to 2 years. Google uses your IP address to guess a rough area, and says it does not store it. We set Google Analytics to keep these records for 2 months.
• Google signals and Google Ads. We also turn on Google signals and link Google Analytics to our Google Ads account. So if you are signed in to a Google account that allows personalised ads, Google can connect your visits across your devices, show us broad groups for all our visitors together (such as age ranges and interests, never who you are), and help our Google ads reach people like you. You can change this in your Google account's ad settings, and with the switch at the end of this page. Google signals, ad personalisation and Google Ads turn off when the birth year you give us shows you may be under 18.
• When Google Analytics is off. It stays off if your browser sends Global Privacy Control or Do Not Track, or if you turn off the switch at the end of this page. It never runs on the sign-in and password pages, the camera hand-off page, the skin card page, the pregnancy question in the quiz or our pregnancy-safe skincare guide.
• Heatmaps and screen replays (Microsoft Clarity). To see where people tap, how far they scroll and where a screen confuses them, we use Microsoft Clarity. It records taps, clicks, scrolling, mouse movement and the layout of the page, as a heatmap and as a screen replay. Every box you type into is hidden. On the quiz, your result and My Page, all the text on the page is hidden too, and the camera pages and the skin cancer question are never recorded. We send Clarity none of your answers. Clarity's script also reads, on its own, the page address, the site that sent you here, your browser, device, screen size and IP address (for a rough area), and sets its own cookie with a random browser ID that lasts up to 1 year. Microsoft keeps these records under its own privacy statement. Like Google Analytics, it never runs on our pregnancy-safe skincare guide, the pregnancy question in the quiz, the sign-in and password pages, the camera hand-off page or the skin card page, and it stays off in the same cases listed above.

• Ad tools (Meta, Google Ads, TikTok). To show our ads to people who may like PERBETE, including people who have visited our pages, and to see which ads bring visitors, we use the ad tools of Meta (Facebook and Instagram), Google Ads and TikTok on our pages. When you open a page, they may get the page address, the page title, the site that sent you, your browser and device, your IP address and their own cookie IDs. This includes our pages about a skin concern or condition, such as acne, rosacea or eczema, so the page address or title may show which one you opened. Opening a page does not mean you have that concern, but the tools may still guess. When you start or finish the quiz, start a scan, sign up or watch most of our short home video, they also get that step's name, with nothing attached. If you are signed in to one of these companies in the same browser, it may link your visit to your account there and use it to choose the ads you see, under its own privacy policy. They never get your quiz answers, your photos, or what you told us about pregnancy or skin cancer. Ad tools stay off on the same pages and in the same cases as Google Analytics above. They also turn off when the birth year you give us shows you may be under 18 (section 8).

• Error reports (Sentry). When a page breaks, an error report is sent so we can fix it: what broke, the page address without its query codes, your browser and device type, and the server calls just before the error. It never includes your quiz answers, what you tapped, your account details or photos, and it is not used for analytics or advertising.

2.5 Waitlist

If today's free formulas are gone, you can join a waitlist. If you give an email address, we store it with the date. We do not email waitlist members yet.

2.6 Product photos, barcodes and reviews

• Product photo search and barcode scans. When you search with a photo of a product or scan a barcode, we may keep the photo, the barcode number and the product we found. We use them to recognize more products and to fill in product details. These are pictures of products, not of you, so please keep faces out of the frame. If a person shows up anyway, we keep the photo as it is: we never measure or recognize faces in it, and we never use it to build or train any face tool, including our camera. If you delete your account or your photos, we keep the product photos but remove their link to your account. You can also ask us to delete them: privacy@perbete.com.
• Purchase proofs for coins. You can send a photo of a product you bought to earn coins. Sending a receipt or an order screen is off for now. The parts below about receipts and order screens apply once we turn that option on. From a product photo, an AI reads only the brand, the product name and, if one is printed, the batch code. From a receipt or an order screen, it reads only the store, the date, the total (with tax and subtotal), the currency, the order number and the items (see section 4). We also check the photo's capture date and whether it looks edited, made by AI or copied from the web. The AI is told to skip anything personal it sees, such as names, addresses, card numbers and loyalty numbers, so we do not save them as data; they stay only inside the photo until the photo is deleted (section 6). We use what it reads to check the purchase, add your coins, put the products on your shelf and stop the same purchase being used twice. Our team may look at a photo you send to confirm a purchase or prevent misuse, for example when the AI is not sure. Purchase-proof photos, including product photos you send for coins, go only to OpenAI and Google, never to any other reader (section 4). A photo may show a person, for example a hand holding the product. We keep the photo as it is. We never measure or recognize faces in it, and we never use it to build or train any face tool, including our camera. Whatever your age, we do not sell this information, share it for ads or use it for ads.
• Reviews. When you post a review, we keep your words, your stars, any photo you add and the name you choose to show. Next to your review, everyone sees your skin type and your main skin concern from your answers, so shoppers can find reviews from people like them. Later you may pick these one time in your profile, and they will show on each review you post. We never show your birth year or exact age. We may add a "match my skin" filter that helps shoppers find reviews from people like them. It may also use your age range in the background. Your age range never shows on your review, but a shopper using the filter may see your review among reviews from people in their own age range. Before a review shows to others, an AI reads the words first (see section 4); if it is not sure, or cannot run, our team checks it. You see your own review right away, marked as being checked.

