Privacy Policy

Effective 14 September 2026

Operator: MirrorVerse (Victor Benson) · Jurisdiction: United Kingdom

Overview

MirrorVerse is a real-time AR hair-studio that lets you try on hairstyles, analyse your hair type, and save looks you love. We are committed to collecting as little personal data as possible while delivering these features. This policy explains exactly what face and photo data we process, which third-party AI services receive it, where each service stores data, how long it is retained, and how you can delete it.

What face & photo data we collect

Depending on which features you use, MirrorVerse may process:

  • Selfies and photos you upload for AI hairstyle try-on or hair analysis.
  • Camera frames captured from your device camera when you use the Live AR mirror or the hair analysis scanner.
  • Face landmarks (on-device only) — facial landmark coordinates generated locally in your browser by MediaPipe for the live AR overlay. These are processed on your device and are never transmitted or stored.
  • AI-generated result images — the hairstyle try-on images returned by Perfect Corp / YouCam.
  • Saved looks — hairstyle configurations and thumbnail image URLs you choose to save to your profile.

MirrorVerse does not collect biometric identifiers used for identification. Face landmarks are computed on-device for AR rendering only and are never uploaded or stored.

How face & photo data is collected

  • Live AR camera — your device camera streams video to the screen for real-time hairstyle preview. Face tracking is performed entirely on-device using MediaPipe. The video feed is never recorded, uploaded, or stored.
  • Photo upload — you may upload a selfie for AI hairstyle try-on. This photo is uploaded to Base44 file storage and then sent to Perfect Corp / YouCam for hairstyle generation.
  • Hair analysis scan — a single camera frame is captured, uploaded to Base44 file storage, and sent to OpenAI (GPT-5.4 vision model) to classify your hair type. The frame is used only for that analysis.
  • AI try-on capture (Live screen) — tapping the AI button captures a single frame from your camera, uploads it, and sends it to Perfect Corp / YouCam for hairstyle generation.

Why face & photo data is used

Face and photo information is used only to:
  • Provide real-time AR hairstyle visualisation on your device (on-device, no upload)
  • Generate photorealistic AI hairstyle try-on images (Perfect Corp / YouCam)
  • Analyse your hair type, density, and length for personalised recommendations (OpenAI GPT-5.4)
  • Display and save hairstyle looks you choose to keep

MirrorVerse does not use your face data, photos, or face landmarks for advertising, marketing, profiling, or targeted advertising. Your photos are used solely to provide the hairstyle features you request.

Where your data is stored and processed — by service

The table below distinguishes MirrorVerse's own storage from each third-party service.

A. MirrorVerse (app database)

Purpose: Storing your saved looks, favourites, and hair profile

Data sent: Saved look metadata, hairstyle names, thumbnail image URLs, and classified hair profile fields

Stored: Stored in the Base44 platform database (servers located in the United States). Saved looks contain image URLs, not raw photo files.

Retention: Retained until you delete individual looks/favourites or delete your entire account.

Deletion: Delete from My Looks (trash icon) or Settings → Delete Account.

B. Base44 file storage (photo upload)

Purpose: Storage of uploaded photos for AI processing

Data sent: Your uploaded selfie or camera frame

Stored: Stored in Base44 PRIVATE file storage on servers located in the United States. Photos are NOT publicly accessible. A short-lived signed URL (valid for 5 minutes) is generated server-side so the AI provider can access the photo during processing, after which the URL expires.

Retention: Uploaded photos are NOT automatically deleted after processing. The Base44 platform does not provide a file deletion API. Base44's retention period for private file storage is not publicly documented. Photos remain in private storage (not world-readable) until Base44's own retention policies apply.

Deletion: MirrorVerse cannot programmatically delete uploaded photos from Base44 file storage, as no file deletion API is available on the platform. Photos are stored privately (not publicly accessible). AI-generated result image URLs are stored in your saved looks until you delete them.

C. Perfect Corp / YouCam (hairstyle try-on)

Purpose: AI hairstyle try-on — applies a selected hairstyle to your photo while preserving your identity

Data sent: Your source photo URL (selfie or camera capture) and a hairstyle reference photo URL

Stored: Processed on Perfect Corp servers located in the United States. Perfect Corp acts as a data processor, processing API data on MirrorVerse's instructions.

Retention: Perfect Corp generally retains API data for up to 30 days after completion of each service session, subject to Perfect Corp's stated exceptions. User content is not used for purposes beyond the stated policy, including model training.

Deletion: After the retention period, Perfect Corp deletes the API data per its stated policy. MirrorVerse cannot delete data held by Perfect Corp before that period expires — contact Perfect Corp directly if needed.

D. OpenAI — GPT-5.4 (hair analysis + AI stylist)

Purpose: AI hair analysis (classifies your hair type from a photo) and AI Hair Stylist (answers hair care questions and recommends styles)

Data sent: Hair analysis: your uploaded photo URL and a text prompt. AI Stylist: your hair profile (type, density, length) and your question — text only, no photos.

Stored: Processed by OpenAI on servers located in the United States. Data is encrypted at rest (AES-256) and in transit (TLS 1.2+).

Retention: By default, OpenAI retains API inputs and outputs (including the uploaded image) in abuse monitoring logs for up to 30 days, unless longer retention is required by law or is reasonably necessary to protect OpenAI's services or any third party from harm. This is OpenAI's default API retention policy — Zero Data Retention (which would exclude data from abuse monitoring logs) is available only to eligible Enterprise customers with prior OpenAI approval and is not applicable to MirrorVerse's standard API usage. OpenAI does not use API data to train or improve its models (as of March 1, 2023, unless you explicitly opt in, which MirrorVerse does not).

