Legal

Privacy policy

Last updated 11 November 2026. This policy explains what information Heume collects, why, who processes it, how long we keep it and how you can delete it.

Who we are

Heume (heume.co) is a facial analysis and improvement service run by Squid Social, based in the United Arab Emirates ("Heume", "we", "us"). We are responsible for the personal information described here. You can contact us about privacy at support@heume.co or through the chat on this website.

Heume gives cosmetic and lifestyle guidance. It is not a medical service. Heume is only for people aged 18 or older, and we do not knowingly collect information from anyone younger.

Information we collect

Account information. When you create an account we collect your first name, email address, a password (stored only as a one-way scrambled hash, never as plain text) and the promo code you used to sign up.

Google sign-in information. If you choose "Continue with Google", Google shares with us your Google account ID, your email address, whether that email is verified, and your name. We ask only for these basic profile details (the openid, email and profile scopes). We do not get your Google password, and we do not access your Gmail, Google Drive, contacts, calendar, photos or any other Google data.

Photos you upload. To run a scan you upload photos of your face (front and both sides) and, if you choose, a photo of the back of your head for hair analysis.

Scan results. From your photos we produce facial landmark positions, measurements, skin and hair readings, scores, a written report, an improvement plan and an AI-generated "potential you" image. We keep these with your account so you can see your progress over time.

Optional profile details. You may tell us your sex, age band and facial hair so we can compare your measurements with suitable reference ranges. You may also tell us your ethnic background, which is sensitive information. We use your background only if you give explicit consent by ticking the consent box, and you can remove it at any time. We never guess any of these details from your photos.

Chat messages. If you use the chat on our website or in your dashboard, we keep the messages you send and our replies. On the website the chat also asks, optionally, for your name and email so we can follow up, and records which page you started the chat from.

Technical information. Our servers handle your IP address to deliver the service and to limit abuse (for example, too many sign-in attempts). We do not use advertising or analytics trackers on this website or in the app.

How we use your information

To create and secure your account and sign you in, including with Google.
To analyse your photos and produce your scores, report, improvement plan and potential image.
To have a member of our team review each report before it reaches you.
To show your scans, progress and protocol in your dashboard.
To answer your chat messages and support requests.
To protect the service against fraud and abuse, and to meet legal obligations.

We do not sell your personal information, we do not share it for advertising, and we do not use your photos to market Heume.

Google user data

Heume's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

We use the Google account ID, email and name only to create your Heume account, sign you in and contact you about your account.
We do not transfer this data to anyone else, except as needed to provide the service (our hosting provider stores it), to comply with law, or as part of a merger or sale of the business with notice to you.
We do not use it for advertising, we do not sell it, and we do not use it to train AI or machine learning models.
No person at Heume reads it except with your permission, for security reasons, to comply with law, or for internal operations such as answering your support request.

Who processes your information

We use a small number of service providers who process data on our behalf and only to run Heume:

Google Cloud (Cloud Run, Cloud Storage and Firestore) hosts the app. Your photos and scan results are stored in Cloud Storage; your account, promo code and chat records are stored in Firestore.
Google Gemini API receives your photos and scan measurements to check photo quality, write your report text and create your potential image. Google processes this data as our provider under its Gemini API terms.
Google Identity Services provides the "Continue with Google" button if you choose to use it.
Google Fonts supplies the typefaces on this website, so your browser requests them from Google's servers.

These providers may process data in countries other than your own, including the United States. Where the law requires it, we rely on the safeguards those providers offer for international transfers.

Legal basis

We follow the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, for people in other countries, the privacy laws that apply to them, such as the GDPR. Where those laws require a legal basis, we process your account, photos and scan results to provide the service you asked for (contract), your ethnic background only with your explicit consent, and security and abuse-prevention information for our legitimate interest in keeping Heume safe.

How long we keep it

Photos, scans and reports: until you delete them or close your account.
Account information: while your account is open. When you ask us to close it, we delete it within 30 days.
Chat messages: up to 12 months after the last message, unless you ask us to delete them sooner.
Backups and logs: deleted data may remain in routine backups or server logs for a short time, up to 30 days, before it is overwritten.

Deleting your data and your rights

You can delete your photos, scans and reports at any time in the app under Account > Your data > Delete my data. To close your account completely, or to delete chat messages, email support@heume.co or ask in the chat from the email address on your account.

Depending on where you live, you may also have the right to access a copy of your data, correct it, restrict or object to how we use it, take it to another service, and withdraw consent at any time. Contact us to use any of these rights. You can also complain to your local data protection authority.

If you used Google sign-in, you can also remove Heume's access from your Google account at myaccount.google.com/connections.

Cookies and local storage

We use only cookies and browser storage that the service needs to work:

Sign-in cookie (facet_customer): keeps you signed in for up to 60 days.
Team cookie (facet_gate): used only by the Heume team's sign-in.
Browser storage: remembers your website chat conversation, your profile choices and your latest dashboard data on your device.

Google may set its own cookies when you use the "Continue with Google" button, under Google's privacy policy. We do not use advertising or tracking cookies.

Security

Data is sent over encrypted connections (HTTPS) and stored on Google Cloud, which encrypts data at rest. Passwords are stored only as salted hashes, and each customer can see only their own scans. No system is perfectly secure, but we limit who on our team can reach your data and use it only to provide the service.

Changes to this policy

If we change this policy we will update the date at the top. If a change is significant, we will tell you in the app or by email before it takes effect.

Contact

Squid Social, United Arab Emirates
Email: support@heume.co