Last updated: 28 June 2026

Keystone Labs Ltd

CRN: SC860392 // ICO: ZC187730

1533 Shettleston Road, Glasgow, Scotland, G32 9AS

1. Introduction

1.1 Who We Are

YourLook ("YourLook", "we", "our" or "us") is operated by Keystone Labs Ltd. For the purposes of UK data protection law, Keystone Labs Ltd is the controller of the Personal Data described in this Privacy Notice.

1.2 Our commitment to privacy

We are committed to processing Personal Data fairly, lawfully and transparently, and to protecting your privacy in accordance with applicable data protection law.

1.3 Scope of this Privacy Notice

This Privacy Notice explains what Personal Data we collect, how we use it, who we share it with, how long we keep it, how we protect it, and the rights you have when you use the Product or Service. Although Keystone Labs Ltd is established in the United Kingdom, the Product may be accessed by Users located in other jurisdictions. Where applicable data protection laws require additional rights or protections, we will comply with those mandatory legal requirements in addition to the protections described in this Privacy Notice.

1.4 Definitions

Capitalised terms used in this Privacy Notice have the meanings given in the Terms and Conditions, unless otherwise stated. "Personal Data" means any information relating to an identified or identifiable individual.

2. Personal Data We Collect

2.1 Information You Provide

We may collect information that you provide directly to us, including:

• account information, such as your name, username, email address, date of birth, and login details;

• profile information, such as profile photographs, descriptions, preferences, and any information you choose to provide;

• communications, including information you provide when you contact us by email, in-app messaging, phone, or social media; and

• Content uploaded or submitted through the Product, including photographs and, where applicable, business-related information.

2.2 Information Collected Automatically

When you use the Product or Service, we may automatically collect technical and usage information, including:

• Device information, such as device type, operating system, browser type, software version, and device identifiers

• Usage information, such as feature usage, booking activity, interaction data, time and frequency of use, and Product performance data

• Technical logs, including security, diagnostic, and error logs

• Location information, where you choose to enable location services or where otherwise permitted by law; and

• Cookie and tracking information, where permitted by law and subject to consent where required.

2.3 Professional Information

If you use the Product as a Professional, we may collect information relating to your salon, business, or professional profile, including location, opening hours, capacity, services, pricing, qualifications, availability, and other information you choose to provide.

2.4 Sources of Personal Data

We obtain Personal Data directly from you when you create an account, make a Booking, upload Content, communicate with us or otherwise use the Product.

We may also collect Personal Data automatically through your use of the Product, including technical, device and usage information, where permitted by applicable law.

Where necessary to facilitate Bookings or provide the Product, we may receive Personal Data from other Users, including Clients and Professionals, or from service providers acting on our behalf.

Certain Personal Data is required in order to create an account, process Bookings, provide customer support, process payments or comply with legal obligations. If you choose not to provide information that is required, we may be unable to provide some or all of the Product or Service.

2.5 Information We Do Not Intentionally Collect

Except for Biometric Data processed for optional biometric-enabled features and any health-related information you voluntarily provide in connection with a requested service, we do not intentionally collect special category data such as information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sex life or sexual orientation.

2.6 Children's Data

The Product is intended for use by individuals aged 18 or over. Where a User is under the age of 18, Personal Data relating to that User will be processed only with the involvement of a parent or legal guardian where required by applicable law.

3. Biometric Data

3.1 What Biometric Data We Collect

Certain optional features of the Product may require the processing of Biometric Data, including facial images and facial embeddings generated from those images. Biometric-enabled features are optional. Where the User is under the age of 18, any consent required for biometric processing must be provided or authorized by a parent or legal guardian where required by applicable law.

3.2 Why We Collect It

Biometric Data is processed solely for the purposes of providing the relevant optional feature, such as hairstyle visualisation, facial analysis or secure authentication where available.

3.3 Health information

You may voluntarily provide health-related information, including allergies, skin or scalp conditions, medical treatments, or other information relevant to the services requested. Such information is processed only where necessary to provide the requested services and, where required by applicable law, based on your explicit consent. Access to such information is limited to authorized personnel and relevant Professionals involved in providing the requested services.

Where health-related information constitutes special category data, we rely on your explicit consent under Article 9 of the UK GDPR unless another lawful condition applies

3.4 Explicit Consent

We will collect and process Biometric Data only where you have provided separate, explicit, informed and freely given consent for the specific feature concerned. The use of biometric features is optional and is not required to access the core functionality of the Product.

