Privacy Notice
Last updated: August 5, 2026
Intro
Next Hair is a hairstyle inspiration and AI try-on product. People can browse haircut and hair color ideas, create an account, upload selfies, preview hairstyle results, save AI results to a gallery, and contact us for support.
Because AI try-on involves selfies and generated images, we treat uploaded photos, saved results, account details, and support messages as sensitive product data even when the law does not classify every item as sensitive information.
Content
- About us
- About you
- Personal data
- AI selfie and likeness processing
- Lawful bases for processing
- Users' data
- AI try-on and photo data
- Data sharing with third parties
- Pinterest API integration
- International data transfers
- Data protection
- Data subjects' rights
- Regional privacy rights
- Cookies
- Privacy Notice updates
- Contact us
About us
Next Hair determines how personal data is collected and used inside this website and related account flows. The controller is Mert EFE, an individual based in Ankara, Türkiye, operating under the Next Hair brand. The monitored electronic contact below accepts privacy requests and formal notices; address and identity evidence is provided through lawful private verification when required.
| Name | Next Hair |
|---|---|
| Website | Next Hair website and account AI hairstyle try-on product |
| Privacy contact | [email protected] or the contact page for privacy, account, or photo deletion requests. |
| Product status | Private-beta preparation. Live checkout is disabled pending provider approval and final legal/controller details. |
About you
The data we process depends on how you use the product. Browsing the magazine, creating an account, trying AI previews, buying credits, and contacting support involve different data categories.
| Type of user | Description |
|---|---|
| Visitor | Someone who browses articles, categories, search, detail pages, and public policy pages. |
| Account user | Someone who registers, logs in, uses account pages, saves gallery results, or purchases credits. |
| AI try-on user | Someone who uploads or selects a selfie and chooses hairstyle styles for AI preview generation. |
| Support requester | Someone who sends a message through the contact page, asks for deletion, or requests account help. |
Personal data
AI selfie and likeness processing
The AI hairstyle try-on is limited to adults aged 18 or older using their own selfie. Before a generation request is accepted, we require an affirmative confirmation of the current AI Selfie Rules. We process the selfie, hairstyle choices, and generated result to provide the requested preview. We keep the notice version, confirmation time, request route, account reference when applicable, and pseudonymous hashes of the session and limited security context for safety, compliance, and dispute handling. The audit record does not contain the selfie.
Do not upload another person, a public figure, or a minor. Do not use the service for face swaps, deepfakes, impersonation, or identity alteration. Uploaded images may be sent to the AI processing providers identified in this notice solely to operate the requested feature, subject to their applicable processing terms and our provider configuration.
Sources of data
We receive data directly from you when you browse, register, sign in, upload images, select hairstyles, use credits, send contact forms, or request a password reset. We may also receive basic sign-in data from Google if you choose Continue with Google.
Some technical data is collected automatically through cookies, sessions, logs, security checks, and browser/device information. See our Cookie Policy for more detail.
Next Hair also keeps limited first-party traffic records without placing an analytics cookie when a page is requested and while a visible page sends a short online-presence signal. These records contain the page path, approximate country supplied by Cloudflare, device class, referring host, account/guest status, and a rotating pseudonymous visitor code. The visitor's raw IP address is not written to the analytics tables, and the records do not contain names, email addresses, selfie data, prompts, or generated images.
Categories of data
| Data category | Examples | Why we use it |
|---|---|---|
| Account data | Name if provided, email address, password hash, Google account identifier, login state, credit balance. | To create accounts, authenticate users, secure sessions, show account pages, and manage credits. |
| Selfie and upload data | Uploaded selfies, selected previous uploads, temporary preview files, file metadata, and upload status. | To generate AI hairstyle previews and let you reuse previous uploads when available. |
| AI result data | Generated hairstyle images, selected styles, prompts or prompt hints, generation status, gallery records. | To show results, save gallery images, let you favorite/download/delete results, and improve the product flow. |
| Payment and credit data | Credit package choice, purchase status, transaction references, and payment provider events. | To add credits, verify purchases, prevent abuse, and keep purchase history. Full card data should be handled by the payment provider, not Next Hair. |
| Contact and support data | Name, email, message subject, message body, support history, reset password requests. | To respond to messages, send password reset links, and resolve account or privacy requests. |
| Technical data | IP address used transiently by infrastructure and security systems; device/browser details, approximate country, pages viewed, referring host, session cookies, error logs, and security events. | To keep the site working, diagnose bugs, prevent fraud, protect uploads, measure traffic, and understand product performance. |
Lawful bases for processing
Depending on your location, privacy law may require a lawful basis for processing. We rely on the following bases where applicable:
- Performance of a contract: to provide account login, AI try-on, gallery, credits, support, and requested services.
