Privacy Notice
Last updated: July 21, 2026
Intro
Next Hair is a hairstyle inspiration and AI try-on product. People can browse haircut and hair color ideas, create an account, upload selfies, preview hairstyle results, save AI results to a gallery, and contact us for support.
Because AI try-on involves selfies and generated images, we treat uploaded photos, saved results, account details, and support messages as sensitive product data even when the law does not classify every item as sensitive information.
Content
- About us
- About you
- Personal data
- AI selfie and likeness processing
- Lawful bases for processing
- Users' data
- AI try-on and photo data
- Data sharing with third parties
- International data transfers
- Data protection
- Data subjects' rights
- Regional privacy rights
- Cookies
- Privacy Notice updates
- Contact us
About us
Next Hair determines how personal data is collected and used inside this website and related account flows. The controller is Mert EFE, an individual based in Ankara, Türkiye, operating under the Next Hair brand. The monitored electronic contact below accepts privacy requests and formal notices; address and identity evidence is provided through lawful private verification when required.
| Name | Next Hair |
|---|---|
| Website | Next Hair website and account AI hairstyle try-on product |
| Privacy contact | [email protected] or the contact page for privacy, account, or photo deletion requests. |
| Product status | Private-beta preparation. Live checkout is disabled pending provider approval and final legal/controller details. |
About you
The data we process depends on how you use the product. Browsing the magazine, creating an account, trying AI previews, buying credits, and contacting support involve different data categories.
| Type of user | Description |
|---|---|
| Visitor | Someone who browses articles, categories, search, detail pages, and public policy pages. |
| Account user | Someone who registers, logs in, uses account pages, saves gallery results, or purchases credits. |
| AI try-on user | Someone who uploads or selects a selfie and chooses hairstyle styles for AI preview generation. |
| Support requester | Someone who sends a message through the contact page, asks for deletion, or requests account help. |
Personal data
AI selfie and likeness processing
The AI hairstyle try-on is limited to adults aged 18 or older using their own selfie. Before a generation request is accepted, we require an affirmative confirmation of the current AI Selfie Rules. We process the selfie, hairstyle choices, and generated result to provide the requested preview. We keep the notice version, confirmation time, request route, account reference when applicable, and pseudonymous hashes of the session and limited security context for safety, compliance, and dispute handling. The audit record does not contain the selfie.
Do not upload another person, a public figure, or a minor. Do not use the service for face swaps, deepfakes, impersonation, or identity alteration. Uploaded images may be sent to the AI processing providers identified in this notice solely to operate the requested feature, subject to their applicable processing terms and our provider configuration.
Sources of data
We receive data directly from you when you browse, register, sign in, upload images, select hairstyles, use credits, send contact forms, or request a password reset. We may also receive basic sign-in data from Google if you choose Continue with Google.
Some technical data is collected automatically through cookies, sessions, logs, security checks, and browser/device information. See our Cookie Policy for more detail.
Categories of data
| Data category | Examples | Why we use it |
|---|---|---|
| Account data | Name if provided, email address, password hash, Google account identifier, login state, credit balance. | To create accounts, authenticate users, secure sessions, show account pages, and manage credits. |
| Selfie and upload data | Uploaded selfies, selected previous uploads, temporary preview files, file metadata, and upload status. | To generate AI hairstyle previews and let you reuse previous uploads when available. |
| AI result data | Generated hairstyle images, selected styles, prompts or prompt hints, generation status, gallery records. | To show results, save gallery images, let you favorite/download/delete results, and improve the product flow. |
| Payment and credit data | Credit package choice, purchase status, transaction references, and payment provider events. | To add credits, verify purchases, prevent abuse, and keep purchase history. Full card data should be handled by the payment provider, not Next Hair. |
| Contact and support data | Name, email, message subject, message body, support history, reset password requests. | To respond to messages, send password reset links, and resolve account or privacy requests. |
| Technical data | IP address, device/browser details, pages viewed, session cookies, error logs, security events. | To keep the site working, diagnose bugs, prevent fraud, protect uploads, and understand product performance. |
Lawful bases for processing
Depending on your location, privacy law may require a lawful basis for processing. We rely on the following bases where applicable:
- Performance of a contract: to provide account login, AI try-on, gallery, credits, support, and requested services.
