1. Who we are
Clerva is a brand owned and operated by Onmo for Services LLC ("Onmo", "Clerva", "we", "us"). Onmo is responsible for the personal information processed to operate clerva.cc and the Clerva service, including facial aesthetics reports and optional Hairstyles purchases. For personal purchases, Onmo acts as the data controller. This Policy accompanies our Terms of Service.
Our Data Processing Agreement applies only where a separate written business agreement appoints Onmo to process personal information on a customer’s behalf. Personal customers do not need to sign a DPA to exercise their privacy rights.
2. Information we process
We process the facial photographs you upload; your age, gender, ancestry, country, preferences, and questionnaire answers; account and contact details; support communications; and the measurements, observations, recommendations, reports, and visualisations generated for you. Preferences may include skin concerns, grooming, lifestyle, and cultural or religious considerations that you choose to share.
We also process purchase amounts, currency, order references, payment status, saved choices, referral activity where used, consent records, and technical information such as browser, device, network, and security logs. Lemon Squeezy handles payment-card details; Clerva does not store full card numbers or security codes.
3. Purposes, legal grounds, and sensitive information
We use this information to manage accounts and purchases, analyse photographs, prepare and review personalised reports and images, provide support and transactional messages, and prevent misuse. AI providers process photographs and questionnaire information for these tasks. Authorized reviewers may access original photos and results when needed for quality assurance, safety, fraud prevention, or support.
Where applicable law requires a legal basis, we rely on performing our contract for the purchased service, legitimate interests in security and service administration, legal obligations for required records, and consent where required for optional processing or sensitive information. Ancestry and health-related or religious information can receive additional legal protection; facial images and derived measurements may be treated as biometric data under some laws. We use facial analysis for aesthetics, not to authenticate identity or make eligibility decisions. Accepting our Terms is not a substitute for any separate consent required by law.
We do not use your photographs for advertising or sell your photographs or reports. Our permission to process your content is limited to delivering, securing, and supporting your service; it is not a general licence to train unrelated AI models on your photographs.
4. Providers and disclosures
Providers include Clerk for authentication; Lemon Squeezy as payment provider and merchant of record; Cloudflare R2 for photo and report storage; Railway and Vercel for hosting; Google and Anthropic for AI analysis, content, and images as applicable; Modal for image segmentation when enabled; and Resend for email delivery. We share the information needed for their tasks, subject to applicable contractual and security obligations. Some providers, including the merchant of record, also process information for their own legal obligations under their own policies.
Google Analytics, Meta Platforms, and Snap Inc. support optional measurement as described below. We may disclose information when legally required, to protect rights or safety, or in a business transfer subject to appropriate confidentiality and applicable privacy requirements. If you choose to share a report or image, its recipients may retain or redistribute it; share only with people you trust.
5. Cookies, measurement, and optional messages
Necessary cookies and similar storage support sign-in, security, and your preferences. Optional analytics, advertising measurement, and optional lifecycle messages have separate choices. Optional measurement requires an affirmative choice; you can review or withdraw it using the control below or the available account preferences. Turning it off does not prevent you from buying or accessing your report. Essential purchase, report, account, and security messages are separate from optional messages.
When enabled, Google Analytics measures website use, and the Meta Pixel and Snap Pixel measure visits and conversions. These integrations may receive browser, network, device, referring-page, general-location, and campaign information. Browser integrations do not receive your photographs, report content, questionnaire answers, analysis IDs, account IDs, email addresses, or phone numbers from us. We strip report/account query parameters; campaign parameters may be used on tracked sales surfaces.
When advertising measurement is enabled, Snapchat’s server-side Conversions API also receives a SHA-256 hash of your normalized email, limited browser/network identifiers, and purchase metadata for attribution and deduplication. A hashed email is still personal information. It receives no photos, report content, questionnaire answers, or analysis/account IDs. The Snap Pixel and Conversions API are excluded from report, photo, preference, membership, settings, and admin activity. Advertising disclosures may qualify as “sharing” or targeted advertising under some privacy laws; the advertising choice controls these optional disclosures.
6. Retention and deletion
We retain your account, uploaded photographs, frozen purchase inputs, reports, and purchased images so you can access your service and past purchases, unless you request deletion or they are no longer needed for the stated purposes. You can delete your account in Settings or request photo-only deletion and assistance at privacy@clerva.cc. Account deletion removes the associated Clerva profile, analyses, reports, and stored photographs. Deletion may remove access to purchases and limit our ability to investigate a quality issue.
Records needed for tax, accounting, fraud prevention, disputes, or other legal obligations may be retained for the applicable requirement. Payment providers keep their own required transaction records. Any residual backup copies remain protected and are removed through the applicable backup lifecycle; deletion from every backup is not necessarily immediate.
7. Security and international processing
We use reasonable technical and organizational safeguards, including restricted access and encryption in transit and at rest for stored photos and reports. No system is completely secure. Onmo and its providers may process information in Qatar, the United States, and other countries where they operate. Protections may differ from those in your country. Where applicable law requires safeguards for a transfer, an appropriate lawful mechanism is required; use of the service alone does not waive those requirements. Contact privacy@clerva.cc for information about applicable safeguards.
8. Your rights and contact
Depending on applicable law, you may request access, a copy, correction, deletion, portability, restriction, or objection to processing, and withdraw consent without affecting earlier lawful processing. You may complain to the competent data protection authority and exercise applicable rights without unlawful discrimination. Contact privacy@clerva.cc; we may verify your identity and will respond within applicable legal deadlines. Company legal notices can be sent to legal@onmo.ai.
Clerva is for adults aged 18 and over. If we learn that a child has provided personal information, we will take steps to delete it. We will update the date on this Policy when it changes and give additional notice of material changes where required.