- Legitimate interests: to secure the site, prevent misuse, improve product quality, debug errors, and understand feature performance.
- Consent: for optional cookies, marketing, optional emails, and some third-party tools where consent is required.
- Legal obligations: for tax, accounting, fraud prevention, payment compliance, or responding to valid legal requests.
Users' data
| Data | Reasons for processing | Typical storage period |
|---|---|---|
| Email address and password hash | Account creation, login, account recovery, and fraud prevention. | Until account deletion, unless longer retention is required for security or legal reasons. |
| Google login data | To verify identity and create or access your Next Hair account when you choose Google sign-in. | Until account deletion or Google connection removal if supported. |
| Credit balance and usage history | To show available credits, charge credits for AI generation, and troubleshoot purchase or usage issues. | For the life of the account and as needed for payment records. |
| AI Selfie Rules confirmation record | To demonstrate that the current own-selfie, adult-use, and AI-processing notice was confirmed before a generation attempt. | Normally 24 months from confirmation. The record contains pseudonymous technical hashes and the notice version, not the selfie. |
| Support messages | To answer your request, investigate bugs, process deletion requests, or improve product support. | As long as needed to handle the request and maintain support records. |
| First-party traffic records | To count page visits, show anonymous live traffic and country distribution, diagnose traffic quality, and improve content. | Raw page-view records are retained for up to 90 days. Live-presence rows are removed after they become stale. The pseudonymous visitor code rotates monthly. |
AI try-on and photo data
AI hairstyle try-on depends on visual input. You may upload a selfie, select inspiration styles, choose filters such as gender, length, texture, or hair color, and ask the product to generate one or more hairstyle results.
| Data | How it is used | Important note |
|---|---|---|
| Uploaded selfie | Used to generate a hairstyle preview on your face. | Upload only your own current selfie. Third-party likenesses are not accepted. |
| Selected hairstyle reference | Used to guide the requested haircut, color, length, or styling direction. | Reference images must be owned, licensed, generated, or otherwise authorised for the intended use. |
| Generated AI result | Shown in the result flow and saved to your account gallery when applicable. | AI previews are decision-support visuals, not guaranteed salon outcomes. |
| Temporary processing files | Used during upload and generation. | The request upload is deleted after the generation request finishes. A server-owned guest continuation job expires after one hour. Provider-side processing follows the applicable provider terms and configuration. |
We do not sell your selfies. We do not use your private uploads as public marketing assets unless you give clear permission. You can request deletion of account data and saved AI results through the account flow or by contacting us.
Data sharing with third parties
We share personal data only when it is needed to provide the product, protect the service, operate infrastructure, process payments, send account emails, or comply with legal obligations.
| Third party type | Examples | Purpose |
|---|---|---|
| AI processing providers | FAL.ai and OpenAI/GPT Image services used by the current generation flow. | To generate hairstyle previews from the selfie and selected style instructions. |
| Email provider | Resend for account email and the domain support mailbox. | To send password reset links, account notices, and support emails. |
| Authentication provider | Google OAuth when Google sign-in is enabled. | To verify identity for users who choose Continue with Google. |
| Payment provider | Paddle, only if the product/domain is approved and checkout is later activated. | As authorised reseller/Merchant of Record, to process purchases, taxes, receipts, refunds, fraud checks, and payment confirmations. |
| Hosting, database, and storage providers | Railway for application/database infrastructure and Cloudflare for DNS, security, delivery, and R2 object storage. | To host the website, store account records, serve uploaded/generated images, and keep the product reliable. |
| Analytics and security tools | Next Hair's first-party traffic and live-presence measurement without an analytics cookie, Google Analytics 4 for consented public-page measurement, plus operational logging, anti-abuse, and debugging tools. | To understand page usage, country distribution, improve UX, detect errors, and protect accounts. Google Analytics is not loaded until analytics consent is given. |
| Legal or public authorities | Courts, regulators, tax authorities, law enforcement, or professional advisers. | Only when required by law, to enforce terms, prevent fraud, protect users, or respond to valid legal requests. |
Pinterest API integration
Next Hair uses the Pinterest API to let an authorised administrator connect a Pinterest account, retrieve that account's available boards, and publish explicitly selected Next Hair images as Pins. Each Pin is selected and approved before it is queued. Next Hair is an independent service and is not endorsed by, sponsored by, or affiliated with Pinterest.
The Pinterest OAuth access and refresh tokens are encrypted at rest and are used only to provide the connected account's requested Pinterest publishing functions. Next Hair does not sell, resell, redistribute, or disclose Pinterest content or Pinterest-derived data to third parties.
