Privacy Policy

Photos and submitted content

Your uploaded front-facing and side-profile photos, questions, messages and other content you choose to submit.

Analysis and generated content

Facial points, coordinates, measurements, scores, appearance estimates, generated hairstyle and styling previews, written reports and improvement plans.

Progress and preferences

Progress saves, comparison records, hairstyle reactions and feedback linked to your results.

Account and authentication

Email address, account identifier, sign-in and session records, and the identity information returned when you choose Google sign-in.

Payments

Subscription plan, transaction references, amounts, currency, tax information, payment status, cancellation, refund and dispute records.

Technical and security information

IP address, browser and device information, request times, session or recovery identifiers, usage counts, errors and security events needed to operate and protect the service.

Consent and requests

The purpose, version and time of permissions, withdrawals, privacy requests and deletion actions.

Support and safety

Correspondence, abuse reports, appeals and the minimum records needed to document decisions and actions.

We do not receive or store full payment-card numbers or card security codes. Waffo handles payment-card information.

Photos and facial measurements can be sensitive personal information. Their legal classification depends on the data, processing and law involved. We do not assume that every photograph is a legally defined biometric identifier.

We use personal data to:

• Process the photos you authorize, calculate measurements and deliver reports, plans, previews and answers.
• Maintain the history and progress records you choose to keep.
• Authenticate access and protect private results.
• Administer allowances, subscriptions, payments, cancellations and refunds.
• Respond to support requests and exercise privacy rights.
• Detect abuse, enforce our content rules and investigate security problems.
• Meet accounting, tax, payment and other legal obligations.
• Maintain evidence of consent, withdrawal and deletion.

For processing governed by laws requiring a stated legal basis, we rely on:

Account administration, requested service delivery and billing

Performing our agreement with you.

Photo processing and processing requiring specific permission

Your consent, including express consent when required for sensitive data.

Security, fraud prevention, troubleshooting and necessary service communications

Our legitimate interests in operating a safe, reliable service, subject to your rights.

Required financial records and lawful regulatory obligations

Compliance with legal obligations.

Nonessential analytics, public testimonials and other separately authorized uses

Your separate consent.

We may use genuinely anonymous or aggregate statistics to understand service performance. Removing a name alone does not make information anonymous.

We do not use appearance scores or estimates to make decisions about employment, credit, insurance, housing or similar significant opportunities.

Before processing your photos, we explain the relevant purpose and request the required permission. Consent to photo processing is separate from recurring-billing authorization, nonessential analytics, public quotation and model training.

We process your photos and derived facial information to provide the analysis and previews you request. Face measurements and preview-quality comparisons are not used to establish your real-world identity or create a database for recognizing people across accounts.

Your photos are not necessarily confined to your device. Requested analysis, image generation, safety checks and storage can require transmission to service providers.

Our AI providers may not use your photos or identifiable analysis data to train their own models. This restriction does not mean that every provider has zero retention.

Showra uses your content to deliver the service by default. Any future use for our own model training requires separate, voluntary consent that you can withdraw. Refusal does not affect your purchase or features.

We do not sell your photos, facial measurements or biometric information.

We disclose only the information needed for the relevant service or purpose.

Waffo Pancake, our Merchant of Record

Payment, billing, invoice, tax, refund and dispute information. Waffo handles payment collection, invoices and transaction taxes under its own responsibilities.

AI image-generation providers (Meta Muse; fallback Black Forest Labs FLUX or Google Nano Banana / Gemini)

Authorized source photos and the instructions needed to create requested hairstyle or styling previews.

AI analysis and language-model providers (OpenAI GPT, Alibaba Qwen)

The authorized photos, measurements, report context and questions needed to produce requested explanations and answers.

Content-safety providers (Microsoft Azure AI Content Safety)

Submitted and generated content needed to check compliance with our safety rules.

Hosting, database, private-storage and security providers

The website requests, account records, private assets and technical information needed to operate and protect Showra.

Email-delivery providers

Email addresses and message content needed to deliver sign-in and service messages.

Google, when you choose Google sign-in

Information needed to authenticate your Google account. Showra does not request access to Google Photos.

Waffo explains its handling of personal information in its Privacy Policy. Google explains its practices in its Privacy Policy.

We may disclose necessary information to comply with a binding legal obligation, respond to lawful requests, protect people from harm or establish and defend legal claims. Such disclosures remain subject to restrictions that apply to photos and biometric information.

We do not publish your private photos, reports or feedback for advertising or testimonials without separate permission. A website quotation requires permission for the particular text and attribution being published.

Links to independent websites are governed by those websites’ policies. Using a service provider does not remove Showra’s responsibilities for its own processing.

We use necessary browser storage and session or recovery identifiers to support authentication, private access, security and service operation. Blocking or clearing them may prevent sign-in or remove your ability to recover an anonymous result.

Nonessential analytics requires your permission before it loads. Declining that permission does not prevent necessary sign-in or payment functions.

You can withdraw analytics permission by emailing support@showra.app. Browser settings also let you clear stored identifiers, although clearing storage alone does not request deletion of server-held data.

We retain personal data only for the stated purpose and the periods below. An earlier legal destruction deadline takes priority. Canceling renewal does not automatically delete history, and financial retention does not extend the retention of photos.

Temporary uploads and unfinished materials

Kept while needed to generate or recover the task. Cleared within 24 hours after the task ends and necessary saved copies are ready; canceled-task materials are cleared within 24 hours after cancellation. Late-arriving files are cleared within 24 hours after arrival.

Anonymous basic results and associated photos

Recoverable for 48 hours after successful result generation. Access requires the original browser credential or a secure recovery link. Expiry ends recovery; signing in does not restore expired or deleted data.

Signed-in results, photos and measurements

Kept while the disclosed account-history purpose remains necessary. We review that necessity every 12 months and act sooner on deletion, withdrawal or the end of the purpose.

Full reports, generated previews and improvement plans

Kept while a valid report-history purpose remains. Cancellation alone does not erase them. Refunds or reversals can change access to content associated with the affected payment.

Progress saves and associated photos

Kept for your authorized tracking purpose. Removing one use does not remove a shared asset still needed for a separate valid use. Withdrawing all uses or closing the account ends the associated retention purpose.

AI conversations and referenced content

Kept for the authorized report and conversation. Report deletion clears associated conversations; withdrawal of a referenced source stops its use and clears the related private content.

Hairstyle reactions and private feedback

Follow the source result’s valid retention period and can be deleted sooner. Source deletion, expiry or account closure clears associated reactions, feedback text, initials and links.

Authorized website quotations

Published only while separate permission and a valid source remain. Withdrawal removes the quotation and controlled cached copies; private feedback remains unless separately deleted.

Account details

Kept while needed for the service relationship, subject to account closure and the minimum records separately retained below.

Sessions and sign-in links

Sessions last seven days and may renew during active use no more than once daily for a further seven days. Sign-out or revocation invalidates the session. One-time sign-in links expire after 15 minutes and cannot be reused.

Consent and withdrawal evidence

Minimum evidence is kept while permission is active and for three years after withdrawal or the end of the purpose, with annual necessity reviews. It does not include photos or analysis text.

Orders, refunds, cancellations and disputes

Minimum records are retained for applicable accounting, tax and payment-provider requirements. Dispute records remain through resolution and any necessary claim or recovery period.

Free-use counts

Kept for 90 days after the relevant UTC calendar month ends, for reconciliation and abuse prevention, then deleted.

Security and error logs

Security logs: 90 days from creation. Error logs: 30 days from creation. Unnecessary sensitive content is excluded.

Analytics events collected with consent

Identifiable or linkable raw events: 60 days from collection.

Safety reviews, abuse reports and appeals

Routine moderation records: 90 days. Case records: 180 days after closure. Only the minimum classification, decision and action records are retained; this does not extend photo retention.

Deletion evidence

Minimum evidence is retained for one year after deletion confirmation and must cover all recoverable backups. An unresolved dispute can require longer retention of necessary evidence, without deleted content.

Model usage and cost records

Call-level billing records: 90 days. Necessary financial summaries follow financial-record requirements. Full photos, prompts and answers are not retained for billing evidence.

Support correspondence follows the purpose of the case: privacy requests follow the relevant consent or deletion record rules, billing cases follow financial and dispute requirements, and abuse cases follow safety-case retention. Other support content is removed when its support purpose ends.

Once a verified deletion request is confirmed, we immediately revoke access through Showra and clear caches we control. We remove the affected production copies within seven days of confirmation.

