Privacy Policy

1. Who is responsible

Pixel Nova Ltd, a New Zealand company operating the Colour and Complexion website, is responsible for the personal information described here. Contact our privacy team at nina@colourandcomplexion.com or Level 4, 82 Willis Street, Wellington 6011, New Zealand. You can also use the privacy-request form linked on this page. The brand is not a separate legal entity. Our New Zealand company number is 8983778.

Our nominated privacy officer can be contacted at nina@colourandcomplexion.com.

2. Information you provide

For in-person bookings we collect your name, email, selected package, appointment slot and booking status. A phone number and notes are optional. Avoid including medical details in optional notes; discuss any necessary health or allergy issue directly with Nina before a makeup service.

For virtual analysis we collect your name, email, questionnaire answers about tanning, skin appearance, freckles, natural hair colour, hair colouring and eye colour, plus one to three assessment photos and an everyday photo. The required fields and minimum photo counts are marked in the form; extra assessment photos are optional. Without the required information and photos we cannot perform this version of the virtual service.

We retain the season selected by Nina, sampled hair/skin/eye colour values, the chosen source photo reference and report/app access token. The report combines these details with season-based guidance. We also record policy versions and text, acceptance times, age confirmation, confirmation delivery, and photo-processing consent. We do not collect a birth date solely to verify the 18+ declaration.

If you contact us, we receive your email or other contact details, correspondence and the details you choose to provide. The website privacy-request form records your email, request type, message, reference, timestamps and handling status. It is not a place to upload photographs, card details or identity documents.

3. Information collected automatically or from others

Our servers and hosting infrastructure may receive IP addresses, browser/request information, visited paths, request times, errors and security events. Rails uses an encrypted session cookie for payment continuity, forms and administrator sessions. The colour app uses session storage to remember dismissal of its home-screen prompt and a service worker for its app shell; the service worker does not provide offline storage of private report pages.

To select NZD or USD pricing, the server sends your IP address to api.country.is and receives an approximate country code. A successful lookup is remembered in the session for one hour and may be cached on the server for 12 hours. We also store the detected country code with your virtual payment and linked appointment to record which country was used for pricing. If detection fails, we leave the country unknown. This is not precise location or proof of residence.

Stripe supplies us with checkout/payment identifiers, status, amount, currency and the checkout email. Stripe receives card and related payment/security information directly on its hosted checkout; we do not receive full card numbers or CVCs. Stripe may use information as an independent controller for its own payment, fraud-prevention and legal purposes under its privacy notice at https://stripe.com/privacy. This notice explains these indirect sources as well as information collected from you. We also receive the payment reference, amount and status of refunds to reconcile payments and end hosted access after a successful full refund.

4. How we use information and legal bases

We use booking, contact, payment and order details to take steps you request before a contract, deliver the agreed service, communicate about it and handle refunds. Where UK/EEA law applies, contract necessity is the basis for these ordinary service activities. We use legally required transaction records to meet legal obligations, and necessary, proportionate security and complaint records for legitimate interests in protecting customers and resolving disputes, balanced against their rights.

The questionnaire may reveal information about skin reactions or health. We obtain separate explicit consent for the photo and questionnaire processing used in virtual analysis and ongoing personalised recommendations within your report or colour app, including any sensitive information revealed. Where required, this is also our special-category condition; we do not treat acceptance of the Terms as that consent. The form explains the purpose before submission. Consent is specific to delivering your analysis, not unrelated uses. You may withdraw it by email or through a privacy request; withdrawal does not undo lawful past processing. We will explain whether analysis must stop and any relevant refund rights.

For customers protected by Canadian consent rules, the notices identify the information, recipients, purposes and significant consequences so you can make a meaningful choice. Information essential to the requested service is distinguished from optional information. Legal exceptions, such as required record keeping, may still apply. The rights and legal bases relevant to a particular activity depend on the law that applies to it.

We retain questionnaire answers to support your analysis and ongoing personalised product recommendations within your report or colour app. Optional promotional emails require a separate opt-in. That opt-in asks for explicit consent to use your questionnaire answers and colour analysis, including any health-related information they reveal, to personalise the emails. You can withdraw by replying to an email or contacting nina@colourandcomplexion.com. Opting out of promotional emails does not end access to your report or app. We do not treat an earlier service-only consent as permission for a new use outside its original scope.

