Effective date: April 14, 2026

Last reviewed: April 14, 2026

Your privacy matters to us. This policy tells you exactly what we collect, why we collect it, who we share it with, and what rights you have over your own data.

1. Who We Are and How to Contact Us

Ayuface is a brand of TekMaison LLC, a limited liability company registered in the Commonwealth of Virginia, with its principal place of business in Arlington, Virginia, United States.

TekMaison LLC is the data controller responsible for your personal information collected through ayuface.com (the "Site").

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:

Privacy inquiries: hello@ayuface.com

Mailing address: TekMaison LLC, Arlington, Virginia, United States

Website: ayuface.com

We aim to respond to all privacy-related inquiries within 30 days.

2. Scope of This Policy

This Privacy Policy applies to all personal information collected by Ayuface through:

• The ayuface.com website and all pages within it.

• The Skin Resilience Quiz hosted on the Site.

• Email communications and marketing.

• Purchase and order transactions.

• Customer support interactions.

• Social media pages operated by Ayuface.

This Policy does not apply to third-party websites linked from our Site. We encourage you to review the privacy policies of any third-party sites you visit.

3. Information We Collect

We collect personal information in the following categories:

3.1 Information You Provide Directly

Purchase and Account Information

When you place an order on the Site, we collect:

• Full name.

• Email address.

• Billing and shipping address.

• Phone number (if provided).

• Payment card information — collected and processed by Shopify Payments. We do not store full card numbers on our systems.

• Order history and transaction details.

Skin Resilience Quiz

When you complete our Skin Resilience Quiz, we collect your first name and email address at the conclusion of the quiz. Your quiz responses — which include information about your skin concerns, lifestyle context, and health background — are processed within the quiz platform to generate your personalized skin profile. Only your name and email address are passed to our systems via the quiz submission.

See Section 3.4 for specific information about how we handle health-related quiz responses.

Newsletter and Marketing Sign-Ups

When you subscribe to our newsletter or email communications, we collect your email address and, where provided, your first name.

Customer Support

When you contact us by email, we collect your name, email address, and any information you choose to include in your message, including order details or product concerns.

3.2 Information Collected Automatically

Website Usage Data

When you visit the Site, we automatically collect certain technical information through cookies and similar tracking technologies, including:

• IP address.

• Browser type and version.

• Device type and operating system.

• Pages visited, time spent on pages, and navigation path.

• Referring URL (the page you came from before visiting our Site).

• Date and time of visit.

Cookies and Tracking Technologies

We use cookies and similar technologies to operate the Site, understand how it is used, and deliver relevant advertising. See Section 8 for our full Cookie Policy.

3.3 Information from Third Parties

We may receive information about you from third-party sources, including:

• Shopify — our e-commerce platform, which provides order processing and customer data management.

• Meta (Facebook and Instagram) — if you interact with our social media pages or if we run targeted advertising campaigns, Meta may share audience data with us in anonymized or aggregated form.

• Google — if you interact with our Google advertising campaigns, Google may share conversion and audience data with us.

• Klaviyo — our email marketing platform, which tracks email open rates, click-through rates, and purchase activity linked to email campaigns.

3.4 Sensitive Health Information from the Quiz

The Skin Resilience Quiz asks questions that may involve health-related context, including whether you are pregnant, breastfeeding, taking prescription medication, managing diagnosed skin conditions such as rosacea, melasma, or cystic acne, or have specific ingredient sensitivities such as sesame allergy or nut allergy. Under the California Privacy Rights Act (CPRA) and certain other state laws, this information may constitute sensitive personal information.

We handle this data with a higher standard of care:

• Health-related responses are used solely to generate your personalized skin profile and to remove products from your recommendations that may not be appropriate for your situation — for example, removing the Nasal Oil if you have a sesame allergy.

• This data is never used for advertising targeting, audience profiling, or any commercial purpose beyond delivering your ritual results.

• This data is never shared with any third party for advertising or marketing purposes.

