Last updated: 05 December 2025

Privacy Policy

On this page

Introduction

At CraftMySkin, we are committed to protecting your privacy, and we take great care with your personal information. This policy will help you understand how we use and protect your data. If you have any questions, feel free to contact us at info@craftmyskin.com. This should be read together with our Terms of Service, which together apply to your use of the CraftMySkin website, the CraftMySkin application, user platform as well as any other services offered by CraftMySkin.

By accessing or using the CraftMySkin website, mobile application and associated services, you agree to the practices and policies outlined in this privacy policy and you hereby consent to the collection, use, and sharing of your information as described in this privacy policy. If you do not agree with this privacy policy, you cannot use the services. If you use the services on behalf of someone else (such as your child) or an entity (such as your employer), you represent that you are authorized by such individual or entity to accept this privacy policy on such individual’s or entity’s behalf.

1. Overview

CraftMySkin (“we”, “our”, “us”) is a technology-driven company providing personalized skin and hair routines through digital platforms. This Privacy Policy (“Privacy Policy”) covers our practices with respect to personally identifiable information (“Personal Information”) that we gather when you use our Services (“Services”).

We created this Privacy Policy (“Privacy Policy”) to give you confidence as you use our website, applications, and services and to demonstrate our commitment to the protection of privacy.

2. Information We Collect

We receive Personal Information directly from you when you voluntarily provide us with such Personal Information, including the following:

Personal identification information.
Skin and hair profile data.
Transaction details.
Technical usage data.
Demographic data (such as your country, gender, or your date of birth).

We may also collect additional information, which may be Personal Information, as otherwise described to you at the point of collection or pursuant to your consent. You may still access and use some of the Services if you choose not to provide us with any Personal Information, but some features of the Services that require your Personal Information may not be accessible to you.

2.1 Optional Photo and Face Data

Users may optionally submit photos, including images of their face skin, to support cosmetic routine personalisation within the app. Such images are stored solely to generate personalised beauty routine and product recommendations based on visible cosmetic characteristics such as skin tone and texture. Face data is not used for identification, authentication, or any purpose beyond cosmetic personalisation. Optional photos are not shared with third parties, are not used for advertising, and are deleted from our processing systems upon submission of account deletion request. Retained data is stored securely on encrypted servers in accordance with Section 4 of this policy.

3. Purpose of Data Collection

We may use information that is not Personal Information to better understand who uses CraftMySkin and how we can deliver a better experience, as well as what type of educational information is important to our users.

We use information, including Personal Information, to provide the Services and to help improve the Services, to develop new services. Specifically, such use may include:

Generating personalized routines.
Recommending brands based on user profile.
Customizing or tailoring your experience of the Services, which may include sending customized messages or showing you sponsored results.
Sending emails and other communications that display content that we think will interest you and according to your preferences.
Improving platform performance.
Customer support and communication.
Fulfilling our legally required obligations, such as preventing, detecting and investigating security incidents and potentially illegal or prohibited activities.
Protecting against or deterring fraudulent, illegal, or harmful actions.
Enforcing our Terms of Service and other agreements.

4. Storage and Security of Information

The security of your Personal Information is important to us. We endeavor to follow generally accepted industry standards to protect the Personal Information submitted to us, both during transmission and in storage. For data storage, we resort to the services of the hosting organizations. We take your privacy seriously and, therefore, encrypt your personal data – where necessary – before sending it to the hosting organizations for the purposes of its storage. Please note that we cooperate only with those hosting organizations that have passed our security and reliability checks.

In particular, we resort to the service providers that have adopted technical and organizational measures to protect your personal data against unauthorized/unlawful processing and accidental loss, destruction, or other damage.

5. Data Retention

We retain Personal Information about you for as long as you have an open account with us or as otherwise necessary to provide you with Services. In some cases, we retain Personal Information for longer, if doing so is necessary to comply with our legal obligations, prevent fraud, enforce the Agreement, or as otherwise permitted or required by applicable law, rule, or regulation. Afterwards, we retain some information in a depersonalized or aggregated form, but not in a way that would identify you personally.

6. Information Provided on Behalf of Minors and Others

As noted in the Terms of Service, the Services are not intended for use by children, and children under the age of 16 should not use our service. CraftMySkin does not knowingly collect any information from minors, nor are the Services directed to or attended for use by children. If you are under 16, please do not attempt to register for the Services or send any Personal Information about yourself to us.

