Privacy policy

Who we are

CEVO (cevolab.com and app.cevolab.com) is run by Fideo LLC, a Wyoming limited liability company. It decides how your data is used, which makes it the controller under the GDPR and UK GDPR, and the business under US state privacy laws.

Controller

Fideo LLC, a Wyoming limited liability company, 1309 Coffeen Avenue STE 1200, Sheridan, WY 82801, USA

Privacy contact

Privacy Team · privacy@cevolab.com (general questions: info@cevolab.com)

EU and UK

CEVO is operated from the United States by Fideo LLC and has not appointed a representative in the EU or the UK. You can contact us directly at privacy@cevolab.com.

What we collect

Everything below comes from you, from Apple or Google when you choose to sign in with them (your verified email address, an Apple sign-in ID if you use Apple and, from Google, your name if present), or is worked out by CEVO from what you give us. We buy no data about you from anyone.

Sensitive data

Several of these are special or sensitive under the law: your face geometry (biometric data), your ancestry (racial or ethnic origin) and your body fat (health data). We collect each only with your explicit consent and use it only to provide the analysis you asked for. For how face geometry is handled, see the biometric notice. For Washington and Nevada residents, see the consumer health data policies for Washington and Nevada.

Why we use it

Each use has a legal basis. For people in the EU and UK, these are the bases under GDPR Article 6, and for sensitive data also Article 9.

Your photos are used only to make your report and the renders you bought, and, if you opted in, to improve CEVO's measurements. We will not use them for anything else without asking you again.

If you do not give the photo and face-geometry consent, we cannot make a report. Every other optional item can be left out, and the report still works.

Your separate consents

We ask for each consent on its own, with its own unticked box, so you can say yes to one and no to another. We show the exact wording next to each box when you give it and keep a copy with your consent record; ask privacy@cevolab.com for a copy at any time.

1. Photos and face geometry (required for the analysis): measuring your proportions from your photos and, for a $59 or $119 report, sending your photos to fal.ai to make your renders. A CEVO team member checks your report and renders before you see them.
2. Report writing (required for the analysis): sending your measurements and the questionnaire answers you allow, never your photos, to Anthropic, the service that writes the report text.
3. Ancestry (optional): using your answer to choose reference norms.
4. Body fat (optional): using your estimate only to estimate the soft tissue over your facial bones for your analysis.
5. Improving CEVO (optional, off by default): using the photos you upload for a paid report, and their measurements, to test and train CEVO's own measurement models. CEVO never sees free-scan photos, so they are never used.
6. Emails (optional, off by default): product news and offers, sent only to an address Google has verified or that you have confirmed.
7. Advertising cookies (optional; outside the United States, asked in the cookie banner; in the United States, on until you switch it off in Cookie settings): letting Google Ads measure our ads, as set out under cookies and ads. Accepting also turns on visit records (see visit measurement).

You can withdraw any consent at any time by emailing privacy@cevolab.com from the address you signed in with. It stops that use from then on and does not undo what was done before. Withdrawing the photo and face-geometry consent deletes your photos, landmarks, measurements, report and renders within 30 days, so download your report first if you want to keep it.

What we never do

• We never use your photos or face geometry to identify you, recognise you or match you against other people. We compare faces only to check that your renders still show you, using a similarity score computed in memory; that score is never stored and never used to identify you.
• We never infer your ancestry, race, sex or emotions from your face. Those answers come only from you.
• We never sell, rent or trade your personal data, and never take payment for it.
• We never share photos, face geometry, measurements, answers, ancestry, body fat or report links with advertising platforms. No ad pixel or ad tag runs on any CEVO page.
• We never use your photos or measurements to train AI models, ours or anyone else's, unless you tick the separate "Improving CEVO" box. Our providers are not allowed to train on them either.
• We never pass your data to clinics, surgeons or telehealth services. The surgeon PDF in the $119 tier is a file you download; only you decide whether to share it.
• We never review your photos or renders in chat apps. Review happens only inside CEVO's own tool.
• The scan itself (your photo, the landmark points and the measurements) sends nothing to any third party. The face-landmark library's built-in usage reporting is switched off and blocked by the page's security policy, so nothing from your scan reaches Google.

