Ovalight Privacy Policy

Effective date: 3 October 2026 · Last updated: 3 October 2026

This policy covers the Ovalight website at ovalight.com (the "Website") and the Ovalight iOS app (the "App"), together the "Service".

1. The short version

• Your photo is processed on your device. The photo you take or choose, and any face measurements used to crop and check it, are processed by code running in your browser or in the App on your device. We never receive or store your photo unless you choose to: by asking us to email your files to you, or by saving them in an optional account. We never analyse faces on our servers, and we never sell or share your photos.
• No account needed. You can use the Service without registering. An account is optional.
• We do process a small amount of other data, for example the IP address your device uses to load our Website, and — only if you buy something — an order record (order number, email address if you give one, product, price) so we can unlock your purchase, help you and issue refunds.
• No advertising trackers, no selling or "sharing" of personal data, no profiling.
• No cookies for analytics or advertising. We use on-device storage only to make the features you ask for work (for example, keeping your photo project on your device if you choose to).
• Questions or requests: support@ovalight.com.

2. Who we are

The Service is provided by QMETER L.L.C-FZ (QMETER L.L.C-FZ), a company registered in the Meydan Free Zone, United Arab Emirates, at Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates ("Ovalight", "we", "us"). For the limited personal data described in section 5, we are the controller (or "business", "data fiduciary", or equivalent term under your local law).

• Contact: support@ovalight.com (please write "Privacy" in the subject line)
• EU representative (GDPR Art. 27): not appointed — we rely on the Art. 27(2)(a) exemption (occasional, low-risk processing of order and support data only; no special categories). We will appoint and list one here if that changes
• UK representative (UK GDPR Art. 27): not appointed — same basis as the EU exemption (UK GDPR Art. 27(2)(a))
• Other local representatives (Türkiye, Saudi Arabia, others where required): see section 14.

We are an independent company. We are not affiliated with, endorsed by, or acting on behalf of any government, passport office, embassy, consulate or visa authority.

3. How the photo tool works — and what that means for your privacy

3.1 On-device processing

When you use the photo tool:

1. You take a photo with your camera or choose one from your device.
2. Code that we provide — machine-learning models running in your browser (for example via WebAssembly or WebGPU) or Apple's on-device Vision framework in the App — finds the face in the photo, measures its position and size, checks the lighting and the background, crops and resizes the photo to the official size specification you selected (or, where an authority asks for an uncropped photo, leaves it uncropped), and checks it against that specification. By default the photo's pixels are not edited beyond cropping and resizing; where a specification allows it and you choose it, the tool can gently even out an already plain background.
3. The result is shown to you, and you can export it as a digital file or a printable sheet.

All of these steps run on your device. The photo, any intermediate versions of it, and any face measurements (such as the position of your eyes and chin) are held in your device's memory while the tool is working and are not transmitted to us or to any other company by the Service.

The AI used by the Service only detects, measures, crops and cleans up the photo you provide. It does not generate faces, change your appearance, or identify who you are.

3.2 What "on your device" does and does not mean

To be precise about our promise:

• We never receive your photo. There is no upload step in the photo tool.
• Loading the Service requires an internet connection. When your browser loads the Website, or when the Website or App downloads its machine-learning model files, your device connects to our servers and our content delivery network. Those connections reveal technical data such as your IP address (see section 5.1) — but never your photo. After the Website and models have loaded, the photo tool can work without a connection.
• What you do with your photo afterwards is up to you. If you save the result to your photo library, sync your device with a cloud service (such as iCloud Photos or a device backup), share the file, email it, or upload it to a print shop or government portal, those actions are handled by your device, your operating system, or the service you choose — not by us — and their privacy terms apply.
• Other software on your device. We cannot control other software on your device, such as browser extensions, that may have access to what your browser displays.

3.3 Photos stored on your device

By default, your photo project is discarded when you close the tool. If you choose "Keep on this device", the project is saved in your browser's storage (IndexedDB) or in the App's private storage on your device, so you can come back to it. It stays on your device until you delete it using the "Delete" control, clear your browser data, or delete the App.

3.4 Photos of other people, including children

Many people use the Service to make photos for their children or other family members. You should only use a photo of another person if you are their parent or legal guardian or have their permission. Because the photo is processed on your device, we do not receive photos of children (see section 12).

