Limited data, used to run your account and product.

Rizzado is a cosmetic hair-care decision system. This policy explains the information needed to provide the service, where progress is stored and the choices available to you.

Information we collect

Your email address, first name when provided, and authentication records required to create and protect your account.
Purchase and access records supplied by checkout providers such as Lemon Squeezy, Hotmart or Whop.
Hair profile answers, product inventory, routine plans, weather context, analyses and logs you create while using Rizzado.
If you use the free plan: your email, a short-lived code to confirm it, how many of your 5 free scans, 3 routines and 5 questions to Cira you have used and, if you accepted marketing cookies, the ad that brought you to Rizzado.
Messages and files you choose to send to [email protected].

Cloud sync and device cache

For signed-in users, Rizzado synchronizes supported profile, product, routine, scan, chapter progress, quiz draft and recent Cira conversation state with the account through Supabase. A local copy supports loading and offline recovery. If cloud sync fails, the app marks the affected data as unsynchronized; the local copy alone does not mean it reached your account. Older data created before an item gained cloud support may remain on its original device.

Legacy diagnostic answers and learning trackers (reset day and wash-day history) also sync under your signed-in account. Their device copies are account-scoped and are not shared between accounts on the same browser.

The optional recent-change timeline about shedding, density and body context stays on your device unless you separately authorize cloud sync. If you authorize it while signed in, the entries are stored with your account, restored on your other devices and can be deleted from the timeline. You can stop cloud sync at any time; doing so deletes the account copy and leaves the local entries on that device.

Clearing browser data can remove an unsynchronized cache, but it does not by itself delete information already associated with your cloud account. Contact support if you want help reviewing or deleting account data.

How we use information

We use this information to authenticate accounts, restore your product state, produce contextual cosmetic guidance, send transactional messages, provide support, maintain purchase records, improve reliability and prevent abuse.

Legal bases

We process each type of information on the legal basis that fits its purpose:

Performance of a contract: creating your account, giving you access, syncing your profile and providing the service you purchased.
Consent: marketing emails and the scalp observations you choose to share. For analytics and marketing cookies, your choice in the cookie banner applies. You can withdraw it at any time.
Legitimate interest: keeping the service secure, preventing fraud and abuse, and improving reliability, always weighed against your rights.
Legal obligation: keeping purchase and tax records for the period the law requires.

How long we keep it

We keep your account and profile information while your account is active. If you delete your account, we delete your profile, analyses, photos, routine history and Cira data. Purchase records are kept in anonymized form, no longer linked to your email, for the period accounting and tax rules require. Support messages are kept as long as needed to resolve and follow up on your request, and backups and logs are removed in their normal rotation cycle.

Free accounts: if an account without a paid plan goes 90 days without use, we delete it. We email you on day 83, and using the account again restarts the 90 days. We delete the hair profile, scans, products and attribution data. We keep only the email address, in a normalized form, so the same inbox cannot start another free trial. The hair profile of a free account is the same kind of data as a paid one, it is protected the same way, and the scalp authorization applies equally.

Emails during the free trial: the sign-in code is a transactional email and always arrives. Follow-up emails about the trial, such as how many scans you have left, are marketing: each one has an unsubscribe link, and unsubscribing does not affect your code or your account.

Service providers

Hosting, authentication, email, payments, analytics and support may be handled by providers such as Cloudflare, Supabase, Resend, Kit, Lemon Squeezy, Hotmart or Whop. They process information under their own terms and only for the services they provide. Rizzado does not sell your personal information.

International transfers

Rizzado and several of its providers operate outside your country, so your information may be stored and processed in other countries, including the United States. We only work with providers that commit to data protection safeguards and, where the law requires it, we rely on standard contractual clauses or other transfer mechanisms recognized by the competent authority.

Cookies and similar technologies

Rizzado uses necessary browser storage for language, login, security and forms, which is always on. Analytics and marketing are on by default on the public site: you can turn them off at any time from “Settings” in the cookie banner or from cookie preferences.

Payment information

Checkout providers process payment details. Rizzado does not store full payment-card numbers.

Scalp observations

The profile asks cosmetic questions about your hair and scalp, such as whether it itches or feels sensitive. We use those answers only to adjust your routine and to point out when it makes sense to see a professional, and only after you authorize it in that question. Rizzado does not diagnose health conditions, so avoid sending medical details that are not needed.

Your rights

You can ask us at any time to:

confirm whether we process your data and give you access to it;
correct data that is incomplete, inaccurate or out of date;
anonymize, block or delete data that is unnecessary, excessive or processed unlawfully;
send your data to you or to another provider (portability);
delete data processed with your consent, and withdraw that consent;
tell you which companies we share your data with;
explain what happens if you do not give consent;
review decisions made only through automated processing, and object to processing you disagree with.

Email [email protected] to exercise any of these rights. We reply within 15 days. You can also file a complaint with the data protection authority in your country (in Brazil, the ANPD).

Contact

For privacy questions, use our contact page or email [email protected].

Privacy contact: [email protected]. This is the channel for any request about your personal data.

Last updated: November 2, 2026