When the authorised administrator disconnects Pinterest, Next Hair deletes the stored Pinterest OAuth tokens and its Pinterest API publication records, including stored account, board, and Pin identifiers. Pending Pinterest API jobs are cancelled by deletion. Pins that were already published remain on Pinterest until the Pinterest account owner removes them on Pinterest.
International data transfers
Next Hair may use service providers located in different countries. If personal data is transferred outside your region, we aim to rely on appropriate safeguards, such as provider contracts, data processing terms, standard contractual clauses, or comparable legal mechanisms where required.
Current infrastructure and AI/email providers may process data outside Türkiye or the user's region. Paddle will receive checkout and transaction data only if checkout is approved and activated. Final transfer safeguards and retention terms require legal review before paid launch.
Data protection
We apply practical security measures based on the current stage of the product. These measures are intended to reduce unauthorized access, accidental deletion, misuse, and exposure of uploaded images or account data.
| Organizational measures | Access limitation, privacy-aware product planning, support request review, and production-readiness checks. |
|---|---|
| Technical measures | Password hashing, sessions, upload validation, database controls, environment variables, backups, and server-side account deletion flows. |
| Product measures | Gallery deletion tools, account deletion, credit checks before generation, and temporary upload cleanup targets. |
Data subjects' rights
Depending on where you live, you may have rights to access, correct, delete, export, restrict, or object to the processing of your personal data. You may also be able to withdraw consent where processing depends on consent.
| Right | Description |
|---|---|
| Access | You can ask what personal data we hold about you and how it is used. |
| Correction | You can ask us to correct inaccurate or incomplete account data. |
| Deletion | You can ask us to delete your account, saved results, uploaded files, and related records where legally possible. |
| Portability | You can ask for a copy of data you provided in a commonly used format where applicable. |
| Objection or restriction | You can object to or ask us to limit certain processing where the law gives you that right. |
| Withdraw consent | You can withdraw consent for optional cookies or marketing where consent was the basis. |
To exercise your rights, contact us. We may need to verify your identity before completing a request, especially for account deletion or photo-related requests.
Regional privacy rights
European Economic Area and United Kingdom residents
EEA and UK residents may have rights under GDPR or UK GDPR, including access, rectification, erasure, restriction, portability, objection, and the right to lodge a complaint with a supervisory authority. We aim to respond within the legally required timeframe.
United States residents
Some US states give residents additional rights, such as access, correction, deletion, portability, opt-out of sale or sharing, and limits on certain targeted advertising or sensitive data processing. Next Hair does not sell personal information as a business model.
| Right | Description | Notes |
|---|---|---|
| Right to know/access | You can ask for details about categories and specific pieces of personal data we process. | Available where state law applies. |
| Right to correct | You can ask us to correct inaccurate personal data. | Usually applies to account details. |
| Right to delete | You can ask us to delete personal data, including account and gallery records where possible. | Some payment/security records may be retained if legally required. |
| Right to opt out of sale or sharing | You can opt out if a business sells or shares personal data for cross-context advertising. | Next Hair does not sell personal photos or personal information. |
| Right to appeal | You may appeal a decision if a request is denied where applicable. | Contact us and include the original request context. |
Do not sell my personal information
We do not sell personal information or user-uploaded selfies. If this changes because of new advertising or data partnership features, this notice must be updated before those features are used.
Do-not-track requests
Browser do-not-track signals are not consistent across the web. We currently do not automatically respond to all do-not-track signals, but you can manage cookies in your browser and contact us with privacy questions.
Canada and Australia residents
Residents of Canada and Australia may have rights to access, correction, deletion or de-identification, complaint, and withdrawal of consent depending on applicable law. You can contact us to submit a request.
Cookies
Cookies help us keep sessions working, remember preferences, support account login, protect forms, and, when you allow analytics, understand usage of public pages through Google Analytics 4. Advertising storage, Google Signals, and ad personalization are disabled. Read the full Cookie Policy.
You can accept, decline, or later withdraw optional analytics through the Manage Preferences control in the site footer. Withdrawing analytics removes the Next Hair Google Analytics cookies available to the site and stops the tag from loading on the next page load.
The preference controls optional Google Analytics. They do not control the limited cookie-free first-party page-request and live-presence counts described above because that measurement does not place or read an analytics cookie.
You can also manage cookies through your browser settings:
Privacy Notice updates
We may update this Privacy Notice as Next Hair adds approved payments, analytics, AI providers, email features, or new account tools. The latest version will be posted on this page.
The controller's identity and monitored electronic contact are stated in this notice. Address and identity evidence is provided privately to Paddle, regulators, courts, and other competent authorities when lawfully required. If approved payment processing or optional analytics changes the processor, transfer, retention, or cookie details described here, this notice will be updated before that change is enabled.
Contact us
For privacy requests, account deletion, photo deletion, saved gallery data, or questions about this notice, email [email protected] or use the contact page.