Privacy notice

Last updated: 29 September 2026

This notice explains how ZAYC LTD uses your personal data when you use Kinetic Maxxer on the web at kineticmaxxer.com or in the Kinetic Maxxer app for iOS and Android. It is written to meet the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

1. Who we are

Kinetic Maxxer is a product of ZAYC LTD, a private limited company registered in England and Wales (company number 12067505). ZAYC LTD is the controller of your personal data.

• Registered office: Unit Da2 Sutherland House, 43 Sutherland Road, London E17 6BU, United Kingdom
• Privacy contact: support@kineticmaxxer.com
• ICO registration number: [ICO registration number — to be added]

We are a small company and have not appointed a data protection officer. Please send any privacy question or request to support@kineticmaxxer.com.

2. The data we collect

Data you give us

• Account details: your email address and password. We store the password only as a bcrypt hash.
• Optional profile details: age range, gender, bio, height, weight, fitness goals, time zone, language and theme.
• Face photos: the front and side photos you upload for analysis.
• Support tickets and contact form messages, including the name and email you give us.
• Your email and privacy choices, and a record of when and how you made them.

Data we create when you use the service

• Analysis results derived from your photos: face-geometry scores, strengths and weaknesses, and the advice we show you.
• Your scan history, XP and achievements.
• If you switch on your public profile, a leaderboard entry made up of a neutral handle (never your email), your best score, your rank, your achievements and your bio.
• An email log: which emails we sent you, when, and whether they were delivered.
• Security data: single-use, expiring tokens for password reset and email verification, and records of account events such as sign-ins, kept on our own server.

We collect this data from you directly or generate it from your use of the service. We do not buy data about you from anyone else.

3. Your face photos

When you upload photos, we use the MediaPipe face-mesh model on our own server to place points on your face and measure proportions such as facial width-to-height, jaw and eye shape and side-profile angles. From those measurements we calculate your scores and advice.

• We do not use your photos or measurements to identify you or anyone else, and we do not match faces against other people.
• Only you can see your photos. They are stored on our server and served only to your signed-in account. We do not share or publish them.
• We do not use your photos to train models unless you switch on AI training opt-in (Profile → Privacy controls). It is off by default and you can switch it off at any time.
• Your photos are deleted when you delete the scan, or when your account is deleted (see section 7).

Photos of your face are personal and can reveal sensitive things about you, so we treat this processing with special care. When you create an account you give explicit consent to the processing of your photos for face analysis by ticking the required checkbox. You can withdraw that consent at any time by deleting your scans or your account.

4. Why we use your data and our lawful bases

To provide the service you asked for (contract)

• Creating and running your account and signing you in.
• Analysing the photos you upload and showing you your results, history and advice.
• Sending transactional emails: email verification, welcome, password reset and reset confirmation, analysis complete, subscription changes, data export ready, account deletion confirmation, support ticket confirmation and security notices. You always receive these while you have an account because the service needs them.
• Answering your support requests.

With your consent

• Weekly progress digest — only if you tick “Email me a weekly progress digest with my scan summary and trend.” Sent on Mondays.
• Monthly tips and product updates — only if you tick “Email me monthly tips and Kinetic Maxxer product updates.” Sent at most once a month.
• Using your photos to train models — only if you switch on the AI training option.
• Appearing on the public leaderboard and public profile — only if you switch on “Public profile” in Profile → Personal details. When it is on, other users can see a neutral handle (such as “Maxxer 3F9A2C1B”, derived from a random account identifier, never any part of your email address), your best score, your rank, your achievements and your bio. Your public profile link uses that same account identifier, never your email. It is off by default and you can switch it off at any time, which removes you from the leaderboard and public profile straight away.

Both email boxes are unticked by default and separate from each other. You can withdraw consent at any time (see section 9). Withdrawing does not affect processing that happened before.

For our legitimate interests

• Keeping the service and your account secure and preventing fraud and abuse.
• Fixing problems and improving the service using our own server records. We do not use third-party analytics or advertising tools.

To meet legal obligations

• Keeping records we are required to keep by law, such as company and tax records.

You need to give us an email address and a password to create an account, and photos to get an analysis. All other profile details are optional. We do not sell your data and we do not show you advertising.

5. Who we share your data with

We use two service providers (processors) who handle data only on our instructions:

• Contabo GmbH — hosts our server and database in Munich, Germany.
• Mailjet (Sinch Mailjet SAS) — delivers our emails from the EU. It receives your email address and the content of the emails we send you.

We do not share your photos with anyone, and we do not share your analysis results beyond what you choose to show through an opted-in public profile (see section 4). If you switch on “Public profile”, other users can see your neutral handle, best score, rank, achievements and bio — never your photos, email address or detailed subscores. We may disclose data if the law requires it, for example to comply with a court order.

6. International transfers

Your data is stored and processed in the European Economic Area (Germany and the EU). The UK has adequacy regulations for the EEA, so these transfers are allowed under UK GDPR without additional safeguards.

7. How long we keep your data

When you delete your account from your profile, it is scheduled for deletion straight away and purged 30 days later. The purge removes your account, your scans and your photo files. You can contact us before then if you change your mind.

8. Keeping your data safe

Data travels between your device and our server over encrypted connections (TLS). Your password is stored as a hash, never in plain text. Your photos are only served to your own signed-in account.

9. Your rights and how to use them

Under UK GDPR you have the right to:

• access your data and get a copy of it;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to how we use your data;
• receive your data in a portable format;
• withdraw consent at any time.

How to use them:

• Export your data: Profile → Privacy controls → Export my data (JSON).
• Correct your details: edit them in your profile.
• Delete a scan or your account: delete a scan from Progress → History, or your whole account from Profile → Delete my account.
• Stop emails: use the one-click unsubscribe link in any digest or update email, the email preferences page, or your profile settings.
• Anything else: email support@kineticmaxxer.com. We will reply within one month and may ask you to confirm your identity first.

10. Automated decisions

Your scores and advice are produced automatically from your photos. They are for entertainment and self-reflection only, and they are not a scientific calculation. We do not use them — or any other automated processing — to make decisions that have legal or similarly significant effects on you (UK GDPR Article 22). The score is calculated only from the positions of points on your face; we do not infer race, ethnicity or any other protected characteristic, and your optional gender and age range are not used to calculate it. See about your scores.

11. Children

Kinetic Maxxer is for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you think a child has created an account, contact us and we will delete it.

12. Cookies and similar technologies

We use only what is strictly necessary to keep you signed in and remember your preferences. There are no analytics or advertising cookies. See our cookie policy for the details.

13. Complaints

If you are unhappy with how we use your data, please contact us first at support@kineticmaxxer.com so we can try to put it right. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.

14. Changes to this notice

We will update this notice when our use of data changes and show the new date at the top. If a change affects you significantly, we will tell you by email or in the app before it takes effect.