4. Biometric information statement

Some laws give special protection to "biometric identifiers" or "biometric information" — for example, a scan of face geometry used to recognize a person. This includes the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier Act (CUBI), Washington's RCW 19.375 and My Health My Data Act, the Colorado Privacy Act (as amended by HB24-1130), the EU and UK GDPR, and similar laws.

• The face measurements used by the photo tool are calculated on your device, are used only to position, crop, and check your photo, are kept only in your device's temporary memory while the tool is working, and are discarded when processing ends. They are not used to identify or recognize anyone.
• We do not collect, capture, purchase, receive, possess, store, sell, lease, trade, disclose, or otherwise obtain biometric identifiers or biometric information through the Service.
• Retention schedule and destruction guidelines: because we do not possess biometric identifiers or biometric information, we hold none to retain. If we ever offer a feature that would involve us receiving such data, we will first update this policy, publish a retention schedule (with destruction no later than the earliest of the date the purpose is satisfied or the period required by applicable law), and obtain any consent required by law before collection.
• We do not use photo or face data for marketing, advertising, or data mining.

5. Personal data we do process

Please do not send us your photo for support. We never need your photo to help you or to process a refund or guarantee claim. If you send one anyway, we will delete it without using it, other than to reply.

Saved photos are photographs, not biometric data. Even when you choose to email or save your photos, we do not create face templates, measurements or identifiers from them on our servers, and we never use them to identify anyone, to train models, or for any purpose other than delivering them back to you.

In-App purchases (iOS). When you buy in the App, Apple sells the purchase to you and processes your payment under Apple's own privacy policy. We do not receive your name, email, or payment details from Apple; the App verifies the purchase on your device.

We do not: sell personal data; "share" personal data for cross-context behavioural advertising; use targeted advertising; build profiles; make decisions with legal or similarly significant effects by automated means; or knowingly collect sensitive personal data (such as biometric, health, or government ID numbers).

6. Who we share data with

• Payment processor (Stripe). Website purchases are sold to you by QMETER L.L.C-FZ. Payments are processed by Stripe, which collects your card or wallet details directly on its secure checkout page; we never see your full card number. Stripe acts as our processor for the payment and as an independent controller for its own fraud-prevention and legal obligations, under its privacy notice: https://stripe.com/privacy. We may move to another payment provider (for example a merchant of record); this policy will be updated before that happens.
• Apple. For purchases in the App, Apple is the seller and processes payment data under its own privacy policy.
• Service providers (processors) who act only on our instructions: hosting, content delivery, databases and optional photo storage (Cloudflare, Inc.), transactional email delivery (our email delivery provider, currently Resend), internal owner alerts without identifiers (WhatsApp, Meta Platforms; section 5.2a), support tools (our email hosting provider), and professional advisers (accountants, lawyers) under confidentiality obligations.
• Authorities, if required by law, or to protect our rights, users, or the public.
• Business transfers. If our business is sold or merged, personal data may transfer to the new owner, who must honour this policy.

We require our service providers to protect personal data with at least the same level of protection as described in this policy.

7. Cookies and on-device storage

We do not use cookies or similar technologies for advertising or cross-site tracking, and we do not use analytics cookies.

We use storage on your device only where it is strictly necessary for features you request:

Usage statistics. We measure usage on our server, without cookies, local storage, fingerprinting, or identifiers (section 5.2). Outside the EEA, the UK and Switzerland, the Studio also sends anonymous step counters (no cookies or identifiers); from those regions it sends none. You can opt out of any client-side statistics at /en/privacy/#analytics. We also honour the Global Privacy Control signal, although we do not sell or share personal data.

8. International transfers

We are based in the United Arab Emirates, and our service providers may process data in other countries (including the United States and the European Economic Area). Where we receive personal data from a provider in a country that restricts international transfers (for example, our merchant of record transferring order data from the EEA or UK), the transfer is protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses or the UK International Data Transfer Addendum, or another lawful mechanism. You can ask us for more information about these safeguards.

Your photo is never transferred anywhere by us, because we never receive it.

