Overview
VERASOMA provides personalised facial analysis as an aesthetic information service. This policy explains what we collect when you use our website and customer portal, how we use it, and the choices you have.
VERASOMA is operated by VeraSoma Inc. ("VERASOMA", "we", "us"). If you have questions about anything in this policy, contact us at support@verasoma.com.
Information we collect
We collect information in four categories:
- Account information. Your email address and the details you provide during sign-up: your date of birth, sex, and the background you choose to describe yourself with. These give your analysis the right context. Your background is sensitive information, so we ask for your explicit consent before we use it.
- Photo uploads. Up to seven photos you upload through the onboarding flow. Each is validated server-side for face detection, framing, and lighting before storage.
- Facial geometry (biometric information). From your photos we derive a map of your facial geometry — 478 landmark points — and the measurements calculated from it. This is biometric information, and we collect it only after you have given your written consent. See Your photos and facial geometry.
- Usage data. Standard server logs (IP address, user agent, request timing) and aggregated product analytics. We do not run third-party advertising trackers.
Use of your information
We use the information you provide to:
- Deliver your personalised facial analysis and any reports you have purchased.
- Compare your measurements against demographic cohorts so the analysis is meaningful.
- Maintain your account, process payments, and provide customer support.
- Improve the underlying analysis pipeline through aggregated, de-identified review.
We do not sell your personal information. We do not use your photos to train third-party models.
Your photos and facial geometry
Your photos, and the facial geometry derived from them, are the most sensitive data we receive. We treat them accordingly:
- Consent first. Before your first photo is uploaded, we explain what we collect, why, who processes it and how long we keep it, and we ask for your written consent. We do not capture a photo or derive facial geometry without it.
- One purpose. We use them only to produce your analysis, your Aesthetic Blueprint, and the generated images in your galleries. We never sell them, and we do not use them to train third-party models.
- Who processes them. The providers that run the analysis receive your photos for that purpose only — see Disclosure to third parties. Members of our team see them only when you ask for support that requires it.
- Stored encrypted at rest in a private storage bucket keyed to your account.
- We do not include identifiable photos in research aggregates without your explicit, separate opt-in.
- How long we keep them is set out in Data retention.
Disclosure to third parties
We share information only with the third-party processors needed to operate the service:
- Hosting and infrastructure: Vercel (web), Supabase (auth, database and photo storage), Google Cloud (processing).
- Analysis providers — these receive your photos. Anthropic (the written analysis), OpenAI (generated images) and Google Cloud Vision (profile measurement). They process your photos and the details that give your analysis context only to produce your results, and are bound not to use them for any other purpose.
- Payments: Stripe.
- Customer support: Intercom.
- Error monitoring: Sentry.
Each processor is contractually bound to use the information only to provide the service we requested. We may also disclose information when required by law or to protect the rights and safety of VERASOMA, our users, or others.
Business transfers. If VERASOMA is involved in a merger, acquisition, financing or sale of assets, your information may be transferred as part of that transaction. ⚠️ Your photos and facial geometry are not treated as an ordinary asset: any acquirer would be bound by the consent you gave and by this policy, and if the purpose for which we hold them were to change, we would ask for your consent again rather than assume it.
We do not use your photos or facial geometry to train models — ours or anyone else's. Aggregated, de-identified research use requires your separate, explicit opt-in, which you can withdraw at any time. There is no version of this policy under which a general acceptance of the terms counts as consent to that.
Security
Your data is processed and stored in the United States — our database and photo storage
on Supabase in AWS us-east-2, and image processing on Google Cloud in
us-east1. If you are in the EU, EEA or UK, your data is transferred to the United
States to provide the service. Full detail, including what we do and do not monitor, is in Security and data protection.
We use industry-standard administrative, technical, and physical safeguards: encrypted transport (TLS), encrypted storage, JWT-based authentication, and least-privilege internal access. No system is perfectly secure; we will notify you promptly if we identify a breach affecting your information.
Data retention
We keep your account information for as long as your account is active.
Photos and facial geometry. We keep your photos, the facial geometry derived from them and the analysis built on them while your subscription is active, because your history and progress comparisons depend on them.
We never keep them more than one year after you stop. When your subscription ends — whether you cancel it or it simply lapses — we keep them for one more year, so you can still open your results and pick up where you left off. At the end of that year we delete them, and everything generated from them, automatically. If you never had a subscription, that same year runs from the last time you used VERASOMA.
You can have them erased sooner, at any time. Email us and we delete your photos, the facial geometry derived from them, and everything generated from them, within 30 days. Deleting your account erases all of it as well. We keep a short record afterwards — your email address, your purchase history, and when you gave consent to process your photos — so a payment stays traceable and we can show consent was given. It contains no photos and nothing derived from them.
Aggregated, de-identified usage data may be kept indefinitely.
Your rights
You can exercise the following rights at any time by emailing support@verasoma.com:
- Request a copy of the data we hold about you.
- Correct inaccurate information.
- Delete your account and associated data.
- Withdraw your consent to our use of your photos and facial geometry. We will then permanently delete them, and everything derived from them, within 30 days.
- Withdraw any research-aggregation consent you have previously given.
Residents of the EU/EEA, UK, California, and other jurisdictions with similar laws have additional statutory rights. We honour those rights as required by law.
Children
VERASOMA is for adults. You must be 18 or older to create an account, and we do not knowingly collect information from anyone under 18. If you believe we have received information from a child, please contact us so we can remove it.
Changes to this policy
We may update this policy as the service evolves. The "effective" date at the top of this page reflects the most recent material update. We will notify users of substantive changes through the customer portal or email.
Contact us
VeraSoma Inc. — support@verasoma.com