5. Photos, human review and automated tools

Nina and authorised administrators can view your photographs and questionnaire answers to provide your colour analysis. Nina selects areas of a photo to sample and determines your season. The website calculates colour values from those areas and assembles your report and colour app using stored templates and palettes. We do not use facial recognition or create facial-geometry templates to identify you. Staff do not use external AI or editing tools outside this website to process your photographs or produce your analysis.

Your photographs, colour samples and questionnaire answers are personal information. Some answers, such as how your skin reacts to sunlight, may also reveal health information. We obtain your explicit consent to process this information for your colour analysis, as explained above. You can withdraw that consent by contacting us.

We use your photographs to deliver and support your personal colour analysis. We may use your questionnaire answers and analysis results to provide personalised product recommendations in your report or colour app, and in promotional emails only if you separately opt in. We do not use customer photographs in advertising or testimonials, or use customer photographs, answers or results for model training or unrelated product development. Service providers process information needed to support delivery, as described below.

6. Recipients and international processing

Access is limited to people and providers who need information for the stated work, subject to appropriate obligations. Necessary recipients include authorised business staff, hosting/database/file-storage providers, Stripe for payments, the IP-country lookup provider, and Zoho’s Australian-hosted email service for manually sent service correspondence and agreement confirmations. Professional advisers or authorities may receive information when necessary for legal duties or a dispute. We do not authorise unrelated uses simply by engaging a provider.

We use Render to host our website, database, uploaded photographs and backups in Singapore. We also use the payment, email and other service providers described in this policy, whose processing locations may differ.

Our Stripe account is registered in New Zealand. Stripe’s standard New Zealand agreement identifies Stripe New Zealand Limited as the contracting entity, with Stripe Payments Europe, Limited also involved in personal-data processing. Stripe processes payment information through its international payment infrastructure. Depending on the activity, it processes information on our behalf or for its own purposes, including fraud prevention and compliance with financial laws. Further details are in Stripe’s Privacy Policy at https://stripe.com/privacy.

To select the displayed currency, we send your IP address to country.is and receive an approximate country code. This service does not receive your questionnaire, uploaded photos or report from our country-lookup integration.

Your information may be processed in countries whose privacy laws differ from those where you live. Where the law requires safeguards for an overseas transfer, these must cover the provider and the way it handles your information. Depending on the applicable law, protections may include legally recognised standards or contractual commitments. Using our website does not mean you waive your privacy rights or give blanket consent to overseas processing. You can contact our privacy officer to ask about overseas handling and the safeguards relevant to your information.

7. Retention and deletion

We keep the information needed for your personalised report and colour app while we continue providing that access to you. This includes the selected report photo, questionnaire answers, analysis and minimal service/order details. We review the need for this information annually. You can request deletion or withdraw consent; removing information needed by your report or app may end or limit access. Retention is not permission for unrelated uses.

Photographs not used in your report are scheduled for deletion from live storage 30 days after recorded report delivery. Unpaid virtual checkout records and their linked acceptance records are scheduled for deletion after 30 days, once Stripe confirms checkout expired without a successful payment. Uncertain payment or storage problems require investigation and retry; we do not erase evidence needed to resolve them.

For closed in-person bookings, phone numbers and ordinary free-text notes are scheduled for removal after 90 days. Minimal booking and agreement evidence is normally retained for six years after closure, or after ongoing access ends if later. Confirmed abandoned unpaid bookings and unconverted enquiries normally have a 90-day period after closure. We retain minimal evidence needed for ongoing report/app access while providing it. Unknown payment status is investigated before financial records are removed.

Required payment, refund and tax evidence is retained for at least seven years after the end of the relevant tax year. Our financial year ends on 31 March. A later payment or refund may start a later tax-record period. This applies to financial evidence, not all photographs or questionnaire answers. Any specifically required extension or justified ongoing dispute is handled separately.