• Health-related quiz responses are retained for 2 years from the date of quiz completion, after which they are permanently deleted.

You may request deletion of your health-related quiz data at any time by contacting us at hello@ayuface.com. See Section 9 for your full privacy rights.

4. How We Use Your Information

We use the personal information we collect for the following purposes:

4.1 To Fulfill Your Order

• Process and confirm your purchase.

• Arrange delivery to your address.

• Send order confirmation, shipping confirmation, and delivery updates.

• Handle returns, refunds, and replacements.

Legal basis: Performance of a contract.

4.2 To Deliver Your Quiz Results

• Process your quiz submission to generate your personalized skin profile.

• Email your skin profile results and a 14-day ritual guidance sequence to the email address you provide.

Legal basis: Consent — you provide your name and email address voluntarily to receive your results. By submitting the quiz form, you consent to receiving your results and the associated guidance sequence. You can unsubscribe at any time.

4.3 To Send Marketing Communications

• Send our newsletter with information about products, skincare education, and brand updates.

• Send promotional offers, launch announcements, and event information.

Legal basis: Consent — you can unsubscribe at any time using the link in any email or by contacting hello@ayuface.com. We will not send marketing emails without your consent.

4.4 To Operate and Improve the Site

• Analyze website traffic and usage patterns using Google Analytics.

• Identify technical issues and improve site performance.

• Understand which products and content are most relevant to our visitors.

Legal basis: Legitimate interests — we have a legitimate interest in understanding how our Site is used in order to improve it.

4.5 To Run Advertising Campaigns

• Deliver targeted advertising on Meta platforms (Facebook and Instagram) and Google.

• Create custom and lookalike audiences for advertising purposes using anonymized or hashed data.

• Measure the effectiveness of our advertising campaigns.

Legal basis: Consent — you can opt out of targeted advertising at any time. See Section 9 for your rights and Section 8 for cookie management.

4.6 To Comply with Legal Obligations

• Maintain transaction records for tax and accounting purposes.

• Respond to lawful requests from regulatory authorities.

• Enforce our Terms & Conditions and other policies.

Legal basis: Legal obligation and legitimate interests.

4.7 To Provide Customer Support

• Respond to your inquiries, complaints, and return requests.

• Investigate and resolve issues with your order or product.

Legal basis: Performance of a contract and legitimate interests.

5. Automated Decision-Making and Profiling

Our Skin Resilience Quiz uses an automated scoring system to assign your skin profile. Your responses to the quiz questions are processed by a scoring algorithm that accumulates points across five biological categories — barrier stability, inflammation response, collagen demand, texture refinement, and high-performance optimization — and assigns you to one of five corresponding skin profiles.

This constitutes automated profiling within the meaning of applicable privacy laws including the Virginia Consumer Data Protection Act (VCDPA). We disclose this clearly:

• The profiling is used solely to personalize the skin ritual recommendations we deliver to you.

• The profiling has no legal or financial consequences for you.

• The profiling does not affect your eligibility to purchase any product — all products are available to all customers regardless of quiz outcome.

• You can opt out of this profiling by choosing not to complete the quiz. All Ayuface products remain available for direct purchase without completing the quiz.

Your assigned skin profile is retained for 2 years from the date of quiz completion and is not shared with any third party for advertising or profiling purposes.

6. How We Share Your Information

We do not sell your personal information. We share it only in the following circumstances:

6.1 Service Providers and Data Processors

We share your data with trusted third-party service providers who process data on our behalf and are contractually required to handle it securely and only for the purposes we specify:

• Shopify Inc. (Canada/USA) — e-commerce platform, order management, payment processing infrastructure, and customer data hosting. Shopify is incorporated in Ottawa, Canada, and operates data centers in multiple jurisdictions including Canada and the United States. Shopify's privacy policy governs their own data handling and is available at shopify.com/legal/privacy.

• Shopify Payments / Stripe — payment card processing. Card data is processed directly by Stripe and is not stored by Ayuface.

