Privacy
Your data rights
What you can ask us to do with your personal data, how to ask, and what happens next. Written as instructions rather than as a legal recital.
First, the question that decides everything else: where did we get your data? If you contacted us, hold an account, or contributed to our research programme, write to us directly — we are the controller and it is our job. If you used a shade finder on a beauty brand's website, that brand is the controller and we only processed data on their instructions. Send your request to them. If you would rather send it to us anyway, do — we will route it and chase them on your behalf.
What you can ask for
Depending on where you live, some or all of these apply. We do not make you prove which regime covers you before we help; if a right is straightforward to honour, we honour it.
| Right | What it means in practice | How to phrase it |
|---|---|---|
| Access | A copy of the personal data we hold about you, plus what we use it for and who we share it with | “Please send me a copy of my data.” |
| Rectification | Correcting anything inaccurate or filling in something incomplete | “My company name is wrong, it should be…” |
| Erasure | Deleting data where we have no overriding reason to keep it. Invoices and tax records we usually must keep | “Please delete my data.” |
| Restriction | Pausing our use of your data while a dispute or a correction is being sorted out | “Please stop using my data until this is resolved.” |
| Portability | Data you gave us, back in a structured machine-readable format you can take elsewhere | “Please export my data.” |
| Objection | Objecting to processing based on legitimate interests. For direct marketing this is absolute — we stop, no balancing test | “I object to you processing my data for…” |
| Withdraw consent | Where processing rests on consent, taking it back. Doing so does not make what came before unlawful | “I withdraw my consent for…” |
| Complain | Raising it with a supervisory authority, whether or not you come to us first | See complaints below |
How to make a request
Email privacy@exacthue.com. There is no form to fill in and no template to follow — a plain sentence saying what you want is enough. It helps if you include:
- the email address you used with us, so we can find the right records;
- which right you are exercising, or just what you want to happen;
- if you interacted with us through a beauty brand's website, which brand.
You can also write to us by post:
Data Protection
ExactHue Pte. Ltd.
352 Yishun Ring Road
Singapore 760352
Identity checks
If a request would reveal or delete personal data, we need to be reasonably sure it is coming from you. Usually replying from the address already on the account settles it. We ask for identity documents only where we genuinely cannot verify you any other way, and we delete whatever you send as soon as the check is done.
How long it takes
| Stage | Timing |
|---|---|
| We acknowledge your request | Within 72 hours |
| We complete it | Within one month |
| Complex requests | Up to two further months — and we will tell you why, before the first month is up |
| Marketing opt-out | Immediately, and always free |
Exercising these rights costs nothing. We will not charge you, delay you, or treat your account differently because you asked. A fee is only ever possible for a request that is manifestly unfounded or repetitive, and we would explain that to you rather than simply invoicing.
If your request is about a face capture
This is the case people worry about most, so here is the specific answer.
A capture submitted to ExactHue Core is processed to produce the match result and then deleted. By default nothing is retained and nothing is used to train our models. So in the ordinary case there is no stored capture to access, export or erase — it is already gone.
The exception is where a brand has explicitly opted into retention for model improvement under a separate written agreement, on the basis that they obtained appropriate consent from you. If that applies, the brand can tell you so, and we will confirm it independently if you ask us.
Worth repeating, because it changes what is even possible: ExactHue Core does not perform facial recognition, does not generate a face template, and does not attempt to infer age, gender, ethnicity or health. It measures colour from skin regions. There is no identity record to hand over because we never built one.
If you contributed to the research programme
You can withdraw at any time, and withdrawal is not a negotiation. Your samples come out of the shade library and out of all future training runs. Your compensation is not affected and we will not ask you to justify it.
One honest limitation: a model that has already been trained and shipped cannot be un-trained. Your samples will not inform any subsequent version, but we are not going to claim we can reach into a released model and remove their influence. Nobody can do that, and a company that says otherwise is telling you what you want to hear.
Complaints
If you are unhappy with how we handled a request, tell us first — most problems are a misunderstanding and we would rather fix it than have you escalate. Write to privacy@exacthue.com with “Complaint” in the subject and it goes to someone senior.
You are entitled to go to a supervisory authority whether or not you come to us first:
- Singapore — the Personal Data Protection Commission
- United Kingdom — the Information Commissioner's Office
- European Economic Area — the data protection authority in the country where you live or work
Related
- The full privacy policy — what we collect, why, how long we keep it and who we share it with
- Cookie policy — every cookie by name, and how to change your choice
- Security — how the data is protected, including what is not in place yet
ExactHue Pte. Ltd. · 352 Yishun Ring Road, Singapore 760352