Privacy

The salon is the data fiduciary for its guests under the Digital Personal Data Protection Act, 2023. Agentic Build Works operates Lookuvi and is the processor that runs the try-on software. A face or hand photo used for a preview is personal data (and is treated with care similar to sensitive / biometric-like data under older SPDI practice).

Purposes (itemised)

• Show a hair, brow, beard, nail, bridal, or makeup preview for this salon visit
• Run live hair colour on your device (not uploaded)
• Join a salon queue with name and mobile, and send transactional queue updates
• Optional booking lead if you tap Book
• Optional WhatsApp reminder or offer after a visit (you can reply STOP)
• Security, abuse prevention, billing for the salon, and legal compliance

Photos and AI processors

Live hair colour runs in the browser with a self-hosted MediaPipe model. That photo is not uploaded.

A style, brow, beard, nail, bridal, or makeup preview sends the photo and the chosen style to our server. The server may send that photo to a configured AI processor: fal (Black Forest Labs FLUX), OpenAI, and/or Google Gemini. Those processors may process data on servers outside India. The HTTP response is Cache-Control: no-store. The generated preview is stored in private object storage for up to 24 hours so the same tap is not billed twice, then a retention job deletes it. Logs do not contain the photo or provider keys. Lookuvi does not use guest photos to train its own models. Production must use paid provider tiers whose terms do not use your content for training where that option exists.

Try-on results are labelled as AI-generated. See AI disclosure.

Hosting

The application is hosted on Hostinger in India. When the site is served through Cloudflare, Cloudflare processes the connection for DNS and TLS (which may involve points of presence outside India).

What we store

We store a consent log (session id, purpose, text version, language, time, a short hash of the browser string, age confirmation), usage events without photos, queue and customer phone records for that salon, and booking leads if the guest taps Book. You can ask for access, correction, erasure, and nomination through the form below or the Grievance page.

Queue, WhatsApp, and SMS

A phone number entered for the queue is saved on that salon's own list, with a visit count and the date of the last completed visit. The salon can send one WhatsApp reminder after a visit, or an offer. Reply STOP to opt out of reminders and offers. That opt-out applies to every salon on this WhatsApp number. Queue updates for a visit you just joined still use the consent tick on the join form. The list is not shared with another salon. Lookuvi does not send commercial SMS today (TRAI DLT is not applicable until SMS is enabled).

Consent, withdrawal, and children

You agree to the photo notice before the camera opens. Withdrawal is as available as consent: use the form below or the withdraw link on the consent sheet. Withdrawal deletes leads tied to the browser session. Stored previews expire on the retention schedule. Open requests are tracked with a 30-day handling target (acknowledgement target 48 hours). Grievance Officer details: Grievance. Contact: support@agenticbuildworks.com.

You must confirm you are 18 or older, or that a parent or guardian is present, before a photo preview. Children's styles require a parent or guardian. Lookuvi does not run tracking or targeted advertising aimed at children.

Cookies & local storage

Staff sign-in uses an httpOnly session cookie. Guests get a random id in sessionStorage for consent and try-on (not an account). The booking hub may set an httpOnly guest cookie after a phone code. Queue join may keep recent visit refs in localStorage on your device. Optional error reporting (Sentry) runs only if the operator sets a DSN — it is not session replay and does not record keystrokes. We do not load third-party marketing pixels or session-replay scripts in the app.

Security practices

Passwords are handled by the auth stack (not stored in plain text). Provider API keys are encrypted at rest. Photos are re-encoded server-side (EXIF stripped). Application logs are redacted to avoid photos, tokens, and phone numbers. Object storage for previews is private. Reasonable security practices under IT Act s43A / SPDI Rules are a continuing duty — see also our security reviews in the engineering process.

Cross-border transfers

When AI processors or CDN/DNS providers handle data abroad, that is a cross-border transfer for the purposes of producing your preview or delivering the site. By agreeing to the photo notice you acknowledge those processors may receive the photo for that purpose only.

Platform contact: support@agenticbuildworks.com. Agentic Build Works, Hyderabad, Telangana, India.