• Klaviyo Inc. (USA) — email marketing platform. We share your name and email address, and Klaviyo tracks engagement with our emails. Klaviyo's privacy policy is available at klaviyo.com/legal/privacy-notice.

• Tally (Belgium) — quiz platform. Collects your first name and email address at the conclusion of the quiz and passes this to us. Tally's privacy policy is available at tally.so/privacy.

• TekMaison LLC's fulfillment partner (USA) — your name and shipping address are shared with our warehouse partner solely for the purpose of packing and shipping your order.

• Meta Platforms Inc. (USA) — if you have consented to advertising cookies, we may share hashed email addresses or pixel-based data with Meta for advertising purposes. This data is used only for audience matching and campaign measurement.

• Google LLC (USA) — if you have consented to analytics and advertising cookies, Google Analytics and Google Ads receive usage and conversion data. This data is used only for analytics and advertising measurement.

If we introduce any new third-party integration or data processor in the future, we will update this Policy before that integration goes live.

6.2 Legal Disclosure

We may disclose your personal information if required to do so by law, court order, or regulatory authority, or if we believe in good faith that such disclosure is necessary to protect our rights, your safety, or the safety of others.

6.3 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of TekMaison LLC's assets, your personal information may be transferred to the acquiring entity. We will notify you before your data is transferred and becomes subject to a different privacy policy.

6.4 What We Never Do

• We never sell your personal information to data brokers or third-party advertisers.

• We never share your quiz health-related responses with any third party for any purpose other than delivering your ritual results.

• We never use quiz health data for advertising targeting or audience profiling.

• We never share your data with any party not listed in this Policy without your explicit consent.

The quiz consent screen states "No spam. No selling your data." This is an unconditional commitment. We honor it in full.

7. International Data Transfers

Ayuface is based in the United States. If you are visiting from Canada or another country, your personal information will be transferred to and processed in the United States, where data protection laws may differ from those in your country.

7.1 Canadian Residents

We collect, use, and disclose personal information from Canadian residents in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws. By using this Site and submitting personal information, you consent to the collection, use, and disclosure of your information as described in this Policy.

Canadian residents have the right to access their personal information held by us, to correct inaccuracies, and to withdraw consent for non-essential uses. To exercise these rights, contact us at hello@ayuface.com.

Where we transfer your data to the United States, we take steps to ensure it receives comparable protection, including through contractual data processing agreements with our service providers.

7.2 Other International Visitors

If you are accessing the Site from outside the United States or Canada, please be aware that your information will be transferred to, stored, and processed in the United States. By using the Site, you acknowledge and consent to this transfer.

8. Data Retention

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. Our specific retention periods are:

• Customer order and transaction data — 7 years from the date of purchase, in accordance with US federal and Virginia tax record-keeping requirements.

• Email subscriber data — for the duration of your subscription, plus 2 years following unsubscription, after which it is permanently deleted or anonymized.

• Skin Resilience Quiz data including health-related responses — 2 years from the date of quiz completion, after which it is permanently deleted.

• Customer support correspondence — 3 years from the resolution of the relevant inquiry.

• Website analytics data — 14 months, in line with Google Analytics recommended retention settings.

• Advertising audience data — subject to the retention policies of Meta and Google, typically 180 days for custom audiences.

When personal information is no longer required, we delete or anonymize it securely. We do not retain data in identifiable form beyond the periods above.

9. Cookies and Tracking Technologies

9.1 What Are Cookies

Cookies are small text files stored on your device when you visit a website. They allow the site to recognize your device on return visits and enable certain functionality. We also use similar technologies including pixels, web beacons, and local storage.

9.2 Categories of Cookies We Use

Strictly Necessary Cookies

These cookies are essential for the Site to function and cannot be switched off. They include cookies that enable your shopping cart, secure checkout, and basic site navigation. No consent is required for these cookies.