How the analysis works

The scanner finds 478 landmark points on your face, such as the corners of the eyes and the edge of the jaw. CEVO calculates distances, ratios and angles between those points, then places each one against published reference ranges for the baseline you chose, and shows, feature by feature, how they balance against those ranges (the facial balance breakdown, in every tier), never as one overall score. The report text is written from those numbers.

The free scan uses one front photo and shows three measurements, calculated in your browser: facial width-to-height ratio (FWHR), canthal tilt (an estimate, about ±1.5°), and the middle-to-lower face ratio. If you take the photo on your phone with Continue on your phone, your computer measures it again itself once it arrives; no measurement is sent between your devices. The gonial angle and the other side-profile measurements come from a 90° side photo, taken after you buy a $59 or $119 report. The $29 report uses the front photo only.

In the $59 and $119 reports, CEVO's software also estimates the age your face appears in the photo, shown as the Biological Facial Age Index (EU AI Act Art. 50(3)).

Every $59 and $119 report includes generated images made from your photo: a Layer 1 grooming simulation, with your bone structure kept as it is, and 3 ($59, or 10 with the $19 hairstyle pack) or 10 ($119) hairstyle renders. Layer 2, in the $119 tier or with the $39 add-on, is a structural illustration made by moving the pixels of your own photo, with nothing redrawn, and a Vector Shift Map that gives, in millimetres, how far each point moves in the simulation. Each image is labelled "Generated simulation, not a photo or a prediction" and carries IPTC metadata marking it as generated. A CEVO team member approves each set in CEVO's own tool before you see it, and the images follow your report in a second email.

Optical Lens Normalization (24mm to 85mm) estimates the camera distance from the size of your iris and the photo's lens data. It does not change your photo. If the photo was taken too close, we warn you or ask you to retake it.

Automated decisions

The report is produced by automated measurement. Working out your measurements, facial balance breakdown and, in the $59 and $119 reports, the Biological Facial Age Index evaluates aspects of your appearance, which can count as profiling under the GDPR. It does not make any decision about you with legal or similarly significant effects: nobody is refused a service, priced differently or assessed for anything because of it (GDPR Art. 22 and UK GDPR Arts 22A–22D). We do not use it for profiling for advertising.

CEVO is an appearance and grooming analysis. It is not a medical device and does not diagnose, treat or plan any medical or surgical procedure.

Human review of reports and renders

Every paid report is checked by a CEVO team member before it opens. Before you see a generated render, the team member checks it for errors, such as a distorted face or the wrong hairstyle, and approves or remakes it.

Who

A trained CEVO team member bound by a confidentiality agreement

What they see

Your report, your photos and the renders. Renders are checked with no name or email attached

Where

Only inside CEVO's own signed-in admin tool, on our servers. No downloads. Every view is logged. Chat tools get only a count of renders waiting, never images or details

Why

So your report is complete and correct, and you receive only renders that match the style described

Who receives your data

The table lists everyone who receives data through CEVO, including our own reviewer. The companies in it process data for us under contract, only on our instructions, and each receives only what it needs. Google Ads and the Google and Apple sign-ins are the exceptions: they act for themselves, as explained below the table.

Google acts as a separate company for its own ad purposes, not as our processor, so its use counts as "sharing" under California law. Google uses the conversions it receives as an independent controller under the Google Ads Controller-Controller Data Protection Terms. You can turn it off: see cookies and ads. Meta advertising tools (the Meta pixel and Conversions API) are not in use yet. Before we turn them on, we will update this policy. We use no third-party analytics service. CEVO's own visit measurement runs on our server in Helsinki, and its counts and visit records go to no other company (see visit measurement).

Apple and Google run their sign-in services under their own privacy policies. You sign in on their pages, so they learn that you signed in to CEVO, and they send CEVO only what the Account row above lists.

