Privacy policy

Last updated: 7 October 2026

In short

• We use your photos to create your hairstyle previews and for nothing else. We do not use them to identify you and we do not train AI models on them.
• Your photos and looks stay in your private Hairstyle Suite until you delete them. Deleting your account deletes everything.
• We work with a few service providers (hosting, AI image generation, payments, email, analytics). They are listed below.

1. Who is responsible

snekmedia GmbH, Rüdigergasse 23/9, 1050 Wien, Austria, email office@rendersnek.com (the "controller" under the GDPR). Full details are in the imprint.

2. What we process and why

Photos and generated looks

When you try on a hairstyle you upload one or two selfies and, optionally, a photo of a hairstyle. We send them to our AI provider to generate the preview and store the selfies, the reference photo and the results in your account. Legal basis: performance of the contract with you (Art. 6(1)(b) GDPR).

"Which one fits me best?" If you use this analysis, your front selfie is sent to our AI provider before you sign up, so it can suggest a haircut for your face shape. We do not store this photo at that point; it is only saved if you go on to unlock the result. The analysis describes features such as face shape to pick a style. It is not used to identify you. Legal basis: your request (Art. 6(1)(b) GDPR).

Your account

Your email address (or your Google account email, if you sign in with Google), the country we derive from your IP address at sign-up, your sign-in and consent records, your credit balance and your purchases. Legal basis: contract (Art. 6(1)(b) GDPR) and our legal obligations to keep records (Art. 6(1)(c) GDPR).

Email

We send emails that belong to the service (sign-in codes, address confirmation). If you agreed, or where the law allows it for existing customers and you did not object, we also send occasional hairstyle ideas. Every such email has a one-click unsubscribe link. We record when an email was sent and whether its button was clicked, to learn which emails are useful. Legal basis: consent (Art. 6(1)(a) GDPR) or our legitimate interest in informing customers about our own service (Art. 6(1)(f) GDPR).

Payments

Payments are handled by Stripe. We never see your card details. We receive the payment status, amount and the email address used. Legal basis: contract (Art. 6(1)(b) GDPR); invoices and payment records are kept for 7 years as required by Austrian tax law (Art. 6(1)(c) GDPR).

Analytics

We use Google Analytics 4 to understand how the site is used (for example, which pages lead to a try-on). Visitors in the EU, the EEA, the UK and Switzerland are asked first, and analytics cookies are only set if they agree; without consent Google receives cookieless signals without an identifier. Elsewhere analytics runs by default. Legal basis: consent (Art. 6(1)(a) GDPR) or legitimate interest (Art. 6(1)(f) GDPR). You can change your choice by clearing this site's data in your browser.

Cookies and local storage

One cookie keeps you signed in (strictly necessary). Your browser also stores a few settings locally (language, your cookie choice, the selected gender, a try-on in progress). These never leave your device except as part of the request you make.

3. Service providers

We use these processors, bound by data processing agreements:

• Cloudflare, Inc. (USA): hosting, database and photo storage.
• OpenRouter, Inc. (USA), which passes requests to Google (Gemini models): AI image generation and the face-shape analysis.
• Stripe Payments Europe, Ltd. (Ireland): payments.
• Resend (Plus Five Five, Inc., USA): sending emails.
• Google Ireland Ltd. / Google LLC (USA): analytics and, if you use it, Google sign-in.

Some of these providers process data in the USA. Transfers rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the EU Standard Contractual Clauses (Art. 46 GDPR).

4. How long we keep data

• Photos, looks and your account: until you delete them or your account. "Delete account" in your Suite removes everything at once.
• Accounts created with an email address that was never confirmed and never used to buy anything are deleted after 7 days.
• Payment records: 7 years (Austrian tax law).
• Analytics data: up to 14 months in Google Analytics.

5. Your rights

You can ask for access to your data, correction, deletion, restriction of processing and a copy in a portable format, and you can object to processing based on legitimate interest. You can withdraw a consent at any time with effect for the future. Write to office@rendersnek.com. You also have the right to complain to a supervisory authority; in Austria that is the Datenschutzbehörde, Barichgasse 40–42, 1030 Wien, www.dsb.gv.at.

6. Children

The service is not intended for children under 14. If you are under 14, please do not upload photos or create an account.

7. Changes

We update this policy when the service changes. The date at the top shows the current version.