Analytics Cookies

We use Google Analytics to understand how visitors interact with our Site. These cookies collect information about pages visited, time spent on the Site, and how you arrived. This data is aggregated and anonymized. Google Analytics cookies are only set with your consent.

To opt out of Google Analytics tracking across all websites, you can install the Google Analytics Opt-out Browser Add-on at tools.google.com/dlpage/gaoptout.

Marketing and Advertising Cookies

We use Meta Pixel and Google Ads conversion tracking to measure the effectiveness of our advertising and to deliver targeted advertising on Meta and Google platforms. These cookies are only set with your consent.

If you consent to advertising cookies, your browsing behavior may be used to show you Ayuface advertisements on Facebook, Instagram, and Google. If you decline, you may still see Ayuface advertisements but they will not be personalized based on your behavior on our Site.

Functional Cookies

These cookies enable enhanced functionality such as remembering your preferences and language settings. They are set with your consent.

9.3 Managing Your Cookie Preferences

When you first visit the Site, you will be presented with a cookie consent banner where you can choose which categories of cookies to accept or decline. You can update your preferences at any time by clicking the "Manage Cookies" link in the footer of the Site.

You can also manage cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the Site, including the ability to add products to your cart or complete a purchase.

For more information about managing cookies, visit allaboutcookies.org.

9.4 Do Not Track

Some browsers transmit "Do Not Track" signals to websites. Because there is no industry standard for how to respond to these signals, our Site does not currently alter its data collection practices based on Do Not Track signals. You can manage your preferences through our cookie consent platform as described above.

10. Your Privacy Rights

Depending on where you are located, you may have the following rights regarding your personal information. We honor these rights for all customers regardless of location.

10.1 Rights Available to All Customers

• Right to access — you can request a copy of the personal information we hold about you.

• Right to correction — you can ask us to correct any inaccurate or incomplete personal information.

• Right to deletion — you can ask us to delete your personal information, subject to certain legal retention requirements.

• Right to withdraw consent — where we process your data based on consent (such as for marketing emails or advertising cookies), you can withdraw consent at any time. Upon withdrawal, we will stop processing your data for that purpose within 10 business days. Data already lawfully processed before withdrawal is not affected.

• Right to object — you can object to processing based on our legitimate interests.

10.2 Virginia Residents — VCDPA Rights

If you are a resident of Virginia, the Virginia Consumer Data Protection Act (VCDPA) provides you with the following additional rights:

• Right to opt out of the sale of personal data — we do not sell your personal data. If this changes, we will update this Policy and provide a clear opt-out mechanism.

• Right to opt out of targeted advertising — you can opt out of the use of your personal data for targeted advertising by declining advertising cookies in our cookie consent platform or by contacting us at hello@ayuface.com.

• Right to opt out of profiling — you can opt out of the automated skin profiling conducted through our quiz by choosing not to complete the quiz. All products remain available for direct purchase.

• Right to data portability — you can request your personal data in a portable, machine-readable format.

To submit a VCDPA rights request, contact us at hello@ayuface.com with the subject line "VCDPA Privacy Request." We will respond within 45 days. We may extend this period by an additional 45 days with prior notice. We will not discriminate against you for exercising your rights.

If we decline to act on your request, you may appeal by emailing hello@ayuface.com with the subject line "VCDPA Appeal." We will respond to appeals within 60 days. If your appeal is denied, you may contact the Virginia Attorney General's Office at ago.virginia.gov.

10.3 California Residents — CPRA Rights

If you are a resident of California, the California Privacy Rights Act (CPRA) provides you with the following rights in addition to those listed above:

• Right to know — you have the right to know what personal information we collect, use, disclose, and sell about you.

• Right to delete — you have the right to request deletion of personal information we have collected, subject to certain exceptions.

• Right to correct — you have the right to request correction of inaccurate personal information.

• Right to opt out of sale or sharing — we do not sell your personal information. We do share certain data with Meta and Google for advertising purposes. You can opt out of this sharing by declining advertising cookies in our cookie consent platform.