We may also disclose data when the law requires it, for example a valid court order, and to a buyer of the business, who would be bound by this policy. We tell you first where the law allows.

International transfers

Several providers are in the US. When your data leaves the EU or UK, it is protected as follows.

Cloudflare R2 keeps CEVO's encrypted copies of paid photos and their landmark records, renders and database backups in Western Europe, encrypted with keys that stay on CEVO's server in Helsinki. Cloudflare is a US company, so the Framework above also covers that storage.

Ask us at privacy@cevolab.com for a copy of the safeguards.

How long we keep it

We keep each kind of data only as long as it is needed, then delete it. One schedule applies everywhere, built to meet the strictest law that applies to you.

You can have any render, your report or your whole account deleted sooner at any time: email privacy@cevolab.com. The face-geometry schedule and how it is destroyed are set out in the biometric notice.

Security

• Data is encrypted in transit and at rest.
• Paid photos and their landmark records, renders and database backups are encrypted on CEVO's server before they are stored in Cloudflare R2. The keys stay on CEVO's server, so Cloudflare cannot read them.
• Photos are served only through short-lived signed links, and only to you and the reviewer.
• Only named team members can reach personal data, through the signed-in admin tool, and access is logged.
• We protect face geometry at least as carefully as any other confidential data we hold.
• Continue on your phone is end-to-end encrypted (AES-256-GCM). Through it pass your answers, which optional consent boxes you ticked, chosen report tier, which screen each device is on and, once you unlock your readout, your email address, plus the photo and its camera lens details, and, once you buy, that your report is paid, its order number and, for a $59 or $119 report bought on your computer, a link for your side photo. The key is made on your computer and travels only in the QR code's link, in the part of the address that browsers never send to a server, so CEVO's relay holds only data it cannot read. It keeps that data in memory, never on disk, deletes it once delivered or after 30 minutes, and logs no content. Once the photo reaches your computer, your computer keeps a private copy of it with CEVO for up to 90 days, like every scan photo. Its logs record IP addresses only as keyed hashes, kept 30 days like our other server logs. The code works once and expires after 30 minutes, so show it only to your own phone.
• After you buy, your computer can show a code to take a photo for your order on your phone, with no sign-in there. The code holds a one-time link for that one photo of that one order. Your phone must open it within 15 minutes; once opened, it works for 30 minutes. The photo is uploaded to CEVO's servers like any photo for your report. While the link lives, CEVO keeps with it your cookie choice, your consent record and your age range from your computer, so your phone does not ask again; they are deleted when the link is used or your photo arrives another way, and at the latest 10 minutes after it expires. The link's one-way code is deleted a day after it expires.

If a breach puts your data at risk, we tell the supervisory authority within 72 hours where required and tell you without undue delay, and in any case within 30 days of discovering it.

Your rights

Everyone

Wherever you live, you can ask us to show you your data, give you a copy, correct it, delete it, or stop any optional use. We do not treat you differently or charge you more for using these rights.

EU and UK

Under the GDPR and UK GDPR you have the right to:

• access your data and get a copy (Art. 15);
• correct it (Art. 16);
• have it deleted (Art. 17);
• restrict how we use it (Art. 18);
• receive the data you gave us in a machine-readable file, or have it sent to another service (Art. 20);
• object to uses based on our legitimate interests (Art. 21); for visit measurement, switch it off (see visit measurement);
• withdraw any consent at any time, without affecting what was done before;
• complain to a supervisory authority (see complaints).

UK users can also complain to us first by emailing privacy@cevolab.com. We acknowledge it within 30 days and tell you the outcome without undue delay.

California

Under the CCPA you have the right to know what we collect and why, to delete it, to correct it, and to opt out of the sale or sharing of your personal information. We do not sell personal information. The conversions we send Google Ads count as "sharing". For visitors in the United States they are on until you opt out: switch off "Measure Google ads" in Cookie settings, in the footer of the homepage and the scan page and at the top of the questionnaire. We treat a Global Privacy Control signal from your browser as the same request.

