These are the third parties that process personal data on our behalf. Each one is bound by a written contract that meets Article 28 of the UK GDPR and the EU GDPR, limits them to our instructions, and requires them to protect your data.
We publish this list so you can see exactly who touches your data. We update it whenever it changes.
Infrastructure
| Provider | Entity and location | What they do | Data they process | Transfer safeguard |
|---|---|---|---|---|
| Hetzner | Hetzner Online GmbH, Falkenstein, Germany | Hosting, storage, backups | All service data, including selfies | Within the EEA, no transfer |
Analysis and AI
| Provider | Entity and location | What they do | Data they process | Transfer safeguard |
|---|---|---|---|---|
| Perfect Corp | Perfect Corp, Taiwan, with infrastructure in other locations | Skin analysis from a selfie | The selfie image, analysed and not retained | Standard Contractual Clauses plus UK International Data Transfer Addendum. Taiwan has no UK or EU adequacy decision, so a transfer risk assessment applies |
| OpenAI | OpenAI Ireland Ltd for UK and EEA users, OpenAI OpCo LLC, United States | Routine and recommendation generation | Skin attribute scores, stated concerns, saved products. No images | Standard Contractual Clauses plus UK Addendum, and EU-US Data Privacy Framework with UK Extension where applicable |
Analytics and diagnostics
| Provider | Entity and location | What they do | Data they process | Transfer safeguard |
|---|---|---|---|---|
| Google Analytics | Google Ireland Ltd, Google LLC, United States | Usage analytics | Usage events, device data, IP address | EU-US Data Privacy Framework with UK Extension, plus Standard Contractual Clauses |
| Firebase Crashlytics | Google Ireland Ltd, Google LLC, United States | Crash reporting | Crash reports, device data, installation identifier | EU-US Data Privacy Framework with UK Extension, plus Standard Contractual Clauses |
| Microsoft Clarity | Microsoft Ireland Operations Ltd, Microsoft Corporation, United States | Product analytics and session recording | Usage events, session recordings with text input masked and skin screens excluded | EU-US Data Privacy Framework with UK Extension, plus Standard Contractual Clauses |
| Sentry | Functional Software Inc, United States, with an EU region option | Error and performance monitoring | Error reports, stack traces, device data | Standard Contractual Clauses plus UK Addendum |
Commercial
| Provider | Entity and location | What they do | Data they process | Transfer safeguard |
|---|---|---|---|---|
| Awin | Awin Ltd, United Kingdom | Affiliate click tracking and commission reconciliation | Click identifier, product, timestamp | United Kingdom, no transfer |
Security
| Provider | Entity and location | What they do | Data they process | Transfer safeguard |
|---|---|---|---|---|
| OctiCode | Entity and location to be confirmed | Security incident detection and response | Access to systems and logs during an incident only | To be confirmed |
Distribution and sign-in
| Provider | Entity and location | What they do | Data they process | Transfer safeguard |
|---|---|---|---|---|
| Apple | Apple Distribution International Ltd, Ireland, Apple Inc, United States | App distribution, Sign in with Apple, push notifications | Account identifier, device token | Standard Contractual Clauses plus UK Addendum |
| Google Ireland Ltd, Google LLC, United States | App distribution, Google Sign-in, push notifications | Account identifier, device token | EU-US Data Privacy Framework with UK Extension, plus Standard Contractual Clauses |
Where your selfies go
Because this is the question people ask most often:
Your selfies are stored only on our servers at Hetzner in Falkenstein, Germany. They are sent to Perfect Corp for analysis and are not retained by Perfect Corp. They are sent to no one else. They are not sent to OpenAI, not to Google, not to Microsoft, not to Sentry, and not to any advertiser.
Changes to this list
We review this list whenever we add, change or remove a provider, and at least every six months.
If a change materially affects how your personal data is handled, we will tell you in the app or by email before it takes effect. If the change affects something you consented to, we will ask for your consent again.
Contact
Questions about any provider on this list, or a request for a copy of the safeguards in place for a particular transfer:
PLUMPED LTD, 124 City Road, London, England, EC1V 2NX. Company number 16204649.