• Right to limit use of sensitive personal information — your quiz health-related responses constitute sensitive personal information under the CPRA. We limit our use of this data to delivering your skin profile and ritual recommendations only. We do not use it for advertising, profiling, or any secondary purpose.

• Right to non-discrimination — we will not discriminate against you for exercising any of your CPRA rights.

To submit a California privacy rights request, please contact us at hello@ayuface.com with the subject line "California Privacy Request." We will respond within 45 days, extendable by an additional 45 days with prior notice.

California residents may also designate an authorized agent to make requests on their behalf. We may require verification of the agent's authority before processing such requests. To verify your identity for a California request, we will confirm the email address associated with your account or order. For sensitive requests, we may ask for your order number as additional verification.

10.4 Canadian Residents — PIPEDA Rights

If you are a resident of Canada, you have the right under PIPEDA to:

• Access the personal information we hold about you.

• Challenge the accuracy and completeness of your personal information and have it corrected where appropriate.

• Withdraw consent to the collection, use, or disclosure of your personal information at any time, subject to legal and contractual restrictions.

• File a complaint with the Office of the Privacy Commissioner of Canada if you believe we have not complied with PIPEDA.

To exercise your PIPEDA rights, contact us at hello@ayuface.com. We will respond within 30 days.

10.5 How to Submit a Privacy Request

To exercise any of the rights described in this section, please contact us at hello@ayuface.com with:

• Your full name and email address associated with your account or purchase.

• The specific right you wish to exercise.

• Any additional information relevant to your request.

To verify your identity, we will confirm the email address associated with your account or order. For sensitive requests, we may additionally ask for your order number. We will not charge a fee for reasonable requests and will not discriminate against you for exercising your rights.

11. Targeted Advertising and Opt-Out

We use Meta Pixel and Google Ads to run targeted advertising campaigns. These tools may use information about your visits to our Site — such as pages viewed and products considered — to show you Ayuface advertisements on other platforms.

You have the following options to limit targeted advertising:

• Decline advertising cookies when prompted by our cookie consent banner.

• Update your cookie preferences at any time via the "Manage Cookies" link in the Site footer.

• Opt out of Meta advertising personalization at facebook.com/ads/preferences.

• Opt out of Google advertising personalization at adssettings.google.com.

• Use the Digital Advertising Alliance's opt-out tool at optout.aboutads.info.

• Use the Network Advertising Initiative opt-out tool at optout.networkadvertising.org.

Please note that opting out of targeted advertising does not mean you will stop seeing Ayuface advertisements — it means the advertisements you see will not be personalized based on your browsing behavior on our Site.

12. Email Marketing and Communications

We use Klaviyo to manage our email communications. When you subscribe to our newsletter, complete the Skin Resilience Quiz, or make a purchase, you may receive emails from us.

12.1 Types of Emails We Send

• Transactional emails — order confirmations, shipping notifications, and return confirmations. These are sent as part of your purchase and are required to fulfill our contract with you. They cannot be opted out of while an order is active.

• Quiz result emails — your personalized skin profile and a 14-day ritual guidance sequence delivering morning and evening protocols, biological context, and phase progression guidance. This sequence may reference Ayuface products relevant to your profile. You can unsubscribe from this sequence at any time.

• Marketing emails — our newsletter, product launches, promotions, and educational content. These are sent only with your consent.

12.2 CAN-SPAM and CASL Compliance

All commercial emails we send comply with the CAN-SPAM Act (United States) and the Canadian Anti-Spam Legislation (CASL). Specifically:

• Every commercial email clearly identifies Ayuface as the sender.

• Every commercial email includes a clear and functional unsubscribe mechanism.

• Every commercial email includes the valid physical mailing address of TekMaison LLC, Arlington, Virginia, United States.

• We honor unsubscribe requests within 10 business days.

• For Canadian recipients, we send commercial emails only where we have obtained express consent as required by CASL. Completing the quiz and submitting your email address constitutes express consent to receive your ritual results and associated guidance sequence. Newsletter sign-up constitutes express consent to receive marketing communications.