Minimal agreement and consent evidence is retained while we rely on it, then normally for six years after the relevant service or processing ends. Consent evidence records the notice, version, choice, dates and necessary record links; it does not require keeping the original photos or answers. Non-personal historical policy wording may be kept longer to explain earlier agreements.

Routine support correspondence is normally removed two years after the issue closes. Relevant tax, agreement or complaint evidence is separated first and follows its own period. Staff review and remove expired email correspondence manually. Formal complaints, disputes and security incidents are reviewed annually while open and normally retained as restricted case records for six years after final resolution, subject to any longer applicable requirement.

Ordinary privacy-request handling records are normally removed two years after completion and response. We keep a minimal action summary rather than unnecessary identity documents or sensitive details. Formal complaints follow the longer complaint period. Minimal deletion audit records are normally removed two years after deletion, external-copy review and restoration handling have all been completed; instructions still needed to prevent deleted information returning from a backup are retained for that purpose.

To honour marketing objections, we keep a minimal protected opt-out identifier while needed to prevent unwanted contact, including after submission deletion. We do not use it to send marketing or personalise recommendations. Staff check this record before manual promotional email. Routine technical logs follow our hosting provider’s short retention arrangements; only necessary extracts are kept longer for a specific incident or dispute.

There is no customer account deletion button. Contact us by email or through the privacy-request form. Staff verify identity proportionately, assess the scope, and explain any information that must be retained and why. Our admin tool removes the selected virtual submission, its questionnaire, analysis, contact details and unshared live photos and derivatives. Report/app access ends and its payment cannot be reused for another submission. If file deletion fails, access remains restricted while staff investigate and retry. Shared files need separate review.

The deletion tool retains necessary payment/agreement evidence and minimal consent and deletion records under the periods above, and a protected marketing opt-out identifier. It clears the payment email and agreement delivery email. Other submissions, bookings, privacy correspondence, Stripe records, staff copies and backups require separate handling. Deletion does not issue a refund or erase copies you downloaded or independently shared. A full virtual refund ends hosted report/app access but does not itself erase all related records.

Our current Render backup recovery window is three days. Deleting live information does not immediately edit existing backups. The recovery window is not a guarantee of permanent erasure from every underlying provider system within that time. Our deletion process includes reviewing staff-held and provider copies. We keep deletion and marketing opt-out instructions separately from the backups being restored and reapply them before restored information returns to use.

An active complaint, legal obligation, investigation or other documented lawful need may require a specific retention hold. Holds record a reason, responsible person and review date; they do not expire without review. We retain only relevant information and release the hold when its reason ends. Scheduled cleanup then resumes. These periods do not remove applicable access, correction, erasure or other privacy rights.

8. Security

The configured production app uses HTTPS, encrypted browser sessions, CSRF protection, named administrator accounts with authenticator verification, expiring and revocable administrator sessions, and limits on repeated requests. Photo access is checked against the current administrator session or private report link and the availability of the service. Private responses ask browsers not to cache or index them or send referring URLs.

New photo uploads are decoded and re-saved with limits on file size, dimensions and processing time, removing embedded metadata such as location and camera information. Photos uploaded before this change may still contain that metadata in storage; the image copies served through the website are re-saved before delivery. These controls are not a guarantee that every malicious file or security threat will be detected.

Private links work like access keys and do not require a customer password. Anyone with your link may be able to view your report and app. Protect the link and contact us if it is exposed; we can replace it and disable the old link. We keep limited staff sign-in and security-event records normally for 90 days. During scheduled cleanup we remove rate-limit records whose rate-limit window is more than one day old. Relevant incident evidence may be retained separately where needed.

Render documents encryption at rest for its managed database, persistent disks and backups. Staff use multi-factor authentication to sign in to the website administration area. Multi-factor authentication is also enabled on Render and Zoho. We will meet applicable breach-assessment and notification duties. No service can promise absolute security.

9. Cookies, external links and marketing

Our website does not currently load analytics tags, advertising pixels or social-media tracking embeds. Its browser storage supports forms, checkout, security and the colour app features described below; it is not used for cross-site advertising. Server and hosting logs, and the server-side country lookup used for pricing, are described separately in this policy.

