Privacy Policy

1. Data Controller

The entity responsible for processing your personal data is:

• Company: byFer
• RUC: 0900000000001
• Address: Av. Principal 123, Guayaquil, Ecuador
• Email: [email protected]
• Phone: +593 99 000 0000

2. Data We Collect

We collect the following personal data when you use our Website:

• Full name
• Email address
• Phone number
• Shipping and billing address
• Payment information (bank transfer details, PayPhone data)
• Purchase and browsing history
• Cookies and analytics data (IP address, device info, browsing behavior)
• Conversation history with the artificial intelligence assistant
• Skin profile (skin type, concerns, and suggested routine), obtained through a photo analysis or a questionnaire
• Selfie photos submitted for skin analysis, which are processed to perform the analysis and deleted immediately afterwards (they are not stored)

In the future, we may collect your tax identification number (cédula or RUC) for tax compliance purposes as required by Ecuadorian law.

3. Purpose of Processing

We process your personal data for the following purposes:

• Processing and fulfilling your orders
• Shipping and delivery coordination
• Payment processing and verification
• Customer communication via email and WhatsApp
• Website analytics and performance improvement
• Marketing communications (only with your consent)
• Personalization of product recommendations and skincare routines through the artificial intelligence assistant

4. Legal Basis

We process your data based on the following legal grounds as established by Ecuador's LOPDP:

• Consent: For analytics cookies, marketing communications, and photo-based skin analysis.
• Contractual necessity: To fulfill your purchase orders.
• Legal obligation: To comply with tax and consumer protection laws.

5. Third Parties

We share your data with the following third-party services:

• Google Analytics: Website usage analytics (with your consent).
• Meta Pixel (Facebook/Instagram): Advertising analytics (with your consent).
• TikTok Pixel: Advertising analytics (with your consent).
• WhatsApp Business: Customer communication.
• Servientrega: Order shipping and delivery.
• OpenRouter (AI model provider that routes requests to providers such as Google): Processing of chat messages with the assistant and skin-analysis photos, solely to generate the requested responses and analyses.

6. Cookies and Tracking

We use the following types of cookies:

• Essential cookies: Required for the Website to function (cart, session, authentication). These cannot be disabled.
• Analytics cookies: Used to understand how visitors interact with the Website (Google Analytics). Loaded only with your consent.
• Marketing cookies: Used to deliver relevant advertisements (Meta Pixel, TikTok Pixel). Loaded only with your consent.

When you first visit our Website, a cookie banner will ask for your consent to load analytics and marketing cookies. You may accept or reject them. Your preference is stored for one year.

7. AI Assistant and Skin Profile

Our Website offers an AI-powered beauty assistant ("Fer") that helps you with product recommendations and skincare routines. Below we describe what data it processes and the control you have over it:

• Conversation history: The messages you exchange with the assistant are stored on our servers to keep the continuity of your conversations and provide context-aware responses.
• Skin profile: If you complete a skin analysis, we store a derived profile that includes your skin type, your main concerns, and the suggested routine, along with the source of the analysis (photo or questionnaire), the language, and the corresponding dates.
• Selfie photos: If you choose the photo-based analysis, the image is sent to a vision model solely to perform the analysis and is deleted immediately once completed. We never store your photos.
• AI provider: Chat messages and photos are processed through OpenRouter, an AI model provider that routes requests to providers such as Google, exclusively to generate your responses and analyses.
• Your control: You can review and delete your skin profile at any time from the "My skin profile" section of your account, and you can delete any conversation from the assistant panel itself.
• Consent: The photo-based analysis requires your express consent at the moment of capture. Using the assistant is completely optional.

The assistant's recommendations are for guidance only and do not constitute medical advice or a dermatological diagnosis.

8. Data Subject Rights

Under Ecuador's Organic Law on Personal Data Protection (LOPDP), you have the following rights:

• Access: Request information about the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Deletion: Request removal of your personal data when it is no longer necessary.
• Portability: Receive your data in a structured, machine-readable format.
• Objection: Object to the processing of your data for specific purposes.
• Restriction: Request limitation of data processing under certain conditions.
• For your skin profile and AI assistant conversations, you can exercise your right of access and deletion immediately and without submitting a request: from "My skin profile" in your account and from the assistant panel, respectively.

9. How to Exercise Your Rights

To exercise any of the rights listed above, please contact us at [email protected] with the subject line "Data Rights Request." We will respond to your request within 15 business days.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include encrypted connections (HTTPS), secure data storage, and restricted access controls.

11. Data Retention

We retain your personal data for the following periods:

• Account data: For as long as your account is active, plus 2 years after deletion.
• Order data: 7 years (as required by Ecuadorian tax law).
• Analytics data: 26 months.
• Cookie consent preference: 1 year.
• AI assistant conversation history: Until you delete the corresponding conversation or your account.
• Skin profile: Until you delete it from "My skin profile" or delete your account.

12. Minors

Our Website and services are not intended for individuals under 18 years of age. We do not knowingly collect personal data from minors. If we become aware that we have collected data from a minor, we will take steps to delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. We encourage you to review this policy periodically.

14. Contact

If you have any questions about this Privacy Policy or how we handle your data, please contact us:

• Email: [email protected]
• Phone: +593 99 000 0000
• WhatsApp: +593 99 000 0000
• Address: Av. Principal 123, Guayaquil, Ecuador