9. How long we keep data

We keep personal data only as long as needed for the purposes in section 5, then delete or anonymize it. Specific periods are listed in section 5. Records needed for legal claims may be kept until the claim is resolved.

10. Security

We use appropriate technical and organizational measures, including encryption in transit (HTTPS/TLS), access controls, least-privilege access for staff and providers, and data minimization — most importantly, by designing the photo tool so that photos never leave your device for our servers. No system is completely secure; if a breach affecting your personal data occurs, we will notify you and authorities where the law requires.

11. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a copy;
• correct inaccurate data;
• delete your data;
• restrict or object to certain processing (including processing based on legitimate interests);
• data portability;
• withdraw consent at any time, where we rely on consent (this does not affect earlier processing);
• not be discriminated against for exercising your rights;
• appeal a decision we make about your request; and
• complain to a data protection authority.

To exercise your rights, email support@ovalight.com with the subject "Privacy request". Because we have no accounts, we may ask for your order ID and the email address used for the purchase to find and verify your records. We do not hold your photos, so we cannot provide or delete them — you control them on your device. We will respond within the time required by your local law (for example, one month under the GDPR, 45 days under US state laws).

12. Children

The Service is intended for and directed to adults. Parents and legal guardians often use it to make passport, ID, or visa photos of their children, including babies. When they do, the child's photo is processed on the parent's device and is not sent to us.

We do not knowingly collect personal data from children under 13 (or the higher age set by local law — for example 16 in some EEA countries, or 18 in India). Purchases must be made by adults. If you believe a child has sent us personal data (for example, in a support email), contact us and we will delete it.

The App is not listed in the App Store Kids Category, does not contain third-party advertising or analytics, and does not use children's data for any purpose.

13. Region-specific information

13.1 European Economic Area, Switzerland, and the United Kingdom

• Controller: QMETER L.L.C-FZ, see section 2. Representatives: see section 2.
• Legal bases are listed in section 5. Where we rely on legitimate interests, we have balanced our interests against your rights; you can ask us for details and object at any time.
• Photos: we do not process your photos; any processing of the photo on your device is done by you, for your personal purposes. If a supervisory authority took a different view, the protections in sections 3 and 4 would still apply.
• Special category data: we do not process special category data (including biometric data for the purpose of uniquely identifying a person).
• Automated decision-making: none with legal or similarly significant effects.
• Complaints: you may complain to the data protection authority in your country of residence, work, or of the alleged infringement (EEA), to the UK Information Commissioner's Office (ico.org.uk), or to the Swiss FDPIC.
• UK statistics: we rely on the statistical-purposes exception for usage measurement and offer an opt-out (section 7).

13.2 United States

State privacy rights. Residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, and other states with consumer privacy laws may have the rights described in section 11, to the extent those laws apply to us. To appeal a decision on your request, reply to our decision with the subject "Privacy appeal"; if you are unhappy with the outcome, you may contact your state Attorney General.

California — notice at collection (categories, last 12 months):

We do not sell or share personal information, have not done so in the past 12 months, and do not use or disclose sensitive personal information. Retention periods are in section 5.

Biometric privacy laws (Illinois, Texas, Washington, Colorado, and others): see section 4. We do not collect, capture, possess, or disclose biometric identifiers or biometric information.

Washington My Health My Data Act and Nevada consumer health laws: we do not collect, share, or sell consumer health data.

Nevada: we do not sell covered information.

Children (COPPA): see section 12.

13.3 Canada (including Québec)

We process personal information in accordance with PIPEDA and applicable provincial laws, including Québec's Act respecting the protection of personal information in the private sector. The person in charge of the protection of personal information is Privacy Officer, reachable at support@ovalight.com. We do not use any biometric system to verify or confirm identity, and we do not create any database of biometric characteristics. You may complain to the Office of the Privacy Commissioner of Canada or, in Québec, to the Commission d'accès à l'information.

13.4 Brazil

We process personal data in accordance with the LGPD (Lei 13.709/2018). Legal bases: performance of a contract, compliance with legal or regulatory obligations, and legitimate interests (LGPD Art. 7). You have the rights in LGPD Art. 18, including confirmation of processing, access, correction, anonymization, blocking or deletion, portability, information about sharing, and revocation of consent. Contact (encarregado / communication channel): support@ovalight.com. You may complain to the Autoridade Nacional de Proteção de Dados (ANPD). We do not process sensitive personal data, including biometric data.