We use a first-party encrypted cookie called _colour_complexion_session to protect forms, keep payment and questionnaire steps connected, remember the detected pricing country for a short period and maintain administrator sign-in. It expires 12 hours after being set or renewed. Administrator access also ends after 30 minutes of inactivity or 12 hours from sign-in. The previous website version used _nina_website_session, a browser-session cookie; a browser may retain session cookies when restoring a previous browsing session. The country result is reused for up to one hour before a fresh lookup is needed.

In the colour app, clicking to dismiss the install prompt saves colour-app-install-dismissed in session storage for that tab’s browsing session so the prompt stays dismissed. This is not a tracking identifier. The app also registers a service worker on your device to support its app functionality. Our service-worker code fetches private pages from the network and does not save report pages or photographs in an offline cache. A service-worker registration may remain until it is unregistered or you clear the site’s data.

You can block cookies or clear cookies and site data using your browser settings. Doing so may interrupt payment or questionnaire continuity, sign you out of admin, or reset app preferences. You can remove the installed app shortcut separately. We do not ask you to accept advertising cookies to use these functional features. If we introduce optional tracking or other storage requiring consent, we will explain it and provide a choice before it operates, with a straightforward way to reject it or withdraw consent.

Stripe-hosted checkout uses Stripe’s own cookies and similar technologies for payment processing, security and other purposes described in its Cookies Policy at https://stripe.com/legal/cookies-policy. Our website does not load Stripe scripts before you move to hosted checkout. External Pinterest links open Pinterest only when you follow them; we do not embed its board script. Other websites’ privacy and cookie settings apply when you visit them.

Product-email permission is separate from cookies and from buying a service. The optional checkbox is unticked by default. We record your choice, notice wording and version, and the time of opt-in or withdrawal. Existing customers are not automatically enrolled. Service messages about your purchase are different from promotional messages; you can withdraw product-email permission by replying or contacting nina@colourandcomplexion.com.

10. Your rights and complaints

You can request access to or correction of your information. Depending on applicable law, you may also request deletion, restriction, portability or information about disclosures, object to certain processing, withdraw consent, or appeal a refused request. Contact nina@colourandcomplexion.com or use the privacy-request form. We will verify identity using proportionate information, avoid asking for excessive ID, respond within the relevant legal deadline and explain any lawful exception. Exercising a right will not by itself lead to unlawful discrimination.

For New Zealand, you may complain to the Office of the Privacy Commissioner (privacy.org.nz). If the Australian Privacy Act applies to the relevant processing, you can also use its complaint process and contact the OAIC (oaic.gov.au); coverage depends on matters such as an Australian link and small-business exceptions, not simply your nationality.

Where UK GDPR or EU GDPR applies because of our activities or targeting, you may use the relevant access, correction, erasure, restriction, portability and objection rights, withdraw consent and complain to the ICO (ico.org.uk), Ireland’s Data Protection Commission (dataprotection.ie), or another competent EEA supervisory authority. Contact us for applicable representative and international-transfer details. These rights are subject to lawful conditions and exceptions.

Canadian coverage depends on commercial activity, a real and substantial connection and applicable federal/provincial law; it is not subject to a universal small-business exemption. You may seek access/correction, challenge our compliance and contact the Office of the Privacy Commissioner of Canada (priv.gc.ca) or the appropriate provincial commissioner, as applicable.

US state rights and thresholds vary. Where an applicable state law grants them, we will support access, correction, deletion, portability, required appeals and relevant opt-outs. We do not claim that every state comprehensive privacy law automatically applies. There is no sale or cross-context behavioural advertising functionality in the audited app; verify actual business practices before publishing a categorical no-sale/no-sharing promise.

11. Children and changes

The service is for adults aged 18 or over. Do not submit information or photos of a child. If you believe this has happened, contact us so we can assess the record, restrict unnecessary use and take the steps required by law. An age checkbox does not remove duties that arise if we learn a child’s information has been collected.

We show the version, effective date and last-updated date of this policy and retain historical versions. Material changes will be brought to affected customers’ attention, with a direct notice or new consent where required. We will not silently treat an old styling-service consent as permission for a new, unrelated use.