If you are a parent or legal guardian of a minor, you may, in compliance with the Agreement, use the Services on behalf of such minor. Any information that you provide us while using the Services on behalf of your minor child will be treated as Personal Information as otherwise provided herein.

If you use the Services on behalf of another person, regardless of age, you agree that CraftMySkin may contact you for any communication made in connection with providing the Services or any legally required communications. You further agree to forward or share any such communication with any person on behalf of whom you are using the Services.

7. Legal Basis

CraftMySkin processes personal data in accordance with applicable data protection laws, including the Kenya Data Protection Act, 2019, the EU General Data Protection Regulation (GDPR), and other relevant international privacy regulations. We rely on the following lawful bases when processing personal data:

7.1 Consent

We process personal data where users have freely given, specific, informed, and unambiguous consent. This includes, but is not limited to:

Completion of skin and hair assessments or questionnaires.
Generation of personalized skin and hair routines.
Optional sponsorship or promotional communications.

Users may withdraw consent at any time through account settings or by contacting us. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

7.2 Contractual Necessity

We process personal data where it is necessary to perform a contract or to take steps at the request of the user prior to entering into a contract. This includes:

Creating and managing user accounts.
Delivering personalized skin and hair routine recommendations.
Providing customer support and service communications.

Without this information, CraftMySkin may be unable to provide its core services.

7.3 Legitimate Interests

We may process personal data where it is necessary for our legitimate business interests, provided those interests do not override the rights and freedoms of users. Legitimate interests include:

Improving platform performance, functionality, and user experience.
Conducting analytics, research, and service optimization.
Ensuring platform security, fraud prevention, and abuse detection.
Maintaining internal operational records.

Where legitimate interest is relied upon, we conduct assessments to ensure processing is proportionate and minimally intrusive.

7.4 Legal Obligation

We process personal data where required to comply with legal and regulatory obligations, including:

Financial, accounting, and tax compliance.
Responding to lawful requests from regulatory bodies, courts, or public authorities.
Compliance with consumer protection, data protection, and e-commerce laws.

7.5 Vital Interests (Limited Circumstances)

In rare cases, we may process personal data to protect the vital interests of a user or another individual where no other lawful basis is available.

9. User Rights

Applicable data protection laws give you the following rights regarding your personal information:

The Right to Know (also referred to as the Right to Access). You have the right to obtain a confirmation as to whether or not personal data concerning you is being processed. Additionally, you can request a copy of the personal data we hold about you and additional details on how such data is processed.
The Right to Data Portability. You are entitled to request your personal information in a portable, structured, and machine-readable format that makes it easier to reuse such information or transfer it directly to another service.
The Right to Correct Inaccuracies (also referred to as the Right to Rectification). Where you cannot update your data by yourself through your account or the App settings, you can ask us to correct, change, complete, or rectify your data.
The Right to Data Deletion (also referred to as the Right to Erasure or the Right to Be Forgotten). You have the right to request deletion of all or some pieces of your personal data. Applicable data protection laws may provide exceptions where we need to keep some data to comply with legal obligations, detect fraud, or exercise or defend legal claims.
The Right to Object to Processing of Personal Data. You may object to certain automatic processing and ask us to cease processing your data for direct marketing purposes.

To exercise any of the rights described above, contact us at support@craftmyskin.com. Please bear in mind that we ensure these rights only with respect to the information that we physically access and store. In order to process your request, we first have to identify you as a user of the CraftMySkin Services.

10. International Data Transfers

We work in the cross-border area and provide our Services to users around the world.

Third-party organizations that provide automatic data processing technologies may transfer information across borders and between jurisdictions.

We try to ensure recipients provide proper protection in accordance with current data protection legislation. By using the Services, you agree that data may be transferred to jurisdictions whose laws provide a different level of protection.

11. Changes to The Privacy Policy

The effective date of this Privacy Policy is set forth at the top of this page. We will notify you of any material change by posting a notice on this page. Your continued use of the Services after the effective date constitutes your acceptance of the amended Privacy Policy.

We encourage you to periodically review this page for the latest information on our privacy practices. Any amended Privacy Policy supersedes all previous versions. If you do not agree to future changes, you must stop using the Services after the effective date of those changes.

12. Contact

If you have any comments, concerns, or questions about this Privacy Policy, please contact us at support@craftmyskin.com.

CraftMySkin Pharma Limited, NextGen Office Building Suites, Mombasa Road, Nairobi, Kenya. Telephone: +254 722 426 132. Email: info@craftmyskin.com.