IL MAKIAGE® PRIVACY POLICY

Last Updated: January 1st 2026

Introduction

Oddity Global Ltd. and Oddity Tech Ltd., including its affiliates (collectively, "IL MAKIAGE", "we", "us" or "our") are committed to protecting your privacy. This privacy policy (“Privacy Policy”) explains how we collect, use and process Personal Data (as defined below) when you use our websites, including any sub-domains and affiliated sites or mobile applications ("Website(s)"), and our products, tools, subscription programs and any related features we offer through them ("Offering(s)", and together with the Websites, "Services"). It also outlines your rights regarding your Personal Data and how to contact us with questions. This Privacy Policy forms part of our Terms and Conditions ("Terms"), available here.

Our Services are intended for individuals at least eighteen (18) years old. In certain jurisdictions, we may, at our discretion, allow users aged sixteen (16) or older, but under eighteen (18), to use the Services with the explicit consent of a parent or legal guardian to our Terms and Conditions.

If you have a disability and need this Privacy Policy in another format, you can contact us at [email protected].

Providing Personal Data is voluntary. However, certain parts of the Services may require specific information, and choosing not to provide it may limit your ability to use those features. If you provide Personal Data, you agree to keep it accurate and up to date.

PLEASE READ THIS PRIVACY POLICY CAREFULLY. Please note that some sections of this Privacy Policy may not apply to you depending on the laws in your jurisdiction.

By accessing or using the Services or Offerings, you confirm that you have read and agreed to this Privacy Policy. If you do not agree, you should not use the Services or Offerings.

Specifically, this Privacy Policy describes -

1. WHAT TYPES OF DATA WE COLLECT?

2. COOKIES AND OTHER TRACKING TECHNOLOGIES

3. WHY WE PROCESS YOUR PERSONAL DATA?

4. WITH WHOM WE SHARE YOUR PERSONAL DATA

5. MARKETING AND ADVERTISING

6. YOUR RIGHTS REGARDING YOUR PERSONAL DATA

7. OUR SECURITY MEASURES

8. MINORS’ PRIVACY

9. INTERNATIONAL TRANSFERS OF PERSONAL DATA

10. HOW LONG WE KEEP YOUR PERSONAL DATA?

11. MODIFICATIONS OF THIS PRIVACY POLICY

12. DATA PROTECTION OFFICER

13. CONTACT US & REPRESENTATIVES

1. WHAT TYPES OF DATA WE COLLECT?

When we refer to "Personal Data" in this Privacy Policy, we mean any information that, either alone or in combination with other information, can identify you through reasonable means, such as your name or email address. This section explains how and when we collect and process Personal Data about you.

• 1.1. Account information: If you choose to register an account, we collect your full name, email address, password, phone number and birthdate, as well as any optional details you choose to provide. In some cases, we may ask for proof of identity or age verification by requesting a government-issued ID or similar documentation. If you are under the Age of Majority (as defined below) but at least sixteen (16), we may request additional information about your parent or legal guardian to verify their identity and obtain their explicit consent, including copies of identification documents as required by law.

• 1.2. Preferences information: We collect information related to our Offerings, your product preferences, including the Offerings you have purchased, returned or viewed, product usage preferences and any other profile information you choose to provide when interacting with our Services.

• 1.3. Visual information and physical characteristics: Certain features in our Services allow you to submit images or photographs ("Photograph") that help us identify skin conditions and properties or analyze physical characteristics. This may include information about your skin type and similar beauty-related attributes. We may use software to detect the general structure of your face ("Structural Data", and together with the Photograph, "Photo Data"). We may also generate de-identified, anonymized or aggregated data derived from your Photo Data ("Derived Data"), as permitted by law. We may request access to your device’s camera or files, which you can allow or deny through your device settings. Some features may not function without these permissions. We use Photo Data and Derived Data to (i) improve our software and algorithms in order to provide the most accurate recommendations of our Offerings, and (ii) for research, product development, general Service improvements, and other lawful purposes.

• 1.4. Billing information: If you purchase Offerings, you must provide billing information such as your credit card number or other payment details, depending on the chosen payment method. Payment information is collected by secure third-party payment processors.

• 1.5. User-provided information: Some parts of our Services allow you to create a public profile ("Public Profile"), which may include your name and any additional information you choose to include, such a profile photo. Our Services may also offer interactive features (such as our PowerMatch Quiz), questionnaires, product review pages or content upload tools. If you use these features, we collect the Personal Data you submit. Information posted publicly, including interactions with our social media channels, may be visible to others for as long as the relevant pages remain active. We are not responsible for Personal Data you choose to post - please be aware that any information you post publicly may be visible to others. Social media platforms operate independently from us and have their own privacy and security practices.

• 1.6. Demographic information: We may collect demographic details such as age and gender.

