Privacy Policy

1. Who We Are

ultymate Inc. ("ultymate", "we", "us") operates the ultymate platform. We are the data controller for personal data processed through the Service. Contact us at support@ultymate.co for any privacy-related queries.

2. Who This Policy Applies To

The Service is only available to users aged 18 and over. We do not knowingly collect personal data from anyone under 18. This age threshold exceeds the minimum requirements of both US COPPA (under 13) and EU/UK GDPR Article 8 (13–16 depending on member state), reflecting the sensitive nature of the biometric and health data we process.

3. Data We Collect

3.1 Account Data

• Email address
• First name
• Age (for age verification)
• Password (hashed — we never store plaintext passwords)

3.2 Biometric and Facial Data

3.3 Health and Wellness Data

• Analysis results and scores
• Self-reported health information (if provided)
• Progress photos and tracking data (only if you choose to use progress tracking)

3.4 Usage Data

• Pages visited, features used, time spent
• Device type, browser, operating system
• IP address (anonymised after 30 days)

4. Biometric Data — Special Provisions

We recognise that facial and biometric data is uniquely sensitive. In addition to our general data practices, we commit to the following:

• We will never sell biometric data to any third party, under any circumstances
• We will never use your facial images to train AI models without a separate, explicit opt-in consent that clearly describes this use
• Images are retained solely to enable your before/after progress tracking — for no other purpose
• All images and analysis results are encrypted at rest
• You may request immediate deletion of any or all of your images and biometric data at any time via account settings or by emailing us

Illinois Residents (BIPA)

If you are an Illinois resident, you have specific rights under the Illinois Biometric Information Privacy Act (BIPA). By using ultymate, you provide informed written consent to our collection and use of biometric identifiers as described in this policy.

California Residents (CCPA/CPRA)

California residents have the right to know, access, delete, and opt out of the sale of their personal information. We do not sell personal information.

5. Data Sharing

We do not sell your personal data. We share data only in limited circumstances: service providers (hosting, payment processing), legal requirements, or business transfer with appropriate protections and notice.

6. Data Retention

• Facial images: retained for the duration of your account, deleted within 30 days of account closure or immediately upon request
• Analysis results: retained for the duration of your account, deleted within 30 days of account closure
• Account data: retained for 30 days after account closure, then deleted

7. Your Rights

Depending on your location, you have the right to access, correct, delete, port, and object to processing of your data, and to withdraw consent at any time. To exercise any of these rights, email support@ultymate.co. We will respond within 30 days.

8. Security

• Encryption for data at rest and in transit
• Access controls and authentication for all staff accessing user data
• Regular security audits

9. Children's Privacy & Age Compliance

Our Policy: 18+ Only

ultymate is not directed to anyone under the age of 18. We do not knowingly collect personal data from minors. This applies regardless of local law or parental consent.

Discovery and Deletion

If we discover that we have collected personal data from a user under 18, we will immediately suspend the account, delete all personal data, and notify the user by email — completed within 72 hours of confirmation.

10. Mental Health & Vulnerable Users

Because ultymate analyses physical appearance, we recognise that certain users may be particularly vulnerable to harm. We do not ask users to disclose mental health conditions; if shared voluntarily, we treat it as special-category health data, processed only with explicit consent and solely to provide appropriate support.

Any user who decides that using ultymate is not right for their mental health may request immediate deletion of their account and all personal data. Email support@ultymate.co with the subject line "Wellbeing Deletion Request" and we will process this within 24 hours.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email at least 14 days before they take effect.

12. Contact & Complaints

For privacy questions or to exercise your rights: support@ultymate.co. If you are an EU/UK resident and are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority.