LOOKSMITH

Privacy Policy

Last updated: 18 August 2026

This Privacy Policy describes how Mirable Labs, Inc. (“Looksmith”, “we”, “us”, “our”) collects, uses, and discloses information about you when you use our website at looksmith.ai, our mobile and web applications, and the features we offer through them (together, the “Service”). Because Looksmith works by rendering makeup onto photographs of your face, this policy pays particular attention to those photographs and to what the law in some places calls biometric information. For the purposes of this policy we are the controller of the personal information we process in connection with the Service.

Please read this policy carefully. By using the Service you agree to the collection, use, and disclosure of information as described here. If you do not agree, please do not use the Service. Where the law requires your consent, we ask for it separately and you can withdraw it at any time.

  1. Changes to this policy
  2. Information we collect
  3. Your face and biometric information
  4. How we use information
  5. AI processing and model training
  6. How we disclose information
  7. Cookies and tracking technologies
  8. Legal bases for processing
  9. Your rights and choices
  10. Retention and deletion
  11. Security
  12. International transfers
  13. Children
  14. Regional disclosures
  15. How to contact us

Changes to this policy

We may amend this policy from time to time. When we do, we update the “Last updated” date above. If we make a material change to how we use or disclose information, we will make reasonable efforts to tell you before it takes effect, for example by email or a notice in the App, and we will take any additional steps the law requires. If a change would broaden how we use your face data, we will ask for your consent again rather than rely on this notice.

Information we collect

Information you give us

Account and contact information
Your name, email address, and any handle or profile details you choose to add. We use these to create and maintain your account, to provide the Service, and to respond to you. If you join a waiting list on our Site we collect only your email address, and we use it to tell you when the App is available.
Photographs and reference images
The selfies you upload, including the additional angles the Service asks for, and any reference or inspiration image you provide. Section 3 explains how we handle these.
Photographs of your makeup products
If you add items to My Bag by photographing them, we store those photographs so that your shelf looks the same on every device you sign in from. They are photographs of products, not of you, and they are kept privately — never placed on a public address and never shown to anyone else. We do not read text from them or analyse them beyond checking, once, that an uploaded image is what it claims to be.
Your choices within the Service
The looks you generate, save, or discard, the products you view, add to a bag, or follow through to a retailer, and any prompt or note you write. We use these to provide the Service and to improve which products it suggests.
Support and other communications
Anything you send us when you contact us, which we use to answer you and to improve the Service.

Information collected automatically

Device and connection information
Device type and model, operating system, app version, unique device identifiers, and IP address.
Approximate location
A general region inferred from your IP address, used for security, for showing relevant retailers and currencies, and for meeting legal obligations. We do not collect precise GPS location.
Usage information
How you move through the Service: features opened, looks generated, taps and clicks, timestamps, crash and performance diagnostics, and how you arrived at the Service. We use this to understand what works, to fix faults, and to make the Service better.

Information from other sources

Sign-in providers
If you sign in through a third-party identity provider, we receive the basic account information that provider shares with us, such as your name and email address, and use it to authenticate you.
Brands, retailers, and affiliate networks
Product catalogues, shade and availability data, and confirmation that a purchase followed a link from the Service, including its value. We do not receive your card or other payment details.
App stores and analytics providers
Aggregate install, subscription, and performance data. We do not receive your payment information from the app stores.

De-identified and aggregated information

We may aggregate or de-identify information so that it can no longer reasonably be linked to you, and we may use that information for any lawful purpose, including publishing trends about which looks and shades are popular. We do not attempt to re-identify information we have de-identified.

Your face and biometric information

This is the most sensitive information we handle, so we want to be exact about it.

To render a look onto your likeness, we process photographs of your face and derive from them the facial measurements needed to place makeup accurately, such as the position and shape of your eyes, brows, lips, and the contours of your face. In some jurisdictions those measurements are treated as biometric identifiers or as sensitive personal information. We collect them only with your consent, and only to provide the features you have asked for.

We do not use your face to identify you, to verify your identity, to infer your age, race, ethnicity, health, or any other characteristic, or to build a profile about you beyond your aesthetic preferences within the Service. We do not sell your face data, and we do not share it with advertisers, data brokers, or brands.

We do not use your face or your generated looks in marketing or any public material without your separate, express, opt-in permission, which you can decline and can withdraw at any time.

You can delete your photographs and the derived facial data at any time from within the App or by emailing us, and deleting your account deletes them. Section 10 sets out our retention periods.

How we use information

We use the information described above to:

We may send you marketing messages about Looksmith where you have asked for them or where the law otherwise permits, and every marketing message includes a way to unsubscribe. Unsubscribing from marketing does not stop essential messages about your account.

AI processing and model training

Generating a look requires sending your photographs and prompts to third-party artificial intelligence providers that perform the image and video generation on our behalf. These providers act as our processors under written contract: they may use your content only to return a result to us, and they are not permitted to use it for their own purposes, including training their own models. Some of these providers operate infrastructure outside your country; Section 12 explains how we handle those transfers.

We do not train our own models on your photographs, your face data, or your generated looks, and we do not permit our providers to train theirs on them. If we ever want to, we will ask for your separate, express, opt-in consent first, and you will be able to decline and keep using the Service.

We do use aggregated and de-identified signals that cannot be linked back to you — for example, that a given look was saved more often than another — to improve which products the Service recommends and how it composes looks.