• 1.7. Location information: We may provide certain location-based services that rely on your device’s geolocation data. You can disable location sharing through your device settings. We collect this information to provide relevant location-based content and Offerings.

• 1.8. Usage information: When you use our Services, we collect technical information about your interaction with our Services. Such information may include statistics, IP address, unique identifiers (e.g., MAC address and UUID), as well as other information that relates to your activity in the Services.

• 1.9. Contacts' information: If you choose to invite friends to use our Services, we may collect information such as their names, phone numbers, email addresses or public profile details from your device or social media accounts. If you share third-party Personal Data with us, you are responsible for informing them and ensuring you have their permission.

• 1.10. Communication information: When you email us or contact support, we collect the Personal Data you provide including your name, email address and any additional information you choose to share. We also collect information you submit when participating in promotions, marketing campaigns or events.

2. COOKIES AND OTHER TRACKING TECHNOLOGIES

When you visit or access our Services, we use cookies, pixels, beacons, local storage and similar technologies ("Tracking Technologies"). These Tracking Technologies allow us to automatically collect information about you, your device, and your online behavior, in order to enhance your navigation in our Services, improve the performance of our Services, perform analytics, customize your experience, and offer you, for example, tailored content and advertisements that better correspond with your interests. For more information, see the following section of this Privacy Policy. 

2.1. What types of Tracking Technologies do we use? When you use our Services, we use the following categories of Tracking Technologies

• 2.1.1. Strictly necessary Tracking Technologies: These Tracking Technologies are automatically placed on your device when you access our Services or take certain actions on our Services. These Tracking Technologies are essential to enable you to navigate and use the features of our Services. We do not need to obtain your consent in order to use these Tracking Technologies.

• 2.1.2. Tracking and advertising Tracking Technologies: These Tracking Technologies collect information about your browsing habits in order to make advertising more relevant to you and your interests. They are also used to limit the number of times you see an advertisement as well as help measure the effectiveness of an advertising campaign. Tracking Technologies remember the websites you visit, and such information is shared with other parties such as advertisers and/or publishers. Publishers, advertisers, and third-party ad networks may also utilize Tracking Technologies or similar technologies to deliver ads and monitor the performance of such ads. The collection of information through Tracking Technologies by such third parties will be governed by their own privacy policies/cookies policies and principles, which IL MAKIAGE does not control.

• 2.1.3. Functionality Tracking Technologies: These Tracking Technologies allow our Services to remember choices you make when you visit our Services (such as language options) and provide enhanced and personalized features. For example, these Tracking Technologies are used for authentication (to remember when you are logged in) and support other features of our Services.

• 2.1.4. Performance Tracking Technologies: These Tracking Technologies collect information about your online activity (for example, the duration of your visit to our Services), including behavioral data and content engagement metrics. These Tracking Technologies are used for analytics and research and to perform statistics (based on aggregated information).

2.2. How and by whom are Tracking Technologies stored on your device? 

We store Tracking Technologies on your device when you visit or access our Services (for example, when you visit our Website). Such Tracking Technologies are called "First Party Tracking Technologies". In addition, Tracking Technologies are stored by other third parties (for example, our analytics service providers, business partners, and advertisers), who run content on our Services. Such Tracking Technologies are called "Third Party Tracking Technologies". Both types of Tracking Technologies may be stored either for the duration of your visit on our Services / Website or for repeated visits. 

There are various ways in which you can manage and control your Tracking Technologies settings. You can change your Tracking Technology preferences by changing your browser settings to send a “Do-Not-Track” signal. In such a case, your browser will send us a special signal to stop tracking your activity. However, please note that certain features of the Services may not work properly or effectively if you delete or disable cookies. 

To learn more about how you can manage your cookies, below is a list of useful links that can provide you with more information:

• (a) Google Chrome

• (b) Microsoft Edge

• (c) Mozilla Firefox

• (d) Safari (Desktop)

• (e) Safari (Mobile)

• (f) Android Browser

You can learn more about how to turn off certain third-party targeting and advertising cookies by visiting the following third-party webpages:

• (a) The Interactive Advertising Bureau (US)

• (b) The Interactive Advertising Bureau (EU)

• (c) European Interactive Digital Advertising Alliance (EU)

• (d) Digital Advertising Alliance

• (e) Network Advertising Initiative

• (f) “Your Online Choices” (UK)

You can withdraw your consent to personalized advertising experience on your device at any time by using your device settings as follows:

• (a) On iOS, depending on the applicable iOS version, you may withdraw consent across all Services by either enabling the “Limit Ad Tracking” setting or disabling the “Allow App to Request to Track” permission in your iOS device settings. Depending on the applicable iOS version, instead of withdrawing consent on a device-wide basis, you may also have the option of withdrawing consent on a per-app basis by disabling tracking permission for a specific app that appears under the “Allow App to Request to Track” setting in your iOS device settings (precise directions may differ depending on the applicable iOS version).