We use sensitive personal information (face geometry, ancestry and body fat) only to provide the analysis you asked for and, if you opt in, to improve CEVO's own measurements (CCPA Regs §7027(m)), so no "limit" request is needed. You can use an authorised agent; we will ask them for proof of your permission.

In the 12 months before this policy's date, we collected personal information only in the categories listed under what we collect, only from you and, when you sign in with them, from Apple or Google, only for the purposes under why we use it, and disclosed it only to the recipients under who receives your data. We have not sold personal information. We share it for cross-context behavioral advertising only with Google Ads, and only if you came from a Google ad and did not opt out, as described under cookies and ads. Anonymous visit counts are deidentified: we keep them in that form and never try to re-identify anyone from them.

Other US states

Residents of Texas, Colorado, Virginia, Connecticut, Oregon, Delaware, New Jersey, Minnesota, Maryland and other states with privacy laws can access, correct, delete and get a copy of their data, and opt out of targeted advertising, sale and profiling. We ask for opt-in consent before collecting any sensitive data. In Maryland we collect sensitive data only where strictly necessary to make the report you asked for, so the optional ancestry, body-fat and improvement uses are not offered there; we tell where you are from your IP address or billing state. If we turn down a request, you can appeal by replying to our answer; we decide within 45 days and, if we still refuse, tell you how to contact your state attorney general.

Biometric rules in Illinois, Texas, Washington and Colorado are covered in the biometric notice. Consumer health data rights are in the policies for Washington and Nevada.

Making a request

1. Email privacy@cevolab.com to get a copy of your data or to have single renders, a report or your whole account deleted, visit records linked to your email included. We do it within 30 days. My CEVO (cevolab.com/account) shows your orders and their status in the meantime.
2. Write from the address on your account, so we can match the request to it.

We confirm it is you through your sign-in or a code sent to your email, and ask for nothing more than that. We answer within 30 days. If a request is complex we may take up to two more months (EU and UK) or 45 more days (US), and we will tell you why. When you ask us to delete your data, we delete it from live systems and from our providers, including fal.ai, within 30 days. Copies in our encrypted database backups are gone within 30 days, when those backups expire; until then they are used only to recover from a failure.

Adults only

CEVO is for adults aged 18 and over. We do not knowingly collect data from anyone younger. If we learn that someone under 18 has used CEVO, we stop, process no photo for them, and delete their data at once. If you think this has happened, email privacy@cevolab.com.

Cookies and ads

Sign-in and security cookies are always on, because the service needs them. Our own visit measurement runs until you switch it off; in the United States, and elsewhere after you accept the cookie banner, it sets two CEVO cookies, __Host-cevo_vid and __Host-cevo_sid (see visit measurement). CEVO runs no ad pixel or ad tag on its pages. Meta advertising tools (the Meta pixel and Conversions API) are not in use yet. Before we turn them on, we will update this policy. If you came from a Google ad, we keep its click ID in your browser for that visit, and our server tells Google Ads, once, that you unlocked your free readout, with that click ID, the time and a fixed value, and once when you pay for a report, with that click ID, the time and the amount paid. In the United States there is no cookie banner: this is on until you switch it off in Cookie settings. Everywhere else, and whenever we cannot tell your country, the cookie banner asks you first and this happens only if you accept. We tell your country from your IP address on our own server (IP geolocation by DB-IP) and do not store the IP address for this. If you switch it off, refuse, have not chosen in the banner, or send a Global Privacy Control signal, Google gets nothing about you, and switching off cancels a conversion not yet sent. In Washington and Nevada, sending this to Google counts as sharing consumer health data. Continue with Google opens Google's own sign-in window; CEVO loads no Google script on its pages. Partner codes are stored on your order, not in a cookie. Details and your choices are on the cookies page.