Where Biometric Data is processed for uniquely identifying or authenticating you, such as secure facial authentication, Keystone Labs Ltd processes that data as special category personal data under Article 9 of the UK GDPR and relies on your explicit consent as the applicable lawful condition for processing.

Some optional image-analysis features, such as hairstyle visualization, may analyze facial characteristics without being used to uniquely identify you. Where such processing nevertheless constitutes Biometric Data under applicable law, we will obtain your explicit consent before processing.

3.5 Information Provided Before Processing

Before biometric processing takes place, we will explain the categories of Biometric Data collected, the specific purpose of the processing, whether processing takes place on your device, on our servers or through an authorised service provider, whether any third-party processor is involved, the general retention period applicable to the Biometric Data and how you may withdraw your consent.

3.6 Storage and Third-Party Processing

Biometric processing may take place on your device, on Keystone Labs Ltd servers, or through carefully selected third-party service providers acting on our behalf, depending on the functionality used. We take reasonable steps to ensure that all third-party providers processing biometric data are contractually required to protect such data in accordance with applicable data protection law and to process it solely on our documented instructions

Where biometric data is processed by third-party service providers, such providers act solely as data processors on behalf of Keystone Labs Ltd. These providers may include cloud hosting providers and biometric technology providers. We require all such providers to implement appropriate technical and organizational security measures and to process biometric data only for the purposes authorized by Keystone Labs Ltd.

3.7 Security of Biometric Data

We implement appropriate technical and organisational measures to protect Biometric Data, given its sensitive nature. These measures may include, where appropriate, encryption in transit and encryption at rest. We monitor system-level security events through appropriate logging and monitoring processes.

3.8 Withdrawal of Consent

You may withdraw your consent to biometric processing at any time through your account settings or by contacting us. Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal, but it will disable the relevant biometric feature.

3.9 Deletion of Biometric Data

Unless we are required by law to retain it, your Biometric Data will be deleted or permanently de-identified without undue delay following withdrawal of consent or when the relevant biometric feature is disabled, in accordance with our retention and deletion practices.

For privacy-related enquiries, please contact us at: [email protected]

4. How We Use Your Personal Data

We use Personal Data for the following purposes:

• to provide, operate, maintain and improve the Product and Service;

• to create, manage and secure user accounts;

• to manage customer support;

• to personalise content, recommendations and user experience;

• to provide optional AI-assisted or biometric-enabled features where consent is required and obtained;

• to maintain safety, security, integrity and fraud prevention;

• to analyse usage, performance and engagement;

• to communicate with you about updates, service notices and support matters; and

• to comply with legal obligations and respond to lawful requests from competent authorities.

5. AI Features

We do not currently use AI-assisted features, but may introduce them in the future, subject to updated notices and consent where required.

6. Legal Bases for Processing

Depending on the purpose for which we process your Personal Data, we rely on one or more of the following lawful bases under the UK GDPR.

Where we rely on our legitimate interests, these include operating, securing, improving and developing the Product, preventing fraud, maintaining network and information security, and supporting our day-to-day business operations. Where we rely on consent, you may withdraw that consent at any time.

7. Sharing Your Information

7.1 Controller and Processor Roles

Keystone Labs Ltd is the controller of the Personal Data processed through the Product for the purposes described in this Privacy Notice.

Where we engage third-party service providers to process Personal Data on our behalf, those providers act as data processors and process Personal Data only under our documented instructions and in accordance with applicable data protection law.

Where Personal Data is shared with a Professional for the purpose of providing a requested service or fulfilling a Booking, that Professional may become an independent controller of the Personal Data they receive. In such circumstances, the Professional is independently responsible for complying with applicable data protection law in relation to that Personal Data.

7.2 Service Providers

We may share Personal Data with carefully selected service providers assisting us with cloud hosting, analytics, customer support, communications, security and technical infrastructure where necessary to provide the Product. These providers process Personal Data on our behalf under appropriate contractual safeguards and only in accordance with our documented instructions.

7.3 Legal Authorities

We may share Personal Data with legal, regulatory or law-enforcement authorities where required by law or where necessary to protect rights, safety, security or the integrity of the Product and Service.

7.4 Business Transfers

If Keystone Labs Ltd is involved in a merger, acquisition, financing, corporate restructuring or sale of assets, Personal Data may be disclosed or transferred as part of that transaction, subject to applicable law.

