Kuzi
Anasayfa
  • Effective date: 29 June 2026
  • Data controller: Alonzo Digital Ltd (England & Wales)

This policy explains what information we collect about you when you use the Kuzi mobile app, why we collect it, and how we protect it. Things like your skincare routine, your products and your photos are personal and they belong to you. That's why we've written this as a clear, plain and two-way document.

Who we are

Kuzi is provided by Alonzo Digital Ltd. We operate as a limited company registered in England & Wales. When this document says "we", "Kuzi" or "Alonzo Digital", we mean the same legal entity.

  • Trading name: Alonzo Digital Ltd
  • Place of registration: England & Wales
  • Registered address: Unit 501 Leroy House, 434-436 Essex Road, London, United Kingdom, N1 3FY
  • Contact: [email protected]

Under the UK GDPR and the Data Protection Act 2018, the data controller is Alonzo Digital Ltd.

Information we collect

Kuzi collects the following information so it can speak with you better.

What you provide

  • Account information — if you signed in with Apple or Google, the name provided by that provider. We use it to recognise your account and for important service notices. Kuzi does not collect your email address and does not send marketing emails.
  • Profile preferences — the name, profile photo, skin type, interests and goals you share in the app.
  • Products and routines — the skincare and beauty products you add to Kuzi, how often you use them, their opened and expiry dates, and their morning-evening order.
  • Skin diary — the face photos you take, the notes you add to a photo, and the self-assessment scores you give.
  • Mood and completion records — your daily mood selections and your routine completion marks.
  • Period and cycle data (special category health data) — when you turn on the Calendar feature: your period start and end dates, your cycle and period length, the flow (bleeding) intensity you mark on period days, the symptoms you select (for example cramps, bloating, skin changes) and your daily log notes. This is special category health data; it is collected only with your explicit consent and only to give you a calendar, predictions and cycle-skin insights. If you never open the Calendar, this data is not collected. See the Period and cycle data section below for details.

What is collected as you use the app

  • Device and usage data — device model, operating system version, language, app version, crash and technical error logs, pseudonymous user and event identifiers (assigned to you but not containing your real identity), screen views and in-app interaction events (such as adding a product, completing a routine, viewing the paywall). If you have enabled notifications, your device's push notification token.
  • Notification preferences — which reminders you turn on or off.
  • Location (optional) — only if you give permission, your device's approximate location for weather and UV forecasts. There is no continuous tracking; you can turn it off from your system settings at any time.

What we do not collect

  • We do not collect identifiers for advertising trackers or third-party ad networks.
  • We do not sell your personal data for advertising.

Why we process your data

Under the UK GDPR we need a lawful basis for every processing activity. Kuzi's main purposes and their bases are:

  • Performance of a contract (Art. 6(1)(b)): Creating your account and providing the app to you; running core functions such as routines, reminders and usage tracking; storing your photos and diary entries in your account.
  • Legitimate interests (Art. 6(1)(f)): Detecting faults, monitoring the app for security, and improving the product with anonymous usage statistics. You can object to this processing at any time.
  • Consent (Art. 6(1)(a)): Providing location-based weather and UV suggestions, and sending push notifications. You can withdraw these consents at any time from the app settings or by writing to [email protected].
  • Explicit consent for special category data (Art. 9(2)(a)): Because your period and cycle data counts as health data, we process it only on the basis of your explicit consent — when you open the Calendar feature and give your approval. You can withdraw this consent at any time, delete your Calendar data from within the app, or write to [email protected]; withdrawing your consent does not affect processing carried out before that point.
  • Legal obligation (Art. 6(1)(c)): Responding to tax and fraud-prevention requirements or to requests from competent authorities.

Who we share your data with

We work with a small number of infrastructure providers to run Kuzi. These providers act as data processors; they process data only on our behalf, under contract, and for the purposes written here.

Account, content and file storage

  • Google LLC — Firebase Authentication, Cloud Firestore, Cloud Storage: Our authentication, database and file storage infrastructure. Your account, profile, product, routine, mood and skin diary records are held on Google Cloud servers. Your skin diary photos and their thumbnails are uploaded to Google Cloud Storage (Firebase Storage). The reason we use this infrastructure: to offer fast and secure synchronisation through a mature, audited cloud provider instead of running our own servers.
  • Apple Inc. — "Sign in with Apple": When you use the Apple sign-in option. Apple passes us a temporary token to verify your identity; if you prefer, you can hide your email address through Apple.
  • Google LLC — "Sign in with Google": When you use the Google sign-in option. Google passes us a token to verify your identity.

Notification delivery

  • OneSignal (OneSignal Inc., USA): Our push notification delivery infrastructure. Your device push token, which notification categories you have enabled, and behavioural segment tags (for example "has an expiring product", "last routine day") are sent to OneSignal. The reason we use it: to track notification delivery and opens from a single tool. Your email address is not sent to OneSignal.
  • Apple Inc. (Apple Push Notification service) and Google LLC (Firebase Cloud Messaging): The platform services that deliver push notifications to your device. Notification content passes through their servers but is not stored on our behalf.

Product analytics and performance

  • Mixpanel (Mixpanel, Inc., USA): The product analytics provider we use to understand how each feature of the app is used. A pseudonymous user identifier assigned to you, device type, in-session events (such as screen views, adding a product, completing a routine, viewing the paywall) and profile properties (skin type, age range, subscription status) are sent to Mixpanel. Your email address is not sent to Mixpanel. The reason we use it: to understand where you get stuck and improve the app; we do not use it for ad targeting.
  • Google LLC — Firebase Analytics: We also write events to Firebase Analytics so they share the same taxonomy as our App Store and Google Play reports. Personally identifying properties such as email or name are not sent to Firebase.
  • Google LLC — Firebase Crashlytics: Crash stack traces, device model, OS version, app version and an anonymous user identifier are sent to Crashlytics to monitor stability. The reason we use it: to detect crashes and fix them quickly. Crash reports do not contain your content data (photos, moods, products and so on).

