Privacy Policy

1. Who We Are

ultymate Inc. ("ultymate", "we", "us") operates the ultymate platform. We are the data controller for personal data processed through the Service. Contact us at support@ultymate.co for any privacy-related queries.

2. Who This Policy Applies To

The Service is only available to users aged 18 and over. We do not knowingly collect personal data from anyone under 18. This age threshold exceeds the minimum requirements of both US COPPA (under 13) and EU/UK GDPR Article 8 (13–16 depending on member state), reflecting the sensitive nature of the biometric and health data we process.

3. Data We Collect

3.1 Account Data

• Email address
• First and last name
• Age (for age verification)
• Password (hashed — we never store plaintext passwords)

3.2 Biometric and Facial Data

3.3 Health and Wellness Data

• Analysis results and scores
• Self-reported health information (if provided)
• Progress photos and tracking data (only if you choose to use progress tracking)

3.4 Usage Data

• Pages visited, features used, time spent
• Device type, browser, operating system
• IP address (anonymised after 30 days)

4. Biometric Data — Special Provisions

We recognise that facial and biometric data is uniquely sensitive. In addition to our general data practices, we commit to the following:

• We will never sell biometric data to any third party, under any circumstances
• We will never use your facial images to train AI models without a separate, explicit opt-in consent that clearly describes this use
• Images are used only to generate your report and to enable your before/after progress tracking — for no other purpose
• All images and analysis results are encrypted at rest
• You may request immediate deletion of any or all of your images and biometric data at any time via account settings or by emailing us

Your consent

We process your facial images and facial measurements only on the basis of your explicit consent. We ask for it on a dedicated consent step before you upload any photos, with separate statements that are never pre-checked. You can withdraw your consent at any time by emailing support@ultymate.co. We keep a record of when you gave each consent and the version of the wording you saw.

Illinois Residents (BIPA)

If you are an Illinois resident, you have specific rights under the Illinois Biometric Information Privacy Act (BIPA). Before we collect any biometric identifier, we ask you to confirm a separate, unchecked consent statement on the consent step. That confirmation is your informed written release for the purposes of BIPA, and we do not collect your photos until you have given it.

California Residents (CCPA/CPRA)

California residents have the right to know, access, delete, and opt out of the sale of their personal information. We do not sell personal information.

5. Data Sharing

We do not sell your personal data. We share data only in limited circumstances: service providers, legal requirements, or business transfer with appropriate protections and notice.

AI processing providers. To check your photos and generate your report, your facial images and analysis results are sent to third-party AI providers (currently OpenAI and Anthropic). They process this data on our behalf to deliver the Service, and may process it in the United States.

Other service providers. Hosting, payment processing (PayPal) and email delivery, limited to the minimum data needed for each purpose.

6. Data Retention

• Facial images: retained for the duration of your account, deleted within 30 days of account closure or immediately upon request. In any event, permanently deleted once the purpose for which they were collected has been satisfied, or within 3 years of your last interaction with us, whichever comes first
• Analysis results: retained for the duration of your account, deleted within 30 days of account closure
• Account data: retained for 30 days after account closure, then deleted

7. Your Rights

Depending on your location, you have the right to access, correct, delete, port, and object to processing of your data, and to withdraw consent at any time. To exercise any of these rights, email support@ultymate.co. We will respond within 30 days.

8. Security

• Encryption for data at rest and in transit
• Access controls and authentication for all staff accessing user data
• Regular security audits

9. Children's Privacy & Age Compliance

Our Policy: 18+ Only

ultymate is not directed to anyone under the age of 18. We do not knowingly collect personal data from minors. This applies regardless of local law or parental consent.

Discovery and Deletion

If we discover that we have collected personal data from a user under 18, we will immediately suspend the account, delete all personal data, and notify the user by email — completed within 72 hours of confirmation.

10. Mental Health & Vulnerable Users

Because ultymate analyses physical appearance, we recognise that certain users may be particularly vulnerable to harm. We do not ask users to disclose mental health conditions; if shared voluntarily, we treat it as special-category health data, processed only with explicit consent and solely to provide appropriate support.

Any user who decides that using ultymate is not right for their mental health may request immediate deletion of their account and all personal data. Email support@ultymate.co with the subject line "Wellbeing Deletion Request" and we will process this within 24 hours.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email at least 14 days before they take effect. If a change materially affects how we collect or use your facial images or biometric data, we will ask for your consent again before it applies to you.

12. Contact & Complaints

For privacy questions or to exercise your rights: support@ultymate.co. If you are an EU/UK resident and are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority.