Privacy

ALBATROS (Jordan) operates this service. For data protection purposes we are the controller. Contact: privacy@albatros.jo.

1. It is resized in your browser first. The full-resolution original never leaves your device — only a downscaled copy is sent.
2. It is sent to our server over an encrypted connection, held in memory, and forwarded to our analysis providers.
3. It is never written to disk or to any storage bucket by us. There is no database row containing it, no file, and no log line containing image data.
4. It is discarded when the request ends, typically within 30 seconds.

Running a scan requires an account, and the findings of a scan are linked to it. The photograph is not, and cannot be: there is no column anywhere in our database capable of holding an image. What survives a scan is the reading — scores, observations, what we recommended — never the picture it came from.

You need an account to run a scan. It holds your email address, the name you gave us if you gave one, a hashed password, your language, the coarse answers you gave on the questionnaire, and a count of how many scans you have run.

Your password is stored as a scrypt hash, never in a readable form. We cannot see it, recover it or tell you what it is.

Consumer accounts live in a separate, private part of our database from the ALBATROS business platform. The two do not share a user table.

Why we ask for this. The analysis costs us real money per run, and an address is what lets us give you your history back rather than a reading you lose the moment you close the tab. We are not selling it. Marketing emails go only to people who ticked that box, and unticking it later is one click in any message we send.

Ask us to delete your account at any time and we will remove it and the scans attached to it: privacy@albatros.jo.

A photograph of your skin can constitute health-related data and, in some jurisdictions, biometric data. We treat it as sensitive regardless of which label applies in your country.

Our lawful basis is your explicit consent, given on the consent screen before any image is uploaded. You may withdraw consent at any time by not using the service; because nothing is retained, there is nothing left to delete afterwards.

We do not perform facial recognition. We do not extract or store a face template, and we make no attempt to identify who is in an image.

Your image is sent to the following third parties purely to perform the analysis:

• Anthropic (Claude API) — vision analysis and report writing. Anthropic states that API inputs are not used to train its models.
• Google (Gemini API) — second-opinion vision analysis. Data handling is governed by Google's paid-tier API terms.
• Vercel — hosting and request routing.

These providers may retain data briefly for abuse monitoring under their own terms. We have no control over that retention and we do not have access to it. Please read their policies if that matters to you.

This means your image is transferred outside Jordan and outside the EEA. Transfers rely on the providers' standard contractual clauses.

• Your account — as described above. Email, optional name, password hash, language, coarse questionnaire answers, scan count.
• The findings of scans you consented to save — scores, observations, which products were recommended, how long the analysis took. Linked to your account. Never an image.
• Aggregate, non-identifying counts — how many analyses ran, how long they took, error rates.
• A salted one-way hash of your IP address on account creation, so repeated abuse from one source can be spotted. It is not reversible into an address.
• A session cookie so you stay signed in. See the cookie notice.
• Your language preference, stored in your own browser. It never reaches our servers.

Free-text answers about sensitivities, allergies and medications are deliberately not stored. They are used during the analysis and then dropped, because keeping them would turn a cosmetic record into a medical one.

The report on screen exists in your browser tab. If you close or refresh the page, that view is gone. If you ticked the optional box to save your results, the findings — not the photograph — are stored against your account and we can give them back to you.

Depending on where you live you may have rights of access, rectification, erasure, restriction, portability and objection. We hold your account and your saved findings, and we will export, correct or delete them on request. There is nothing to hand over or erase in relation to your photographs, because we never had them.

Requests: privacy@albatros.jo. You also have the right to complain to your local data protection authority.

This service is not directed at anyone under 18 and we do not knowingly process images of minors. Our models are instructed to abort the analysis and return nothing if there is any indication the subject may be a minor.

If we ever change this in a way that means images are retained, we will say so on this page and on the consent screen before the change takes effect. It will never happen silently.