- Legitimate interests: to secure the site, prevent misuse, improve product quality, debug errors, and understand feature performance.
- Consent: for optional cookies, marketing, optional emails, and some third-party tools where consent is required.
- Legal obligations: for tax, accounting, fraud prevention, payment compliance, or responding to valid legal requests.
Users' data
| Data | Reasons for processing | Typical storage period |
|---|---|---|
| Email address and password hash | Account creation, login, account recovery, and fraud prevention. | Until account deletion, unless longer retention is required for security or legal reasons. |
| Google login data | To verify identity and create or access your Next Hair account when you choose Google sign-in. | Until account deletion or Google connection removal if supported. |
| Credit balance and usage history | To show available credits, charge credits for AI generation, and troubleshoot purchase or usage issues. | For the life of the account and as needed for payment records. |
| AI Selfie Rules confirmation record | To demonstrate that the current own-selfie, adult-use, and AI-processing notice was confirmed before a generation attempt. | Normally 24 months from confirmation. The record contains pseudonymous technical hashes and the notice version, not the selfie. |
| Support messages | To answer your request, investigate bugs, process deletion requests, or improve product support. | As long as needed to handle the request and maintain support records. |
AI try-on and photo data
AI hairstyle try-on depends on visual input. You may upload a selfie, select inspiration styles, choose filters such as gender, length, texture, or hair color, and ask the product to generate one or more hairstyle results.
| Data | How it is used | Important note |
|---|---|---|
| Uploaded selfie | Used to generate a hairstyle preview on your face. | Upload only your own current selfie. Third-party likenesses are not accepted. |
| Selected hairstyle reference | Used to guide the requested haircut, color, length, or styling direction. | Reference images should be licensed, owned, generated, or otherwise safe to use before production launch. |
| Generated AI result | Shown in the result flow and saved to your account gallery when applicable. | AI previews are decision-support visuals, not guaranteed salon outcomes. |
| Temporary processing files | Used during upload and generation. | The request upload is deleted after the generation request finishes. A server-owned guest continuation job expires after one hour. Provider-side processing follows the applicable provider terms and configuration. |
We do not sell your selfies. We do not use your private uploads as public marketing assets unless you give clear permission. You can request deletion of account data and saved AI results through the account flow or by contacting us.
Data sharing with third parties
We share personal data only when it is needed to provide the product, protect the service, operate infrastructure, process payments, send account emails, or comply with legal obligations.
| Third party type | Examples | Purpose |
|---|---|---|
| AI processing providers | FAL.ai and OpenAI/GPT Image services used by the current generation flow. | To generate hairstyle previews from the selfie and selected style instructions. |
| Email provider | Resend for account email and the domain support mailbox. | To send password reset links, account notices, and support emails. |
| Authentication provider | Google OAuth when Google sign-in is enabled. | To verify identity for users who choose Continue with Google. |
| Payment provider | Paddle, only if the product/domain is approved and checkout is later activated. | As authorised reseller/Merchant of Record, to process purchases, taxes, receipts, refunds, fraud checks, and payment confirmations. |
| Hosting, database, and storage providers | Railway for application/database infrastructure and Cloudflare for DNS, security, delivery, and R2 object storage. | To host the website, store account records, serve uploaded/generated images, and keep the product reliable. |
| Analytics and security tools | Analytics, logging, anti-abuse, and debugging tools if enabled. | To understand performance, improve UX, detect errors, and protect accounts. |
| Legal or public authorities | Courts, regulators, tax authorities, law enforcement, or professional advisers. | Only when required by law, to enforce terms, prevent fraud, protect users, or respond to valid legal requests. |
International data transfers
Next Hair may use service providers located in different countries. If personal data is transferred outside your region, we aim to rely on appropriate safeguards, such as provider contracts, data processing terms, standard contractual clauses, or comparable legal mechanisms where required.