• We do not send commercial electronic messages to Canadian recipients without express consent, and we maintain consent records as required by CASL.

12.3 Unsubscribing

You can unsubscribe from marketing emails at any time by clicking the "Unsubscribe" link at the bottom of any marketing email, or by contacting us at hello@ayuface.com. Upon receiving your unsubscribe request, we will stop sending marketing emails within 10 business days.

Unsubscribing from marketing emails will not affect transactional emails related to active orders. Unsubscribing from quiz result emails will not affect order-related transactional emails.

Klaviyo may retain your email address on a suppression list after unsubscription to ensure we do not contact you again. This is a standard email compliance practice and does not constitute use of your data for any other purpose.

12.4 Email Tracking

Our marketing emails contain tracking pixels that allow Klaviyo to record whether you have opened an email and whether you have clicked any links. This data is used to measure the effectiveness of our communications and to personalize future emails. If you prefer not to be tracked in this way, you can disable image loading in your email client, which will prevent tracking pixels from firing.

13. Data Security

We take the security of your personal information seriously and implement appropriate technical and organizational measures to protect it against unauthorized access, disclosure, alteration, or destruction.

Our security measures include:

• SSL/TLS encryption for all data transmitted between your browser and our Site.

• Shopify's PCI-DSS compliant payment processing infrastructure.

• Access controls limiting employee and contractor access to personal data on a need-to-know basis.

• Contractual data processing agreements with all third-party service providers requiring them to maintain appropriate security standards.

• Regular review of our data handling practices and third-party processor security standards.

No method of transmission over the internet or method of electronic storage is completely secure. While we strive to protect your personal information, we cannot guarantee absolute security. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify affected individuals and relevant authorities as required by applicable law.

14. Children's Privacy

Our Site is not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe that your child has provided us with personal information, please contact us immediately at hello@ayuface.com and we will take steps to delete that information from our systems.

In compliance with the Children's Online Privacy Protection Act (COPPA), we do not knowingly collect, use, or disclose personal information from children under the age of 13 without verifiable parental consent. If we learn that we have collected personal information from a child under 13, we will delete it promptly.

15. Third-Party Links and Services

Our Site may contain links to third-party websites, including our social media pages on Instagram. This Privacy Policy does not apply to third-party websites. We are not responsible for the privacy practices of any website we link to and encourage you to read the privacy policy of any site you visit.

When you interact with our social media pages on Instagram or other platforms, those platforms may collect data about your interaction in accordance with their own privacy policies. We are not responsible for data collected by social media platforms.

In the future, we may integrate additional third-party tools such as a customer support helpdesk. We will update this Policy before any new integration goes live to reflect the new data processing activity.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons, including the addition of new third-party integrations or data processors. When we make material changes, we will:

• Update the effective date at the top of this page.

• Post a notice on the Site informing you of the change.

• Where required by law, notify you directly by email.

• Update this Policy before activating any new data processor or third-party integration.

Your continued use of the Site after a change becomes effective constitutes your acceptance of the updated Policy. We encourage you to review this Policy periodically. Prior versions of this Policy are available upon request by contacting hello@ayuface.com.

17. Contact and Complaints

If you have any questions, concerns, or complaints about this Privacy Policy or our data handling practices, please contact us:

Ayuface — Privacy Inquiries

TekMaison LLC

Arlington, Virginia, United States

hello@ayuface.com

ayuface.com

We will acknowledge your inquiry within 5 business days and aim to resolve it within 30 days.

Regulatory Complaints

If you are not satisfied with our response to a privacy concern, you have the right to lodge a complaint with the relevant supervisory authority at any time, including while a privacy request is pending:

• United States (Virginia) — Virginia Attorney General's Office, Consumer Protection Section: ago.virginia.gov

• United States (California) — California Privacy Protection Agency: cppa.ca.gov

• Canada — Office of the Privacy Commissioner of Canada: priv.gc.ca