2.7 Coins

You can earn coins for things you do on PERBETE, and spend them to open extras, for example the 3D trust net for a routine. We keep your coin balance, what you earned coins for, and what you opened with them. Coins have no cash value (see our Terms, section 7B). Section 6 says how long we keep this. Ingredient safety information is always free and never needs coins.

2.8 Creator program (planned)

We plan to open a creator program for people 18 and older. If you join, you choose to have a public creator profile: the name and photo you pick, the routines and posts you share as a creator, and the badges you earn. Anyone can see it. Creators get coins, badges and featured routines, not money. We will not show your answers, your age or your health information on your profile unless you post them yourself.

2.9 Brand trials and surveys (planned)

Later, a brand may pay us to run a product trial or a survey on PERBETE. It will always be clearly labelled, and you choose whether to join. We will ask you before we give a brand your name, your address or your answers.

3. How we use it

• To make recommendations. Your answers decide which ingredients and products we suggest, and which we leave out. For example, a pregnancy answer changes which ingredients we flag. A skin cancer answer makes us leave out products with an ingredient that has an official cancer classification.
• To improve our models. Your photos and answers train our skin AI. When the camera guesses something and you correct it, the difference helps us make it more accurate. We use photos only if you agreed to the camera.
• To learn what works. Your routine history (2.2B) shows us which suggestions help, so we can make them better.
• To run and protect the service. Sign-in, keeping your answers, rate limits, fixing bugs.
• To reach new people. Ad tools (2.4) help our ads reach people who may like PERBETE.
• To make group reports. We may count answers across many people to show trends, for example which skin concerns are most common with oily skin, or which ingredients people look up most this month. Each group in a report has at least 30 people. A report never describes one person, and never uses face photos or anything the camera measured. Reports are de-identified: we will not try to find out who anyone in a report is, and anyone who gets a report from us must promise the same. We may publish these reports, share them with brands, or offer them for a fee.
• To follow the law.

We do not:

• sell information about you as a person for money,
• sell or give a brand information about you as one person, unless you say yes to that on its own (section 2.9),
• use or share your health answers, your photos or your face data for ads,
• sell, rent, trade or otherwise profit from face photos or face data,
• give you rewards, coins or payment for face photos.

4. Who we share it with

We share information with service providers that run parts of PERBETE for us, under contract, and with the ad companies and public services named below:

We do not use any other AI reader today. If we add one, we will list it here, with what it gets, before it gets anything.

We may also share information if the law requires it, to protect people's safety, or as part of a merger, a sale, or a move of PERBETE to a new company. If that happens, we will tell you first, your information stays under this policy, and face photos and face data are never sold.

Retailer links. Our product pages link to retailers such as Amazon. Some Amazon links are affiliate links: if you buy, we may earn a commission. As an Amazon Associate, PERBETE earns from qualifying purchases. When you click, you leave PERBETE. The retailer's privacy policy applies there. We do not send your quiz answers to retailers.

5. Sensitive and health information

Your answers about skin concerns and conditions, pregnancy, menopause, allergies and skin cancer can be "consumer health data" under Washington's My Health My Data Act and Nevada law (SB 370). Your skin tone, ancestry and health answers can be "sensitive personal information" under California law. Face photos are biometric information under Illinois BIPA and similar laws.

For this information:

• Every one of these questions is optional.
• Each question says on the spot why we ask.
• We use it to make your recommendations and, for camera data, to improve our camera. Health answers may also be counted, with no name and no link to you, inside group reports (section 3) that never describe one person.
• We do not sell it, and we never use it or share it for ads.
• If we ever want to use it for something new, we will ask you first, on its own, and you can say no.
• You can delete it (section 7).

Your shelf and purchase proofs. The products you save, or show us you bought, can hint at your skin or health, for example an acne treatment. We treat this list the way we treat health information: we use it only for your recommendations, your coins and to stop fraud, and we never sell it or use it for ads.

Your consent to face and health data. Washington, Nevada and some other states ask for your consent before we collect consumer health data. One consent covers your face photos and your health answers. Its line names our Face and health data policy and links to it; that policy says what we use the data for, who handles it and how to take your consent back. You give it on the camera screen with the slide that starts your AI skin read; if you skip the camera, with the Agree and see my routine button. If you sign in first, the line under the sign-in button covers your health answers, and your face photos always get their own slide on the camera screen. Every health question is still optional, so you can skip any of them. You can take your consent back at any time by emailing privacy@perbete.com. From then on we stop collecting face photos and health information from you, and we delete your face photos (the pictures themselves). What the camera already read from them and your answers stay without your name or email, so they are no longer linked to you. De-identified quiz copies (2.2A) have no link to you either, so they stay. Washington residents also have a right to a separate Consumer Health Data Privacy Policy. Ours is the Face and health data policy.