13.5 India

We process digital personal data in accordance with the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. We process your personal data for the purposes in section 5, on the basis of your consent (for example, when you contact us) or for legitimate uses permitted by the Act (for example, to provide a purchase you requested). You may access a summary of your data, correct or erase it, withdraw consent, and nominate another person to exercise your rights. Grievance officer: Privacy Officer, QMETER L.L.C-FZ (privacy@ovalight.com), support@ovalight.com. If you are not satisfied with our response, you may complain to the Data Protection Board of India. On request, we will provide this notice in English or any language specified in the Eighth Schedule to the Constitution of India. We do not process personal data of children; photos of children made by their parents are processed only on the parent's device.

13.6 United Arab Emirates

We process personal data in accordance with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and other applicable UAE law. You have the rights listed in section 11, including the rights to obtain information, request correction or erasure, restrict and object to processing. You may complain to the UAE Data Office.

13.7 Türkiye

For individuals in Türkiye, QMETER L.L.C-FZ acts as data controller under Law No. 6698 on the Protection of Personal Data (KVKK). Your personal data are processed for the purposes and on the legal grounds in section 5 (KVKK Art. 5(2)(c) performance of a contract, (ç) legal obligation, (f) legitimate interests). You have the rights in KVKK Art. 11. Data controller representative in Türkiye: to be appointed if the KVKK Board's VERBIS rules require it for a controller established abroad.

13.8 Saudi Arabia

For individuals in the Kingdom of Saudi Arabia, we process personal data in accordance with the Personal Data Protection Law and its Implementing Regulations. Representative in the Kingdom (if required): not appointed at launch; we will appoint one if the Implementing Regulations require it for our level of processing. You have the rights to be informed, to access, to request correction and destruction of your personal data, and you may complain to the Saudi Data & AI Authority (SDAIA).

13.9 Azerbaijan

For individuals in the Republic of Azerbaijan, we process personal data in accordance with the Law of the Republic of Azerbaijan "On Personal Data". We do not collect face images or other biometric data. You may exercise the rights described in section 11 by contacting us.

13.10 Russian Federation

We do not offer paid services in the Russian Federation and do not intentionally collect personal data of citizens of the Russian Federation. The free photo tool processes photos only on your device.

13.11 Australia

We handle personal information consistently with the Australian Privacy Principles. You may access and correct your personal information and complain to us; if you are not satisfied, you may complain to the Office of the Australian Information Commissioner (oaic.gov.au).

13.12 Japan

We handle personal information in accordance with the Act on the Protection of Personal Information (APPI). Purposes of use are listed in section 5; our security control measures are described in section 10. You may request disclosure, correction, suspension of use, or deletion of retained personal data by contacting us. Information about the foreign countries in which personal data may be processed, and their personal information protection systems, is available on request.

13.13 Republic of Korea

We process personal information in accordance with the Personal Information Protection Act (PIPA). Purposes, items, and retention periods are in sections 5 and 9; entrusted processors are listed in section 6; overseas transfers are described in section 8. Privacy officer: Privacy Officer, support@ovalight.com.

13.14 Other countries

If you live in a country not listed above, you have the rights given by your local law. Contact us and we will help.

14. Print-and-Mail service (Phase 2) — NOT YET ACTIVE

This section describes a future optional feature. It is not available yet, and none of the processing below takes place today. Before launch, this section will be completed, reviewed by counsel, and shown to you at the moment you choose the feature.

What will be different. If you choose to order printed photos delivered to you, we will — only with your separate, explicit consent given for that order — upload the finished print sheet (not your original photo) together with your name, shipping address, email address, and phone number (if required by the carrier) to our print partner, a print partner that will be named here before this feature launches (to be stated before launch), and to us, so that the sheet can be printed and posted to you.

15. Changes to this policy

We will update this policy when our practices change. For material changes — especially any change to how photos are processed — we will give prominent notice on the Website and in the App before the change takes effect and, where required, ask for your consent.

16. Contact

QMETER L.L.C-FZ, Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates, Meydan Free Zone, United Arab Emirates · support@ovalight.com