8. International Transfers

We aim to store and process Personal Data within the United Kingdom where reasonably practicable. However, some of our service providers may process Personal Data outside the United Kingdom, including where they provide hosting, analytics, customer support, communications, security, or technical infrastructure services.

Where Personal Data is transferred outside the United Kingdom, we will ensure that the transfer is made in accordance with applicable data protection law. This may include relying on UK adequacy regulations, the International Data Transfer Agreement, the UK Addendum to the European Commission’s Standard Contractual Clauses, or another lawful transfer mechanism.

We will take reasonable steps to ensure that third-party providers processing Personal Data on our behalf are subject to appropriate contractual, technical and organizational safeguards.

9. Data Retention

9.1 General Principles

We retain Personal Data only for as long as necessary to provide the Product and Service, comply with legal obligations, resolve disputes, enforce our agreements, prevent fraud and protect our rights and the rights of others. Retention periods vary depending on the type of information collected. Account information is retained until the account is deleted, unless a longer retention period is required by law. Financial records are retained for the period required by applicable accounting and tax legislation. Biometric Data is retained only for as long as the relevant feature remains enabled, unless otherwise required by law.

9.2 Retention of Different Categories of Data

Data records are generally retained where reasonably necessary for accounting, dispute resolution, fraud prevention, legal claims, regulatory compliance or the establishment, exercise or defense of legal rights.

9.3 Deletion and Anonymisation

Where Personal Data is no longer required, it will be deleted or anonymised in accordance with our data-retention practices and applicable law. Information that has been anonymised or aggregated so that it no longer identifies an individual may be used for statistical, analytical or Product-improvement purposes.

10. Security

10.1 Security Measures

Depending on the nature, scope, context, and purposes of the processing, and the risks to individuals' rights and freedoms, we implement appropriate technical and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.

Technical measures

• Secure cloud infrastructure and hosting solutions designed to protect the confidentiality, integrity, and availability of Personal Data.

• Monitoring and logging of system-level security and technical events to support the detection, investigation, and response to security incidents.

• encryption of Personal Data during storage ("at rest") and transmission ("in transit"), where appropriate, using appropriate cryptographic safeguards; and

• role-based access controls, authentication mechanisms, and database-level security measures designed to restrict access to Personal Data to authorized personnel with a legitimate business need.

Organizational measures

• restricting access to Personal Data on a need-to-know basis.

• confidentiality obligations for personnel with access to Personal Data.

• internal policies and procedures governing the handling of Personal Data; and

• periodic review of our security practices.

The security measures we implement may evolve to reflect changes in technology, operational requirements, and legal obligations.

10.2 Security Limitations

While we take reasonable steps to protect Personal Data, no method of electronic transmission, storage or processing can be guaranteed to be completely secure. Accordingly, we cannot guarantee that Personal Data will never be accessed, disclosed, altered or destroyed by unauthorized third parties.

10.3 Personal Data Breaches

If a Personal Data breach occurs, we will investigate the incident and comply with any applicable legal obligations, including notifying the Information Commissioner's Office and affected individuals where required by law.

11. Your Rights

Subject to applicable law, you may have the following rights in relation to your Personal Data:

• The right of access to your Personal Data

• The right to rectification of inaccurate or incomplete Personal Data

• The right to erasure of your Personal Data in certain circumstances

• The right to restriction of processing in certain circumstances

• The right to object to processing based on our legitimate interests

• The right to data portability, where applicable

• The right to withdraw consent at any time where processing is based on consent

• The right to lodge a complaint with the Information Commissioner's Office or another competent supervisory authority

12. Exercising Your Rights

12.1 How to Contact Us

If you wish to exercise any of your rights under applicable data protection law, you may contact us using the contact details provided in this Privacy Notice.

12.2 Identity Verification

We may request information necessary to verify your identity before responding to your request.

12.3 Response Times

Unless an extension is permitted by applicable law, we will normally respond within one month of receiving a valid request.

12.4 Fees

Requests are generally free of charge, although we may charge a reasonable fee or refuse a request where permitted by law, including where a request is manifestly unfounded or excessive.

13. Changes to this Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in our practices, legal requirements or operational needs. Where changes are material, we will provide notice through the Product or by other appropriate means before the changes take effect, where required by law.

14. Contact Information

Keystone Labs Ltd has not appointed a Data Protection Officer at this stage. Privacy-related enquiries should be sent to [email protected]

You also have the right to lodge a complaint with the Information Commissioner's Office. We would, however, appreciate the opportunity to address your concerns before you contact the ICO. Our ICO registration number is ZC187730.