Legal
Privacy policy
How ExactHue Pte. Ltd. handles personal data — written to be read, not to be survived.
On this page
1. Who we are
ExactHue Pte. Ltd. (“ExactHue”, “we”, “us”) is a private company limited by shares, registered with the Accounting and Corporate Regulatory Authority (ACRA), Singapore, with its registered office at 352 Yishun Ring Road, Singapore 760352. Our colour-science laboratory and research operations are based at the same address.
We build ExactHue Core, a shade-matching engine licensed to beauty brands, retailers and marketplaces. We do not sell a consumer product.
2. Scope of this policy
This policy covers personal data we handle:
- when you visit exacthue.com or contact us;
- when you hold an account on the ExactHue console as a customer or prospective customer;
- when you contribute to our colour-science research programme;
- when ExactHue Core processes an end customer's capture on behalf of a brand.
Controller and processor. For our website, our customers and our research programme, ExactHue is the controller — we decide why and how the data is used. When ExactHue Core processes a shopper's capture inside a brand's storefront, that brand is the controller and ExactHue acts as a processor under their instructions and our data-processing agreement. If you are a shopper, the brand's own privacy notice governs, and requests are best directed to them — though we will always help.
3. What we collect
| Category | Examples | Source |
|---|---|---|
| Identity and contact | Name, work email, company, job title, country | You, directly |
| Account | Credentials (hashed), environment scopes, sign-in events, API key metadata | You and our systems |
| Commercial | Plan, billing contact, invoices, contract records | You and our payment provider |
| Enquiry content | Whatever you write to us in a form or an email | You, directly |
| Technical | IP address, user agent, pages requested, timestamps, error traces | Automatic, on request |
| Analytics | Aggregated page views and referrers, if you accept optional cookies | Cookies, with consent |
| Capture data | Images submitted to ExactHue Core and colour values derived from them | End customers, via our brand customers |
| Research data | Skin colour measurements, session metadata, consent and payment records | Research contributors |
We do not buy personal data from brokers, and we do not enrich your record with third-party profiling data.
4. Facial captures and ExactHue Core
This section matters most, so it is the most specific.
4.1 What the engine does
ExactHue Core measures colour from skin regions of a submitted image in order to recommend a cosmetic shade. It estimates the lighting, inverts the camera's processing, recovers an estimate of skin reflectance, and compares that against a catalogue of measured product colour.
4.2 What the engine does not do
- It does not perform facial recognition, identification or verification.
- It does not generate or store a face template, faceprint or biometric identifier.
- It does not attempt to infer age, gender, ethnicity, health or emotional state.
- It does not make any dermatological, diagnostic or medical assessment. Fitzpatrick classification is used solely as a research sampling taxonomy.
4.3 Retention of captures
A capture is processed to produce the match result and is then deleted. Our default is that captures are not retained and are not used to train or improve our models. Retention for model improvement occurs only where a brand customer has explicitly opted in under a separate written agreement, and only on the basis that the brand has obtained appropriate consent from the individual.
4.4 Sensitivity
Although the engine does not perform biometric identification, an image of a person can be sensitive under several legal regimes. We therefore treat captures as personal data throughout: minimised, encrypted, region-pinned where required, and never repurposed. Where your jurisdiction requires specific consent before this processing, the brand's consent flow governs, and we provide the technical controls needed to honour it — including refusing to process where consent has not been recorded.
5. Research contributor data
Our shade library is built from controlled research sessions rather than from scraped imagery or repurposed customer photographs. If you contribute:
- you are told the purpose before the session and given a written information sheet;
- you are compensated for your time;
- your samples are stored under a pseudonymous identifier, separated from your contact details;
- you may withdraw at any time, and withdrawal removes your samples from the library and from future training. Where a model has already been trained, we cannot un-train it, but your samples will not inform any subsequent version;
- your samples are never sold, licensed or shared, and are never used to identify you.
6. Why we process it
- To operate the service — authenticate you, run matches, ingest catalogues, report accuracy.
- To answer you — respond to enquiries, pilots, technical questions and complaints.
- To bill and administer — contracts, invoices, tax and accounting records.
- To secure the service — rate limiting, abuse detection, audit logging, incident investigation.
- To improve accuracy — using research library data, and customer captures only where explicitly opted in.
- To comply with law — statutory record-keeping and lawful requests.
- To send updates — only where you asked for them, and unsubscribe is one click.
7. Lawful bases
Where the EU or UK GDPR applies, we rely on:
| Purpose | Lawful basis |
|---|---|
| Providing the service to a customer | Performance of a contract |
| Responding to enquiries | Legitimate interests — answering people who contact us |
| Security, fraud and abuse prevention | Legitimate interests — keeping the service safe |
| Optional analytics cookies | Consent |
| Marketing emails | Consent |
| Research contribution | Explicit consent |
| Statutory records | Legal obligation |
Where Singapore's Personal Data Protection Act applies, we rely on consent, deemed consent, or the legitimate interests exception as appropriate to each purpose above.