Subscriptions and purchases

  • RevenueCat (RevenueCat, Inc., USA): Used to verify and record the status of in-app subscriptions (Apple App Store / Google Play). A pseudonymous app user ID, subscription plan identifier, and purchase and renewal events are sent to RevenueCat. The reason we use it: to track subscriptions across both platforms from a single source of truth. Payment is taken by Apple or Google; your card details never reach Kuzi or RevenueCat.

Location-based weather

  • OpenWeather Ltd (United Kingdom): When you turn on the location-based weather feature, we send your approximate location coordinates to them for that single weather query only. Location is not stored or tracked on our side.

Other than the list above, we do not share your data with third parties for advertising, marketing or similar purposes.

Artificial intelligence and automatically generated content

Some of the comments and suggestions Kuzi shows you are produced by algorithmic / AI-assisted systems. The main ones are: daily motivation lines, routine comments based on weather context, product reminder cards (expiring / forgotten product), skin diary comparison comments and improvement insights, and routine consistency summaries.

  • How your data is used: As of today these comments are produced on your device or on Kuzi's own servers. Your skin diary photos, self-assessment scores and mood records are not sent to an external AI provider; they are stored on Kuzi servers only to provide the service to you (see Who we share your data with).
  • This may change in future: If we later integrate a third-party provider (for example OpenAI, Google Gemini or a similar model) to extend our AI features, we will update this document and state clearly here which data is processed and which provider it is shared with. If any processing requires your approval, we will also ask you inside the app.
  • There is no guarantee of accuracy. AI can make mistakes; the comments shown may be wrong, incomplete or misleading. There is no dermatologist or medical expert on the Kuzi team. This content is not medical advice; it is general guidance. For skin problems, allergic reactions, product interactions, or pregnancy and breastfeeding, we recommend consulting a professional. For details, see the "AI-assisted content" section of the Terms of Service.
  • Profiling and automated decisions: Kuzi does not make solely automated decisions about you that produce legal or similarly significant effects (within the meaning of Art. 22 UK GDPR). Comments are shown only inside the app.

Period and cycle data (special category health data)

Kuzi's Calendar feature helps you track your period and cycle. Using this feature is entirely your choice, and it works like this:

  • Explicit consent is required. Period/cycle data is special category health data, so when you first open the Calendar we ask for your explicit consent. If you do not approve, this data is not collected; you can keep using the rest of the app.
  • Only to serve you. The period dates, flow intensity, symptoms and notes we collect are used only to give you a calendar, period predictions, cycle status and (if you are premium) insights about how your cycle affects your skin.
  • Not shared with third parties. We do not send period, cycle, symptom or any health information derived from them to any analytics, advertising or marketing provider — including Mixpanel, Firebase Analytics, OneSignal and Meta. This data is stored only in the cloud infrastructure we use to give you synchronisation (Google Firebase — see Who we share your data with), linked to your account.
  • Not sent to external AI. Cycle-skin insights are calculated on your device or on Kuzi's own servers; your period/cycle data is not sent to an external AI provider.
  • Not for medical or contraceptive use. Kuzi's period predictions are statistical estimates; they cannot be used for contraception, pregnancy planning or medical decisions. Kuzi does not offer fertility or ovulation tracking.
  • You are in control. You can edit or delete your period records from within the app and withdraw your consent; if you delete your account, this data is also deleted within the period set out in How long we keep your data.

International data transfers

Kuzi's cloud infrastructure may process data outside the United Kingdom, in regions chosen by our infrastructure provider — primarily the European Economic Area and the United States. Under the UK GDPR, these transfers are either:

  • held in countries covered by an adequacy decision from the ICO, or
  • protected by the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses (SCCs).

How long we keep your data

  • Active account: We keep your data for as long as you continue to use Kuzi.
  • When your account is deleted: We delete your account and the personal data belonging to you within a reasonable time after your request, and no later than 30 days. Clean-up from backups is completed within this period.
  • Data we must keep longer by law: Kept for the legally required period, then deleted or anonymised.

You can delete your account from within the app, or ask us to delete it by writing to [email protected].

Your rights

The UK GDPR and the Data Protection Act 2018 give you the following rights:

  • Access — to find out what data of yours we process.
  • Rectification — to have inaccurate or incomplete data corrected.
  • Erasure — to ask for your data to be deleted, under the "right to be forgotten".
  • Restriction of processing — to ask us to stop processing in certain circumstances.
  • Data portability — to receive your data in a machine-readable format.
  • Objection — to object to processing based on legitimate interests.
  • Withdrawal of consent — to turn off consent-based processing such as location or notifications at any time.
  • Complaint — to complain to the UK data protection authority, the Information Commissioner's Office (ICO, ico.org.uk).

To exercise these rights you can write to [email protected]. We normally respond within 30 days.

Children

Kuzi is not designed for children under 16. If an account has been opened for someone we know to be under 16, we will close the account and delete the data. If you believe your child is using Kuzi, please let us know at [email protected].

Security

We protect your data with server-side encryption on Kuzi servers and secure communication channels (HTTPS). No system is one hundred percent secure, but we take reasonable security measures seriously.

Changes to this policy

We may update this policy from time to time. When there is a significant change, we will tell you inside the app. The version in force is always available on this page.

Contact

  • Data protection requests: [email protected]
  • General contact: [email protected]
  • Post: Alonzo Digital Ltd, Unit 501 Leroy House, 434-436 Essex Road, London, United Kingdom, N1 3FY