How we disclose information

We disclose information in the following circumstances, and not otherwise:

Service providers
Vendors who help us run the Service under contract, including cloud hosting and storage, the artificial intelligence providers described in Section 5, authentication, error and performance monitoring, analytics, customer support tooling, and email delivery. They may use the information only to provide their service to us.
Brands, retailers, and affiliate networks
When you follow a product link, the retailer and the affiliate network that measures the referral receive the fact of the click and standard commerce data. They do not receive your photographs, your face data, or your generated looks.
At your direction
Anyone you choose to share a look with, and any integration you ask us to connect.
Legal and safety
Where we are required by law, by legal process, or by a regulator; and where we believe disclosure is necessary to protect the rights, property, or safety of Looksmith, our Users, or the public.
Corporate transactions
A counterparty or its advisers in connection with a merger, acquisition, financing, or sale of assets. We will require any acquirer to honour this policy for information transferred to it, and we will tell you before your face data becomes subject to a different policy.
Professional advisers
Our auditors, lawyers, and accountants, where necessary and under a duty of confidence.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under California law.

Cookies and tracking technologies

Our Site uses a small number of cookies and similar technologies for essential functions such as remembering your session, and for basic analytics that tell us how the Site is used. Where the law requires consent for non-essential cookies, we ask for it before setting them. Most browsers let you block or delete cookies, though doing so may stop parts of the Site working. Like most sites, ours does not currently respond to browser “Do Not Track” signals; we do honour recognised opt-out preference signals where the law requires it.

Legal bases for processing

If you are in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases. We process your account and usage information to perform our contract with you. We rely on your explicit consent to process your facial images and the biometric data derived from them, which are special category data, and you can withdraw that consent at any time. We rely on our legitimate interests in securing the Service, preventing abuse, and improving the Service using aggregated or de-identified data, having weighed those interests against your rights. We rely on legal obligation where the law requires us to keep or disclose information.

Your rights and choices

Depending on where you live, you may have the right to access the information we hold about you and to know how we use and disclose it; to receive a copy in a portable form; to correct inaccurate information; to delete your information; to restrict or object to certain processing; to withdraw consent you have given; and not to be discriminated against for exercising any of these rights.

You can exercise most of these rights directly in the App, including deleting individual looks, deleting your photographs and face data, and deleting your account. For anything else, email support@mirablelabs.com and we will respond within the time the law allows. We may need to verify your identity before we act, and some rights are limited — for example, where fulfilling a request would affect another person’s rights or where we must keep information by law. If you believe we have not handled your information properly, you may complain to your supervisory authority, including the UK Information Commissioner’s Office if you are in the United Kingdom.

Retention and deletion

We keep information only as long as we need it. In practice that means:

Photographs and derived face data
For as long as you keep them in your account, so that you can generate new looks without re-uploading, and no longer than the periods set out in our Biometric Data Retention & Destruction Policy. That policy is the single place these timings are stated, so that they cannot drift apart between documents.
Photographs of your makeup products
Until you delete the item they belong to, or delete your account. Removing an item removes its photographs; they are not kept once nothing in your bag refers to them.
Generated looks
Until you delete them or delete your account.
Account and transaction records
For the life of your account, and afterwards only as long as needed for legal, tax, accounting, or dispute-resolution purposes.
Usage and diagnostic information
Typically no more than twenty-four months, after which it is deleted or de-identified.
Aggregated or de-identified information
May be kept indefinitely, as it can no longer be linked to you.

Security

We protect your information with measures appropriate to its sensitivity, including encryption in transit and at rest, access controls that limit who on our team can reach face data, and contractual restrictions on our providers. No system is impenetrable and we cannot promise perfect security. Please use a strong, unique password, and tell us at support@mirablelabs.com if you believe your account has been compromised.

International transfers

We are based in the United States and we use providers located in the United States and elsewhere, which means your information may be transferred to, stored in, and processed in countries with different data protection laws from your own. Where we transfer personal information out of the European Economic Area or the United Kingdom to a country that has not been found to provide an adequate level of protection, we rely on the European Commission’s standard contractual clauses, together with the UK international data transfer addendum where applicable, and we carry out a transfer assessment. Email us if you would like to see a copy of the clauses we use.

Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. Face features are limited to users who are at least 18. If we learn that we have collected information from a child under 13, we will delete it promptly. If you are a parent or guardian and believe your child has given us information, email us and we will remove it.

Regional disclosures

California

In the twelve months before the date of this policy we collected the categories of personal information described in Section 2, including identifiers, commercial information, internet activity, approximate geolocation, and sensitive personal information in the form of biometric information, for the purposes described in Section 4, and we disclosed them to the categories of recipient listed in Section 6. We do not sell personal information or share it for cross-context behavioural advertising, and we do not use or disclose sensitive personal information for purposes beyond those permitted under California law. California residents have the rights described in Section 9 and may exercise them through the App or by email; you may also use an authorised agent.

Illinois, Texas, Washington, and other biometric privacy laws

Where a biometric privacy statute applies to you, we collect biometric identifiers and biometric information only after informing you in writing and obtaining your written release, we use them solely to provide the try-on features you request, we never sell, lease, or otherwise profit from them, and we disclose them only to the processors described in Section 5 or where the law compels us. We retain them as described in Section 10 and destroy them when the purpose for collection has been satisfied or 24 months after your last interaction with us, whichever comes first.

European Economic Area, United Kingdom, and Switzerland

Our legal bases are set out in Section 8 and your rights in Section 9. Mirable Labs, Inc. is the controller. You may contact us at the address in Section 15 with any question about our processing, and you may lodge a complaint with your local supervisory authority.

How to contact us

Mirable Labs, Inc.
support@mirablelabs.com

Write to us with any question about this policy, to exercise your rights, or to ask us to delete your photographs and face data. We read everything sent to that address.