8. Who we share it with
We share personal data only with service providers who need it to run the service, each under a written contract that restricts them to our instructions:
- Cloud infrastructure — hosting and processing, in the region you are pinned to.
- Email delivery — transactional and, where consented, update emails.
- Payment and invoicing — we never see or store full card details.
- Error and performance monitoring — with personal data scrubbed from traces where feasible.
- Professional advisers — accountants and lawyers, under professional duties of confidence.
A current list of sub-processors is provided to customers on request and, for Enterprise agreements, is maintained under a contractual notification obligation before any addition takes effect.
We do not sell personal data. We do not share it for third-party advertising. If ExactHue is ever involved in a merger, acquisition or asset sale, personal data may transfer as part of that transaction, and we will notify affected individuals before it becomes subject to a materially different policy.
9. International transfers
ExactHue operates from Singapore, and our infrastructure providers operate globally. Singapore is not covered by a European Commission adequacy decision, so where personal data of individuals in the EEA or the UK is transferred to us we rely on Standard Contractual Clauses (with the UK Addendum where applicable), supported by a transfer risk assessment. Where a particular destination is covered by an adequacy decision, we rely on that instead.
Customers on Enterprise plans can pin processing to EU, UK, US or APAC regions so that capture data does not leave the chosen region during processing.
10. How long we keep it
| Data | Retention |
|---|---|
| Captures submitted to ExactHue Core | Deleted after processing; not retained by default |
| Match results and derived colour values | Aggregated and de-identified within 30 days |
| Account records | Duration of the account, then 30 days after termination |
| Enquiry correspondence | 24 months from last contact |
| Contracts, invoices and tax records | As required by law, typically 5–7 years |
| Security and audit logs | 12 months |
| Research samples | Until withdrawal, or 5 years from collection, whichever is sooner |
| Marketing consent records | Until you unsubscribe, plus proof-of-consent record |
11. How we protect it
Encryption in transit (TLS 1.2 or above) and at rest; least-privilege access with multi-factor authentication for staff; credentials scoped per environment so a sandbox key cannot reach production; audit logging; dependency and vulnerability scanning; and an incident response process with a defined notification path. Further detail, including what is not yet in place, is on our security page.
No system is perfectly secure. If a breach affects your personal data and poses a risk to you, we will notify you and the relevant supervisory authority within the timeframes the law requires.
12. Your rights
Depending on where you are, you may have the right to:
- Access — obtain a copy of the personal data we hold about you.
- Rectification — correct data that is inaccurate or incomplete.
- Erasure — ask us to delete data where there is no overriding reason to keep it.
- Restriction — ask us to pause processing while a dispute is resolved.
- Portability — receive data you gave us in a structured, machine-readable format.
- Objection — object to processing based on legitimate interests, and to direct marketing at any time.
- Withdraw consent — where processing relies on consent, withdraw it without affecting prior processing.
- Complain — to your supervisory authority. In the UK that is the Information Commissioner's Office; in Singapore, the Personal Data Protection Commission. We would appreciate the chance to resolve it first.
How to exercise each of these, step by step →
Write to privacy@exacthue.com. We acknowledge requests within 72 hours and respond within one month, extendable by two months for complex requests, in which case we will tell you why. Exercising these rights is free; we will not penalise you for it.
If your data was processed by ExactHue Core inside a brand's storefront, that brand is the controller. Send your request to them, and we will support them in fulfilling it — or send it to us and we will route it.
13. Children
ExactHue Core is licensed for use by adults. Our website and console are not directed at children, and we do not knowingly collect personal data from anyone under 16. Our brand customers are contractually required not to deploy the engine to audiences under the applicable age of digital consent. If you believe a child's data has reached us, write to privacy@exacthue.com and we will delete it.
14. Cookies
We use a small number of strictly necessary cookies, and optional analytics cookies only with your consent. The notice you saw on arrival records that choice. Full detail, including names and durations, is in the cookie policy.
15. Changes to this policy
We update this policy when our practices change. The effective date and version above always reflect the current text. For material changes affecting how we use data you have already given us, we will notify account holders by email at least 30 days before the change takes effect, and we keep prior versions available on request.
16. Contacting us
Privacy questions and rights requests: privacy@exacthue.com
General enquiries: hello@exacthue.com
Security disclosures: security@exacthue.com
By post:
Data Protection
ExactHue Pte. Ltd.
352 Yishun Ring Road
Singapore 760352
ExactHue Pte. Ltd. · Registered with the Accounting and Corporate Regulatory Authority (ACRA), Singapore.