Visit measurement

To see how visitors find cevolab.com, how they move through it and where people stop, our own server measures visits. Each time a page reaches a step, your browser tells our server. The steps are: a page opened (for example the homepage, the questionnaire, the scan page or the page after payment); each questionnaire step reached (about you, goal, routine, hair type, hair length, style, body fat, consent); a scan started (camera, upload or phone), a photo taken (and whether it passed the photo checks) or accepted, the free readout shown; an unlock or sign-in, with Google or by email; the prices seen, a report tier picked (and which one), checkout opened. Choosing to take a new photo from the price page instead of buying is a step too. The prices seen, the tier picked and that choice also say how many of the 10 free front measurements the photo got, as a band (1 to 4, 5 to 9, all 10, or not certain).

Visit records

In the United States, and everywhere else only after you accept the cookie banner, our server keeps a record of your visits:

• It sets two first-party cookies: __Host-cevo_vid, a random visitor ID kept for 400 days and renewed when you come back, and __Host-cevo_sid, a random session ID that ends after 30 minutes without activity. Scripts on the page cannot read them, and no other company receives them.
• With them it records each step with its time; the address of the first page of each visit, without anything after a "?"; where you came from: the site and page that linked to you, the campaign tags and ad click IDs in the link (such as utm_source, gclid or fbclid) and a partner code; phone, tablet or computer, and your browser and operating system family (never the full browser string); and your country.
• When you unlock your free readout or sign in, your visits are linked to that unlock or account, including its email address, and your orders from then on (tier, amount, payment) are added to them, so we can see which visits led to a sign-up or an order.
• Each step and arrival is deleted 25 months after it is recorded. Your visitor ID, with its device, country and email link, is deleted 25 months after your last visit or order (checked daily).

Anonymous counts

• Every step is also added to an anonymous daily count, for every visitor who has not switched it off. A count holds only the step, the day (never the time), and whether the device is a phone or a computer. For those three price-page steps it also holds that band. Only if Google Ads measurement or visit records are on for you, and your browser sends no Global Privacy Control signal, does it also say whether you came from a Google ad: yes or no, never the click ID.
• Where visit records are not on (outside the United States or when we cannot tell your country, until you accept or if you refuse), only these counts are made: no cookie, nothing stored on your device and no ID.
• Counts are deleted after 400 days (about 13 months).

What neither ever holds

• Your answers themselves (they are kept in their own record, see Questionnaire answers, and linked to your visitor ID if visit records are on when you answer), your photo, face data or measurements, or free text you typed.
• Your IP address: our server uses it only in memory, to stop floods of fake counts and to tell your country. It is never written to a log or database, not even as a hash.
• Counts and visit records are never sent to another company. They are made only on cevolab.com and stay in CEVO's own database on our server in Helsinki, Finland, hosted by Hetzner. They are never sold, never shared for advertising and never used to make any decision about you.

In the United States, visit records rest on our legitimate interest in understanding how our own site is used and which ads, links and partners bring visitors (GDPR Art. 6(1)(f)); everywhere else, and when we cannot tell your country, on your consent in the cookie banner (Art. 6(1)(a)). The anonymous counts rest on our legitimate interest in anonymous statistics about our own site (Art. 6(1)(f)). You can object or withdraw at any time: open "Cookie settings" in the footer of the cevolab.com homepage or scan page, or at the top of the questionnaire ("Cookies" on phones), and switch off "Measure my visits". That stops both the visit records and the counts in that browser, and our server expires the two ID cookies. The choice is kept in the cevo_consent cookie for 182 days. A Global Privacy Control signal does the same automatically. If your visits are linked to your email, you can ask privacy@cevolab.com for a copy or to delete them. Because a count carries no ID, we cannot find or delete the counts made before you switched it off, and we will never try to link them to a person.

Complaints

Please tell us first at privacy@cevolab.com, so we can put it right. You can also complain to a regulator at any time:

EU

The data protection authority in the country where you live or work. CEVO has no establishment in the EU, so there is no lead authority

UK

The Information Commissioner's Office, ico.org.uk

US

Your state attorney general, or in California the California Privacy Protection Agency, cppa.ca.gov

Changes to this policy

If we change this policy in a way that matters, we email you 30 days before it applies. If we want to use your data for a new purpose, we ask for your consent first. Each version is dated. We keep every version published from 25 October 2026 onwards and send any of them on request.