Deletion: OpenAI automatically removes API inputs and outputs from its systems after the retention period described above, unless legally required to retain them longer. MirrorVerse cannot delete data held by OpenAI before the retention period expires — contact OpenAI directly if needed. Deleting your MirrorVerse account removes data from the MirrorVerse database but does not delete data already held by OpenAI during its retention period. Note: Base44's own retention of InvokeLLM request data (prompts, image URLs, and outputs) is not publicly documented; MirrorVerse cannot guarantee whether Base44 retains this data separately beyond the OpenAI request.

E. MediaPipe (on-device face tracking)

Purpose: Real-time AR face tracking for the Live hairstyle overlay

Data sent: Nothing. No camera frames or face data are transmitted.

Stored: Face landmark processing occurs entirely in your browser. No face data is stored or uploaded.

Retention: Not applicable — no data is stored or transmitted.

Deletion: Not applicable — no data leaves your device.

Face data — summary of transmission

  • Photos/selfies may be uploaded to Base44 file storage when you use AI try-on or hair analysis.
  • Photos may be transmitted to Perfect Corp / YouCam for hairstyle generation (up to 30-day retention, US servers).
  • Photos may be transmitted to OpenAI for hair analysis (GPT-5.4 vision model; retained for up to 30 days for abuse monitoring by default, unless longer retention is required by law or harm prevention; not used for model training; US servers).
  • MediaPipe face landmarks are processed locally on-device and are not transmitted to any server.
  • Face/photo data is not used for advertising or marketing.
  • Face/photo data is not used for unrelated profiling.

Storage locations — summary

  • MirrorVerse app data (saved looks, favourites, hair profile): stored in the Base44 platform database, United States.
  • Uploaded photos: stored in Base44 private file storage, United States. Retention period is not publicly documented by Base44; photos are not automatically deleted after processing.
  • Perfect Corp / YouCam: processes and stores API data on servers in the United States, generally retained for up to 30 days.
  • OpenAI (hair analysis): processes API data on US servers, retains for up to 30 days for abuse monitoring by default (unless longer retention is required by law or harm prevention), then deletes. Not used for model training.
  • MediaPipe: on-device only — no server storage.

Deletion

You can delete your data at any time:

  • Delete saved looks — go to My Looks and tap the trash icon on any look.
  • Delete favourites — go to My Looks → Favourites and remove any item.
  • Delete hair profile — re-scan or clear your profile from the Analyse screen.
  • Delete your entire account — go to Settings → Delete Account. This permanently removes your account, saved looks, favourites, and hair profile from the MirrorVerse app database. Uploaded source photos stored in Base44 private file storage cannot be deleted by MirrorVerse, as the Base44 platform does not provide a file deletion API; they remain in private storage (not publicly accessible) until Base44's own retention policies apply.
  • Revoke AI consent — go to Settings → Face & Photo Data to revoke your consent for AI processing at any time. This prevents future AI transmissions but does not delete data already held by third-party providers.

Note: Deleting your MirrorVerse account removes your entity records (saved looks, favourites, hair profile, and user account) from the MirrorVerse app database. It does NOT delete uploaded source photos from Base44 private file storage, as the Base44 platform does not provide a file deletion API — those photos remain in private storage (not publicly accessible) until Base44's own retention policies apply. Account deletion also does not delete data already held by Perfect Corp (retained for up to 30 days per their policy) or by OpenAI (retained for up to 30 days for abuse monitoring by default, unless longer retention is required by law or harm prevention). Both third-party providers automatically delete data after their respective retention periods, subject to legal exceptions. MirrorVerse cannot guarantee deletion from systems outside its direct control.

Consent

Before any photo or face data is transmitted off your device, MirrorVerse requires your explicit, active consent:

  • Clear notice — a consent dialog explains what data will be sent, to which provider, and for what purpose.
  • Exact recipient named — the dialog names the specific third-party processor (Perfect Corp / YouCam for try-on, or OpenAI GPT-5.4 for hair analysis) before you consent.
  • Active consent — you must tap "Continue" to proceed. Consent is never preselected or assumed.
  • "Not now" prevents transmission — if you decline, no photo is uploaded and no data is transmitted to any third party. The feature simply does not run.
  • Revocation — you can revoke your AI consent at any time in Settings → Face & Photo Data. Revoking prevents future transmissions but does not delete data already held by third-party providers during their retention periods.

On-device face tracking (MediaPipe) does not transmit any data and therefore does not require consent for transmission — nothing leaves your device.

No advertising or marketing use

MirrorVerse does not use your face data, photos, or face landmarks for advertising, marketing, profiling, or targeted advertising. Perfect Corp / YouCam states that user content is not used for purposes beyond its stated policy, including model training. OpenAI states that API data is not used to train or improve its models.

Third-party protection

Our third-party AI providers — Perfect Corp / YouCam (hairstyle try-on) and OpenAI (hair analysis and AI stylist) — process your data to deliver the specific feature you requested. Perfect Corp acts as a data processor on MirrorVerse's instructions. Once your photo is transmitted to a third-party provider, it is subject to that provider's own privacy policy and data handling practices. MirrorVerse has limited control over data once it reaches a third-party provider's servers.

Account & authentication data

If you create an account, we store your email address. Authentication is handled securely by the Base44 platform. If you sign in with Google or Apple, we receive only your email and name — not your password.

Subscriptions

Premium subscriptions on web and Android are processed by Stripe. We do not store your full card details — Stripe handles payment securely. Premium is not available for purchase within the iOS app. On iOS, all premium-gated features are inaccessible and users are shown a neutral informational message — no external payment links are presented.

Children's privacy

MirrorVerse is not directed at children under 13, and we do not knowingly collect their data.

Contact

For privacy questions or data deletion requests, contact MirrorVerse at victors419er@gmail.com.
    base44
    Edit with Base44