Aamey Biometric Privacy Notice

Provided by Joorus Inc. Address: 250 Consumers Road, Suite 719, Toronto, ON M2J 4V6, Canada GST/HST Registration: 712534965RT0001 Contact: [email protected] (Privacy Officer / DPO); [email protected] (general) Effective date: 2026-05-11 Version: 1.0.0

This Notice covers biometric data. It exists separately from the Privacy Policy because biometric information is subject to additional laws — including the Illinois Biometric Information Privacy Act ("BIPA"), Quebec Law 25, and the EU AI Act — that require special, written, informed consent.

DRAFT — pending licensed-attorney review with biometric-law specialization. Do NOT collect biometric data before attorney sign-off.

1. What we mean by "biometric information"

Within Aamey, "biometric information" includes:

• Face geometry — the 3D mesh of your face captured via your phone camera, professional dermatoscope, or other supported devices (Section 5b of the technical specs).
• Face embeddings — mathematical numerical representations derived from your face mesh used to recognize, match, or render your face.
• Dermatoscope, polarized, or multi-spectral images — close-up images of your skin captured by paired professional devices.
• 3D face renders — the 3D model of your face we generate from the above.

Photographs alone, without face-geometry processing, are not biometric information under this Notice (they are covered by the general Privacy Policy).

2. Why we collect biometric information

We collect biometric information only to provide and improve specific Aamey features that you choose to use:

1. Virtual try-on (AR) — overlay makeup, hair, and other products on your live camera feed.
2. Personalized recommendations — suggest products and looks that suit your face and complexion.
3. 3D face mockup — let you see a rotatable 3D model of your face.
4. Skin and feature analysis — identify skin conditions, brow shape, lash density, hair type, lip shape, eye shape, and undertone.
5. Personalized magazine — generate issues featuring you as the model (only with separate, additional consent).
6. Application monitoring — provide live feedback while you apply makeup.
7. Professional diagnostics — when an MUA, dermatologist, or institute lab paired a professional device to your account with your consent.

We do not use biometric information for:

• Advertising profiling or any third-party advertising
• Identification of third parties (facial recognition outside your own account)
• Sale to any party
• Law-enforcement requests, except under valid legal compulsion

3. Your prior, written, informed consent

Before Aamey captures any biometric information, you must:

1. Read this Notice (it appears on your screen the first time you initiate face capture).
2. Tap an explicit "I agree" button (e-signature equivalent to written consent).
3. Confirm the specific purposes you authorize.

We record your consent — the time, IP, device, version of this Notice, and the purposes — in our audit log. You may withdraw consent at any time (see Section 6).

If you are between the age of 13 and the age of majority in your jurisdiction, a parent or legal guardian must provide consent on your behalf through Aamey's verified parental-consent flow.

4. How we store biometric information

• Encryption at rest: all biometric data is encrypted with AES-256-GCM using keys managed in our secrets vault (Doppler); keys rotated annually.
• Encryption in transit: all transmissions use TLS 1.3 minimum.
• Access controls: automated systems access biometric data only to perform the features you authorized. Joorus engineering access requires a privileged-access ticket with audit logging.
• No plaintext to third parties: we never send raw biometric data to Anthropic, Stripe, marketplaces, or other sub-processors. Face data used by AI features is processed inside our own systems and is sent to Anthropic only as the minimum, ephemeral context required for the feature you requested — Anthropic has signed our Zero-Data-Retention (ZDR) agreement.
• Air-gap from advertising: biometric data is segregated from any analytics or marketing systems.

5. How long we keep it

Once retention expires (or you revoke consent), biometric data is hard-deleted within 24 hours, including from active databases, hot caches, and search indexes. Backups containing biometric data are deleted on the next rolling-30-day backup cycle.

This is well below the 3-year cap in Illinois BIPA and well below thresholds in Quebec Law 25.

6. Your rights

You may at any time, free of charge:

• Access — request a description of the biometric data we hold about you and its purposes.
• Revoke consent — withdraw your authorization for any or all purposes. Future captures will not proceed; existing data will be hard-deleted within 24 hours.
• Delete — request immediate deletion of specific items (e.g., all 3D renders, or one specific dermatoscope session).
• Restrict — limit processing while we resolve a question.
• Receive a copy in a machine-readable format.

Exercise rights via in-app Settings → Privacy & Data → Biometric Data, or email [email protected].

7. Sharing biometric information

We share biometric information only:

• With the professional you specifically authorize (e.g., an MUA you booked or a dermatologist using a paired device) for the duration and purpose of the engagement.
• With Anthropic as ephemeral context to power an AI feature you requested, under our ZDR agreement.
• As required by law or to comply with valid legal process.
• With your explicit, separate consent for any other purpose.

We do not sell or trade biometric information to any party.

8. Specific jurisdictional rights

8.1 Illinois (BIPA)

If you are an Illinois resident:

• You have the rights described above plus the rights under BIPA (740 ILCS 14/).
• You may bring an action under BIPA's private right of action. Damages can include statutory minimums of $1,000 (negligent) or $5,000 (intentional) per violation.
• Joorus's biometric data retention schedule is publicly available in this Notice.

8.2 Quebec (Law 25)

If you are a Quebec resident:

• Joorus has registered or is registering its biometric processing with the Commission d'accès à l'information (CAI).
• A Privacy Impact Assessment (PIA) has been completed prior to deploying biometric features in Quebec; an executive summary is available on request.
• You may file a complaint with the CAI: cai.gouv.qc.ca.

8.3 European Union / EEA (GDPR + EU AI Act)

If you are an EEA resident:

• Biometric data is a "special category" under GDPR Article 9 and requires explicit consent — which you provide via the consent flow described in Section 3.
• The EU AI Act applies to biometric categorization (e.g., skin-type classification). Joorus discloses to you when AI is processing your biometric data.
• You have the rights described above plus all GDPR rights. Joorus has appointed (or is in the process of appointing) an EU Representative; details are published at aamey.com/legal/subprocessors.

8.4 Texas (CUBI), Washington (HB 1493), and other US states

State-specific rights and recourses apply. Joorus complies with these as applicable.

8.5 California (CCPA/CPRA — biometric "Sensitive Personal Information")

You may instruct Joorus to limit use of your biometric Sensitive Personal Information to what is necessary to provide the service. Use the in-app "Limit the use of my Sensitive Personal Information" link.

9. Children

Aamey does not knowingly collect biometric data from anyone under 13. For users between 13 and the age of majority, verifiable parental or guardian consent is required.

10. Changes to this Notice

We will publish material changes at aamey.com/legal/biometric-notice and notify affected Users at least thirty (30) days in advance. Consent re-confirmation is required when changes expand the purposes or recipients of biometric data.

11. Questions

Privacy Officer / DPO: [email protected] General: [email protected] Address: Joorus Inc., 250 Consumers Road, Suite 719, Toronto, ON M2J 4V6, Canada.

(Phone number not published; available on counter-signed commercial agreements where required.)

End of Biometric Privacy Notice.