6. How long we keep it

7. Your choices and rights

Anyone can:

• Delete your face photos from any device: email privacy@perbete.com. We delete the photos themselves. What the camera already read from them stays (section 6).
• Delete your account in the settings on My Page. For 30 days you can bring it back by logging in again with the same email. After that we delete your name, email and sign-in, and your shelf, coins, check-ins and streaks. Your saved answers and their history, your routine history and what the camera read from your photos stay, without your name or email. Your face photos also stay without your name, for up to 3 years from that day, to train our skin AI, and then they are deleted. After the 30 days we can no longer tell which photos were yours, so if you want them deleted, email privacy@perbete.com within those 30 days. A few other things stay, with no name and no link to you: your reviews (no longer shown), what we read from purchase proofs and their fingerprints, product photos from search, and de-identified quiz copies (2.2A). Records of which Terms you agreed to stay for 10 years, under a code instead of your account number, and longer only while the law makes us keep them for a dispute. Section 6 has the details.
• Change or clear answers by retaking the quiz or clearing your browser data.
• Your Privacy Choices: turn off ad tools and analytics. Use the switch at the end of this page (the Your Privacy Choices link at the bottom of our pages takes you there), or turn on Global Privacy Control in your browser. Either one stops Google Analytics, Microsoft Clarity and the Meta, Google Ads and TikTok tools on PERBETE in that browser. This is also how you tell us "Do Not Sell or Share My Personal Information".
• Email us to delete your face photos or your account from any device: privacy@perbete.com (the address is also in the settings on My Page).
• Ask us to see, correct or delete your information: privacy@perbete.com.

California residents (CCPA/CPRA) have the right to:

• know what personal information we collect, use and disclose,
• delete it,
• correct it,
• limit our use of sensitive personal information (we use it only to provide and improve the service and, without names, in group reports),
• opt out of "sale" or "sharing". We never sell your information for money. But California law counts more than money: letting ad tools (2.4) collect information on our pages for ads can count as "selling" and "sharing". So we treat our ad tools as both. In the last 12 months, what they may have received is in the Meta, Google Ads and TikTok row of section 4: identifiers (IP address, cookie IDs) and internet activity (page addresses and titles, the site you came from, step names), plus browser and device details. To opt out, use Your Privacy Choices (the switch at the end of this page) or Global Privacy Control; we treat either as your request,
• not be treated differently for using these rights.

Washington and Nevada residents can confirm whether we collect their consumer health data, see it, delete it, and withdraw consent.

Illinois residents: we collect face photos only with your written consent on the camera screen, keep them no longer than the schedule above, and never profit from them.

Other states such as Virginia, Colorado, Connecticut, Texas and Oregon give similar rights. Wherever you live, you can ask us to see, correct or delete your information, and we will answer.

We may keep some information after a delete request when the law allows it, for example to meet a legal duty or to prove what you agreed to if there is a dispute. Section 6 lists what stays and for how long.

We will verify requests before acting on them. You can use an authorized agent. We answer within the time the law requires. If we deny a request, you can appeal by emailing privacy@perbete.com.

8. Children

PERBETE is for people 13 and older. The birth year picker does not offer years under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 gave us information, contact us and we will delete it.

For users aged 13 to 17:

• Before your answers are saved or the camera turns on, you confirm that your parent or guardian says it's OK.
• Once you tell us your birth year, we turn off the ad tools from Meta, Google Ads and TikTok for you, and Google signals. Google Analytics and Microsoft Clarity still run as described in 2.4.
• The quiz does not ask you about pregnancy. If you use the small pregnancy switch on your result, your answer stays on your device. We use it only to filter that list. We never save it on our server: not in your account, not in the copies and notes in section 2. The same goes for anyone who has not told us a birth year that shows they are at least 18.
• A parent or guardian can ask us to see or delete a teen's information: privacy@perbete.com. A pregnancy answer is not part of this, because we never keep it.

9. Security

• Face photos are encrypted before they are stored (Fernet: AES-128 with an integrity check). The key is kept out of our code.
• Data travels over encrypted connections (HTTPS).
• Your saved answers can be read only with your own sign-in token.
• We keep encrypted backup copies of our database so we can recover if something breaks. Every week, one encrypted copy is saved on our own backup drive, outside the cloud where the service runs. The key that unlocks it is kept in a separate place. Every month we test that a backup can be restored. Section 6 says what happens to deleted information in a backup.

No system is perfectly secure. We will notify you and the authorities of a breach as the law requires.

10. Where data is stored

Our service providers in section 4 store and process data for us. They may do this in the United States or in other countries where they operate.

The AI readers in section 4 may process what we send in other countries.

11. Changes

We may update this Policy from time to time. We'll post the new version here with its date. For a big change, we'll tell you before it starts: by email if we have your address, and with a notice on the site or in the app. Usually you don't need to do anything; continuing to use PERBETE means you accept the new version.

If a change would use information we already hold in a very different way, we will ask you first where the law requires it. For your health answers and your face photos we always ask first: if we ever want to use them for a new purpose, for example for ads, we ask you on its own, and nothing changes for you unless you say yes.

12. Contact

PERBETE · privacy@perbete.com