Privacy
Effective October 4, 2026
Kiki is an AI-powered personal styling and beauty app operated by Emma Paunil-Mattison, doing business as "Ask Kiki," a sole proprietorship based in Arizona, United States. Contact: hello@askkiki.io.
No other Kiki customer or user account can see your data through the app's normal functions. Access inside Kiki is isolated per-account by row-level security enforced in our database. This section describes access through the app's own features; it does not describe access by Kiki's authorized personnel (currently: the founder only) or by our infrastructure provider, Base44, both of which are addressed in Sections 5 and 6.
Person-photos (reference photos, challenge/progress photos) and closet/vanity (product) photos are served through time-limited access links rather than permanent public links. Generating that link requires you to be authenticated as the account owner, but once a link is generated, anyone who obtained the exact link could retrieve the image until it expires (typically about one hour) — the link itself does not re-check who is holding it. In practice, the link is only ever generated for you and displayed to you within the app, not shared elsewhere.
Photos and profile data are processed by our application platform (Base44) and the AI models that power photo analysis and image generation, in order to generate your results.
Kiki's own promise: we do not use your photos or chat messages for Kiki's own marketing, and we do not use them to train any model Kiki itself develops or controls, without your separate, explicit opt-in consent.
A separate, important disclosure about our infrastructure provider: our application is built on Base44, a third-party platform that hosts our database, file storage, and the AI integrations Kiki's features rely on. Base44's standard terms, which apply to our current plan, permit data stored in our workspace — including photos, chat messages, and derived profile data — to be used by Base44 to help train or improve their own AI models, unless an account carries a specific, separately-contracted exclusion from that use. Our current plan does not carry that exclusion. Routing AI calls through a separate API key would not change this, because the data continues to reside in our platform workspace regardless of which model performs the inference. We disclose this plainly rather than promise protection we do not yet have, and will update this section if that changes.
Who processes your data, specifically: Base44 (our application platform, hosting our database, file storage, and the AI integrations described above); the AI models invoked through Base44's AI integration to analyze photos and generate Looks and chat responses; and Wix Payments (our payment processor). We do not currently use any advertising, analytics-for-advertising, or data-broker service beyond Base44's own built-in, platform-level usage analytics. We do not sell your personal data — this reflects what we have built and integrated today, not a promise about every service we might add in the future, and we will update this section if that changes.
Your data is stored on Base44's infrastructure. All photos you upload — reference, challenge/progress, and closet/vanity — are stored privately and served through the time-limited links described in Section 4.
A note on photos uploaded before this protection was fully in place: the underlying bytes of any photo that was ever stored at a public link before being moved to private storage remain reachable at their old link even after our records were updated, because our platform has no mechanism to delete the old file — only to stop the app from pointing to it. We have audited our generated Looks specifically and confirmed none are on public links.
Kiki is currently offered only to users located in the United States. If that changes, this policy will be updated before expansion, since serving other regions (the EU in particular) would introduce additional legal obligations not addressed here.
What account deletion does today, and its limits: when you delete your account, we first cancel any active paid subscription with Wix Payments so that future renewal charges stop. Deleting your account is different from simply turning off auto-renewal (see our Terms of Service, Section 4) — turning off auto-renewal keeps your access through the period you already paid for, while deleting your account ends access and begins the deletion process described here. Account deletion does not reverse or refund a charge that has already been initiated before the deletion request.
After subscription cancellation, we remove the records in our active database associated with your account — your profile, Looks, closet and routine records, credit and entitlement records, referral history, and link-click history. This does not include: Wix Payments' own transaction records (Wix, not Kiki, is the system of record for your actual billing history); records we are required to retain for legitimate accounting, tax, fraud-prevention, or legal-compliance purposes, for the period those obligations require; and backups, which follow our platform provider's own backup schedule.
Underlying files and AI conversation memory: removing a database record that points to a photo or generated Look does not delete the underlying image file — our platform has no file-deletion capability today, for us or for any app built on it, so those bytes persist in storage after account deletion, inaccessible through the app but not erased. The same is true of Kiki's saved conversation memory of you: the visible chat record is deleted, but the underlying AI assistant's memory layer has no way to delete a single user's memory — only an all-user, nothing-left "delete all knowledge" action exists at the platform level, which is not something we can do for one person without affecting everyone. Deleting references to a photo in our database does not make the photo itself anonymized or unrecoverable. We disclose this as a real, current platform limitation, and we're raising it with our provider as a product gap rather than treating it as settled.
Database backups are retained for 7 days on our current plan. Per our platform provider's backup documentation, backups capture application records only — the contents of uploaded photo and Look files are not part of a backup, only the record that points to them — and end-user account records are stored and backed up separately from that application data, so a backup restore does not add, remove, or change them.
Deleting your account's records, as described above, is confirmed and tested. Full erasure of underlying files and AI memory is not currently possible on our platform.
Where this applies today: state privacy laws like the California Consumer Privacy Act (CCPA) generally apply to businesses that meet certain size or data-volume thresholds — for example, over $26,625,000 in annual revenue, or buying, selling, or sharing the personal information of 100,000 or more consumers or households in a year. Based on Kiki's current size — a pre-revenue, early-stage product with no meaningful user base yet — we don't believe Kiki currently meets those thresholds, so these laws likely don't yet legally apply to us. We extend the rights below to everyone who uses Kiki regardless of where you live or whether a specific law applies, and we'll revisit this assessment, and update this section, as Kiki grows.
Your rights, extended to all users: you can ask us (a) what personal data we have about you, (b) to correct inaccurate data, or (c) to delete your account and associated data as described in Section 8. To make a request, email hello@askkiki.io from the email address on your account — we use that match to verify it's really you; if you reach out from a different address, we may ask for more information to confirm your identity before acting. We aim to respond within 30 days. Where we can't fully complete a request — for example, because certain data must be retained for the legal, accounting, or fraud-prevention reasons described in Section 8, or because of the storage limitations described there — we'll tell you specifically what we can and can't do.
A note on the photo-derived data described in Section 2: Kiki's AI analyzes your photos to produce general stylist-assessment categories (skin tone, undertone, face shape, hair texture, color season) — not a facial geometry template or faceprint used to identify or authenticate you. Based on that, we don't believe this data is the kind of "biometric identifier" regulated under laws like Illinois' BIPA, Texas's CUBI, or Washington's My Health My Data Act, which generally target identification-oriented biometric scans or health-status data rather than general appearance or styling categorization. This is our good-faith reading, not a guarantee, and we'll revisit it, including with legal counsel, before any feature that would change how this data is used.
Kiki is not intended for anyone under 18. We check the birthdate you provide at signup and will not create an account if it indicates you're under 18. If we otherwise learn — including because an account was created through a method that doesn't run that check — that an account belongs to someone under 18, we will promptly review that account and take steps to close it and delete the associated data. If we learn an account belongs to a child under 13 specifically, we treat that as triggering our obligations under the Children's Online Privacy Protection Act (COPPA) and will delete that account's data on an expedited basis rather than through our standard account-deletion process.
If we make a material change to this policy — one that meaningfully affects how we collect, use, or share your data — we'll notify you by email or in-app notice at least 14 days before it takes effect. We'll also update the effective date at the top of this page. Non-material changes (like clarifications) may take effect immediately upon posting. Continuing to use Kiki after a material change takes effect means you accept the updated policy.
hello@askkiki.io