PRIVACY POLICY — AMITY
Operator: JMVTECH DEVELOPER LTDA • Porto Alegre, RS, Brazil
Last Updated: July 6, 2026
1. INTRODUCTION
This Privacy Policy ("Policy") describes how JMVTECH DEVELOPER LTDA (a Brazilian limited liability company) ("we," "us," "our," or "Amity"), located at Avenida Cristóvão Colombo, No. 2144, Room 408, 3rd Floor, Floresta, Porto Alegre, RS, Brazil, CEP 90560-001, collects, uses, stores, shares, and protects the personal information of users ("you" or "User") of the Amity mobile application ("App").
This Policy has been prepared in compliance with applicable U.S. privacy laws, including the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), the Children's Online Privacy Protection Act (COPPA), the Illinois Biometric Information Privacy Act (BIPA), LGPD (Brazil), GDPR (Europe), and other applicable federal and state laws.
By using the App, you acknowledge that you have read and understood this Policy.
2. KEY DEFINITIONS
| Term | Definition |
|---|---|
| Personal Information | Information that identifies, relates to, describes, or could reasonably be linked to a particular individual. |
| Sensitive Personal Information | A subset of personal information including biometric data, precise geolocation, account credentials, and certain other categories. |
| Biometric Information | Information based on an individual's biometric identifiers, including facial geometry measurements. |
| Consumer (CCPA) | A California resident. |
| Business | Amity, acting as the controller/business that determines the purposes and means of processing personal information. |
| Service Provider | A third party that processes personal information on our behalf under a binding contract. |
| Sale / Sharing (CCPA) | Disclosing personal information to a third party for monetary or other valuable consideration, or for cross-context behavioral advertising. |
3. PERSONAL INFORMATION WE COLLECT
3.1. Account and Identification Data
Full name, email address, profile picture (avatar), auto-generated User ID (UUID), username (nickname), and bio provided during registration via Google or Apple OAuth.
3.2. Beauty ID Data (Beauty Profile)
Skin type (dry, oily, combination, normal, sensitive), skill level, skin undertone (warm, cool, neutral), face shape (detected automatically or entered manually), style preferences, and referral codes.
3.3. Biometric Information (SENSITIVE DATA)
- Reference facial photo: Bare-face selfie stored in encrypted private Cloudflare R2 object storage with time-limited signed access URLs.
- Facial landmark points (468 landmarks): Processed entirely on your local device via MediaPipe and NEVER transmitted to our servers.
- Live video frames (Amity Mirror): Processed in real-time (1 fps WebP) solely during active interactive sessions.
3.4. Audio and Voice Data
Microphone audio during active Amity Mirror interactive sessions. Wake word detection ("Amity") and voice activity detection (VAD) are performed locally on your device. Audio is NOT permanently saved or stored after the session ends.
3.5. User-Generated Content & Social Data
Saved looks, published feed posts, likes, saves, follower relationships, follow requests, and user block lists.
3.6. Subscription and Financial Data
Subscriptions are processed exclusively through the Google Play Store or Apple App Store and managed by RevenueCat. We do not collect, store, or have access to credit card numbers or bank account details.
3.7. Device and Technical Data
Device push notification token (FCM/APNS), device platform (Android/iOS/Web), connection status, and clipboard content (checks ONLY for the prefix amity-ref: on launch for referral code processing).
4. HOW WE USE YOUR INFORMATION
We process personal data for the following purposes:
- Service Delivery: Creating accounts, personalizing makeup recommendations, generating AI makeup look images, providing step-by-step tutorials, and operating Amity Mirror.
- Safety & Moderation: Detecting fraud, moderating feed content, and preventing abusive behavior.
- Monetization (Free Plan): Displaying relevant ads via Google AdMob (for free plan users only) with explicit consent management via Google UMP SDK.
5. HOW WE SHARE YOUR INFORMATION
We share personal information with verified subprocessors under strict data protection agreements:
| Provider | Country | Data Shared | Purpose & Safeguards |
|---|---|---|---|
| Supabase Inc. | USA | Database-stored data | Backend infrastructure, RLS database security (SOC 2, DPA) |
| Google Cloud / Vertex AI | USA | Facial images, Beauty ID | AI image generation & analysis (ISO 27001, Google Cloud DPA) |
| Cloudflare R2 Storage | Global CDN | Images (profile, looks, reference) | Encrypted private image storage & delivery (ISO 27001, DPA) |
| RevenueCat | USA | User ID, subscription status | In-app subscription management (RevenueCat DPA) |
| Google AdMob | USA | Ad identifiers, interaction data | Ad delivery for free plan users (ATT/UMP Consent, Google DPA) |
| Firebase Cloud Messaging | USA | Device push token | Sending push notifications |
| Upstash | USA | User ID | API rate limiting & caching (Upstash DPA) |
6. DATA STORAGE AND SECURITY
We implement technical and organizational security measures including Row Level Security (RLS) on PostgreSQL, JWT cryptographic verification, encrypted local credential storage, and private bucket policies with time-limited signed access URLs for user images.
7. CHILDREN'S PRIVACY (COPPA)
The App is directed to users 13 years of age and older. We do not knowingly collect personal information from children under 13. If we discover that a child under 13 has provided personal information, we will promptly delete such information. Contact: coppa@amityadvisor.com.
8. CALIFORNIA CONSUMER PRIVACY ACT (CCPA / CPRA)
California residents have specific rights to know, access, correct, delete, limit sensitive personal information use, and opt out of cross-context behavioral advertising.
9. YOUR PRIVACY RIGHTS
All users may exercise their rights to access, update, or delete their data directly in the App settings menu or by contacting our Privacy Officer at privacy@amityadvisor.com.
10. COOKIES AND TRACKING TECHNOLOGIES
We use session tokens for authentication and Google UMP for consent management. Users may opt out of interest-based ad tracking in device settings at any time.
11. ACCOUNT DELETION AND DATA REMOVAL
12. CHANGES TO THIS POLICY
We will notify you of material changes with at least 30 days' advance notice via in-app notification or registered email address.
13. CONTACT US
For questions or privacy requests:
- General Email: support@amityadvisor.com
- Privacy Requests: privacy@amityadvisor.com
- COPPA Requests: coppa@amityadvisor.com
- Mailing Address: Avenida Cristóvão Colombo, No. 2144, Room 408, 3rd Floor, Floresta, Porto Alegre, RS, Brazil, CEP 90560-001