Encrypted backups operate on a rolling seven-day retention schedule. Deleted content is permanently removed from recoverable backups within 30 days after deletion confirmation, including residual or restored copies. We apply deletion records before restored data becomes available through the service.

These schedules never extend an earlier legally required destruction deadline.

For biometric data covered by the Illinois Biometric Information Privacy Act, we permanently destroy it once the collection purpose has been fulfilled, or by three years after your last interaction with Showra, using the earlier deadline. Automated billing, background polling and emails do not indefinitely restart that period. See 740 ILCS 14/15.

Deleting a report includes its associated photos, previews, plan and conversations, subject to a separate valid use of a shared asset. Account closure ends all account-content purposes. Necessary financial or consent evidence does not preserve deleted face content.

Our deletion confirmation distinguishes the systems we control from external-provider handling. Providers have their own retention and deletion requirements; completion of Showra’s deletion process is not a representation that every independent provider copy has already been destroyed.

You can request access to your personal data, correction of inaccurate information, deletion of data, withdrawal of consent and closure of your account.

The account privacy area is at Account settings → Data and privacy. Requests for copies, corrections, deletion, consent withdrawal and account closure are handled by email at support@showra.app. You do not need an active subscription to make a request.

Access

Ask what personal information we hold about you and request a copy.

Correction

Identify inaccurate or incomplete account or personal information and provide the correction. For an inaccurate analysis, identify the report and disputed information so we can review it.

Data copy or portability

Email us to request a copy. We provide a commonly used, machine-readable format for data covered by a portability right.

Deletion

Identify the result, photo, progress record, conversation, feedback or other data you want deleted. You may request deletion of all account content.

Account closure

Request closure and cancellation of future subscription charges. We track data deletion and payment cancellation separately and confirm their status.

Withdrawal of consent

Identify the processing purpose, training permission, analytics permission or public quotation permission you want to withdraw. Withdrawal stops future consent-based processing; it does not undo processing lawfully completed before withdrawal.

Restriction or objection

Ask us to restrict processing or object to processing based on legitimate interests, according to the rights available under the law that protects you.

Review or complaint

Ask us to reconsider a declined request. You may also complain to your local privacy regulator or other competent authority.

We handle privacy requests and respond within 30 calendar days of receipt. When we cannot complete a request within that time and the law permits an extension, we notify you within the original 30 days, explain the reason and provide the revised deadline. A shorter legal deadline takes priority.

We verify requests using information proportionate to the risk, normally your account email or proof that you control the relevant anonymous result. Do not email payment-card details, identity documents or additional face photos unless we explain why a specific verification step is necessary and provide an appropriate channel.

You may use an authorized representative where the law allows it. We may need to verify their authority and your identity.

Some records must be retained for legal, payment or unresolved-dispute reasons. We explain any limitation and its basis. These exceptions do not justify retaining unrelated photos or reports.

We do not penalize you for exercising privacy rights. Withdrawing permission needed for a photo-based feature may prevent us from continuing that feature. Cancellation, refunds and deletion remain separate processes.

Providing Showra can involve processing by service providers outside your country. The location depends on the service involved, and privacy laws can differ between countries.

Cross-border processing remains subject to the legal requirements that apply to Showra and the relevant provider. We do not treat your acceptance of this policy as a blanket waiver of transfer protections.

Email support@showra.app for information about the recipients, processing locations and transfer protections relevant to your data.

We protect personal data using secure connections, access restrictions, private access to user assets and controlled retention and deletion. Access is limited to what is needed to operate the service, resolve an authorized request or meet a legal obligation.

No system can guarantee absolute security. Protect your account email and recovery links, and contact us promptly about suspected unauthorized access.

When a security incident requires notification, we notify affected people and relevant authorities within the deadlines required by the law governing that incident.

Showra is intended only for people aged 18 or older and accepts only their own adult photos.

We do not knowingly provide the service to children. If we discover a child’s information or an unauthorized third-party photo, we stop further processing and display and arrange deletion under the rules above.

Contact support@showra.app about a child’s data, or abuse@showra.app to report misuse of someone’s photo.

We will give at least 30 days’ notice of material changes to this Privacy Policy through the website or your registered email and update the effective date.

A new purpose requiring consent will not begin merely because we publish a revised policy. We will obtain the required separate permission.

Privacy, account and support requests: support@showra.app
Abuse and unauthorized-photo reports: abuse@showra.app
Service operator: Showra
Website: https://showra.app