Current infrastructure and AI/email providers may process data outside Türkiye or the user's region. Paddle will receive checkout and transaction data only if checkout is approved and activated. Final transfer safeguards and retention terms require legal review before paid launch.
Data protection
We apply practical security measures based on the current stage of the product. These measures are intended to reduce unauthorized access, accidental deletion, misuse, and exposure of uploaded images or account data.
| Organizational measures | Access limitation, privacy-aware product planning, support request review, and production-readiness checks. |
|---|---|
| Technical measures | Password hashing, sessions, upload validation, database controls, environment variables, backups, and server-side account deletion flows. |
| Product measures | Gallery deletion tools, account deletion, credit checks before generation, and temporary upload cleanup targets. |
Data subjects' rights
Depending on where you live, you may have rights to access, correct, delete, export, restrict, or object to the processing of your personal data. You may also be able to withdraw consent where processing depends on consent.
| Right | Description |
|---|---|
| Access | You can ask what personal data we hold about you and how it is used. |
| Correction | You can ask us to correct inaccurate or incomplete account data. |
| Deletion | You can ask us to delete your account, saved results, uploaded files, and related records where legally possible. |
| Portability | You can ask for a copy of data you provided in a commonly used format where applicable. |
| Objection or restriction | You can object to or ask us to limit certain processing where the law gives you that right. |
| Withdraw consent | You can withdraw consent for optional cookies or marketing where consent was the basis. |
To exercise your rights, contact us. We may need to verify your identity before completing a request, especially for account deletion or photo-related requests.
Regional privacy rights
European Economic Area and United Kingdom residents
EEA and UK residents may have rights under GDPR or UK GDPR, including access, rectification, erasure, restriction, portability, objection, and the right to lodge a complaint with a supervisory authority. We aim to respond within the legally required timeframe.
United States residents
Some US states give residents additional rights, such as access, correction, deletion, portability, opt-out of sale or sharing, and limits on certain targeted advertising or sensitive data processing. Next Hair does not sell personal information as a business model.
| Right | Description | Notes |
|---|---|---|
| Right to know/access | You can ask for details about categories and specific pieces of personal data we process. | Available where state law applies. |
| Right to correct | You can ask us to correct inaccurate personal data. | Usually applies to account details. |
| Right to delete | You can ask us to delete personal data, including account and gallery records where possible. | Some payment/security records may be retained if legally required. |
| Right to opt out of sale or sharing | You can opt out if a business sells or shares personal data for cross-context advertising. | Next Hair does not sell personal photos or personal information. |
| Right to appeal | You may appeal a decision if a request is denied where applicable. | Contact us and include the original request context. |
Do not sell my personal information
We do not sell personal information or user-uploaded selfies. If this changes because of new advertising or data partnership features, this notice must be updated before those features are used.
Do-not-track requests
Browser do-not-track signals are not consistent across the web. We currently do not automatically respond to all do-not-track signals, but you can manage cookies in your browser and contact us with privacy questions.
Canada and Australia residents
Residents of Canada and Australia may have rights to access, correction, deletion or de-identification, complaint, and withdrawal of consent depending on applicable law. You can contact us to submit a request.
Cookies
Cookies help us keep sessions working, remember preferences, support account login, protect forms, understand performance, and prepare payment or analytics features. Read the full Cookie Policy.
You can also manage cookies through your browser settings:
Privacy Notice updates
We may update this Privacy Notice as Next Hair adds approved payments, analytics, AI providers, email features, or new account tools. The latest version will be posted on this page.
The controller's identity and monitored electronic contact are stated in this notice. Address and identity evidence is provided privately to Paddle, regulators, courts, and other competent authorities when lawfully required. If approved payment processing or optional analytics changes the processor, transfer, retention, or cookie details described here, this notice will be updated before that change is enabled.
Contact us
For privacy requests, account deletion, photo deletion, saved gallery data, or questions about this notice, email [email protected] or use the contact page.