Privacy Policy
Last updated: 2026-10-17 ยท Version 2026-10-17.1
SkinMatch asks for some sensitive details about your body and your life so it can suggest a routine. This policy explains what we collect, why, where it is kept, and what you can do about it. In short: your account and quiz answers are stored in your browser on your device. We do not run a database of them, and you can export or delete them at any time from My data.
Controller: The Paperkind (legal entity name to be confirmed by owner) ("we", "us"), for the SkinMatch website.
1. Data we collect and why
| Data | Examples | Why | Where it is kept |
|---|---|---|---|
| Account details | Name, email address, password (stored only as a salted PBKDF2 hash) | To let you log in and keep your routine | Your browser (local storage) |
| Quiz answers (sensitive) | Gender identity you choose, whether you shave, pregnancy or breastfeeding status, skin type, concerns on face, neck, body, hair or feet, time, budget, product style, natural preference | To choose products and routine steps that suit you | Your browser (local storage) |
| Consent record | Which policies you accepted, their version and the time you accepted them | To show you agreed before we used your data | Your browser; a copy of the acceptance rows is kept in the same place, without your name or email |
| Marketing choice | Whether you ticked the optional marketing box | To respect your choice | Your browser |
| Technical logs | IP address, browser type and pages requested, when the website is loaded | To keep the site running and secure | Hosting provider's logs |
The quiz asks about gender identity and pregnancy or breastfeeding status. You can choose "Prefer not to say" or skip the descriptive field. Those answers are treated as sensitive personal data. We ask for your explicit consent before you start the quiz.
We do not collect payment details, because we do not sell products on this site. Purchases happen on the retailer's site.
2. Legal basis
Your account and quiz answers are processed on your consent, given when you create an account. You can withdraw consent by deleting your account from My data. Under India's Digital Personal Data Protection Act, 2023 we rely on consent. For users in the EU or UK, Article 6(1)(a) and Article 9(2)(a) of the GDPR and UK GDPR (explicit consent to special-category data) apply. Technical logs are processed on our legitimate interest in keeping the site secure (counsel to confirm).
3. Sharing and service providers
We do not sell personal data. We do not send your account or quiz answers to any server, because they stay in your browser. When you click a "Buy" button, you leave SkinMatch and go to the retailer's website, which handles your visit under its own privacy notice. The retailers and other service providers are listed at subprocessors.html.
We disclose information only where the law requires it.
4. Retention
We keep your account data until you ask us to delete it. Your account and quiz answers stay in your browser until you delete your account from My data, or clear this site's data in your browser. Nothing is deleted automatically after a set time: there is no automatic expiry.
When you delete your account, we remove your name, email address, password hash and quiz answers from your browser. We keep the acceptance rows and an audit entry that contain no name or email, as proof of consent. Hosting logs follow the hosting provider's retention settings.
To ask us to delete your data, use "Delete my account and data" in My data. Section 5 explains how to request deletion by email.
5. Your rights
In My data you can:
- export everything your account holds, as a JSON file;
- delete your account, which removes your personal details and quiz answers from this browser; and
- review what you accepted and when.
Under the DPDP Act and, where it applies, the GDPR or UK GDPR, you may also ask for correction, object to processing, raise a grievance, and (in the EU or UK) complain to a supervisory authority.
We respond within 30 days.
6. Security and breaches
Passwords are stored as salted PBKDF2-SHA256 hashes with 600,000 iterations. Accounts can only be created over HTTPS. Repeated failed logins are slowed down. The site uses a Content Security Policy that blocks third-party scripts and loads no third-party fonts or trackers.
This is a browser-only account system. Anyone with access to your device can read what your browser stores. Use a private device and log out on shared computers.
If a personal-data breach affects data we hold, we will notify affected users and the relevant authorities as the law requires. That includes CERT-In within 6 hours for reportable incidents, the Data Protection Board of India, and, where applicable, GDPR regulators within 72 hours.
7. Children
SkinMatch is not for people under 18. Sign-up asks you to confirm your age, and we do not knowingly create accounts for anyone under 18. If you believe a child has an account on a device, delete it from My data on that device.
8. Cookies and similar storage
We set no cookies. The site uses your browser's local storage to keep your account, quiz answers and throttling records. See the Cookie Policy. Retailer websites set their own cookies when you visit them.
9. Grievance officer
Name and address to be published by the Company before launch.
10. Changes
We version this policy (2026-10-17.1) and will tell you in the app about material changes. If a change affects how your quiz answers are used, we will ask for your consent again.