• (b) On Android devices, you may withdraw your consent in the Google Ads settings within your Android settings by enabling the “Opt out of Ads Personalization” setting (precise directions and the name of the setting may differ depending on the applicable Android versions and device manufacturer).

3. WHY WE PROCESS YOUR PERSONAL DATA?

This section explains for what purposes we use your Personal Data and outlines the legal bases or justifications that underline our usage.

4. WITH WHOM WE SHARE YOUR PERSONAL DATA

4.1 We share and disclose Personal Data as permitted by law, as described below:

• 4.1.1 Affiliated companies: We may share Personal Data internally within our parent company, affiliated companies and subsidiaries, for the purposes described in this Privacy Policy.

• 4.1.2 Payment processors: We share your payment information with third-party payment processors for the purpose of facilitating your payments when using our Services.

• 4.1.3 Service providers: We may share your Personal Data with service providers that operate our technical infrastructure, customer support, analytics, cloud storage, email delivery, marketing, and database services.

• 4.1.4 Third-party advertisers: Third parties may use Tracking Technologies to collect information for advertising based on your browsing interests.

• 4.1.5 Third-party integrations: You may integrate third-party services (Apple, Google, Facebook, etc.). You are bound by their privacy notices and terms. We do not receive or store your passwords.

• 4.1.6 Compliance with laws: We may disclose Personal Data to government, law-enforcement or private parties when legally required or necessary to protect rights, safety, or prevent illegal activity.

• 4.1.7 Auditors and advisers: We may share your data with auditors, accountants, lawyers, insurers and other advisers to meet regulatory obligations.

• 4.1.8 Mergers and acquisitions: We may transfer data as part of a merger, acquisition, bankruptcy, reorganization, or sale of assets — only as necessary.

4.2 The following summarizes our Personal Data disclosure practices during the preceding 12 months, including the categories of Personal Data we collect and how we use them.

As part of our advertising activities, we work with other companies and businesses to deliver behavioral advertising. In doing so, we may disclose personal information in ways that may be considered “selling” or “sharing” under US law.

We do not sell or share sensitive personal information, nor do we sell or share the personal information of consumers under 16 years of age.

4.3 We obtain the categories of personal information listed above from:

• 4.3.1. Consumer directly

• 4.3.2. Advertising networks

• 4.3.3. Internet service providers

• 4.3.4. Data analytics providers

• 4.3.5. Operating systems

• 4.3.6. Social networks

5. MARKETING AND ADVERTISING

We may use your Personal Data ourselves or by using our third-party service providers for the purpose of providing you with in-app promotional materials concerning the Services as well as products, websites and applications which relate to: (i) affiliated companies, or (ii) IL MAKIAGE' business partners and affiliates (collectively, “Marketing Affiliates”), which we believe may interest you. You may choose not to receive future promotional, advertising, or other Website-related emails from us by sending us an email to: [email protected], or selecting an unsubscribe link at the bottom of each email that we send. Please note that even if you opt out of receiving the foregoing emails, we may still send you a response to any “Contact Us” request as well as administrative emails (for example, in connection with a password reset request) that are necessary to facilitate your use of our Sites and notifications regarding your orders. Please note that even if you unsubscribe from our marketing mailing list, we may continue to send you in-app service-related updates and notifications.

At times, we may want to contact you via telephone regarding your use of the Offerings. For EU and UK residents, we will only contact you via telephone regarding your use of the Offerings and/or for telemarketing purposes where you provide your consent,  or we have another valid legal basis under applicable laws. For US residents, by submitting your Personal Data by and through the Services, you agree that such act constitutes an inquiry and/or application for purposes of the Amended Telemarketing Sales Rule (16 CFR §310 et seq.), as amended from time to time (the “Rule”) and applicable state do-not-call regulations. As such, notwithstanding that your telephone number may be listed on the Federal Trade Commission’s Do-Not-Call List, and/or on applicable state do-not-call lists, we retain the right to contact US residents via telemarketing in accordance with the Rule and applicable state do-not-call regulations. For Australian residents, we will not contact you for telemarketing purposes where you are registered on the Do Not Call Register.

At times, we may want to contact you via your mobile device regarding your use of the Offerings. For EU and UK residents, we will only contact you via your mobile device (including artificial voice calls, pre-recorded messages and/or calls (including SMS text messages) delivered via automated technology, to the telephone number(s) that you provided) regarding your use of the Offerings and/or for marketing purposes where you provide your consent as required under the  applicable laws, respectively, or we have another valid legal basis under applicable laws, respectively, to do so. 

For Canadian residents, we will only contact you via your mobile device via SMS text messages to the telephone number(s) that you provided regarding your use of the Offerings and/or for marketing purposes where you provide your consent as required under CASL, or there is an exemption under CASL enabling us to do so. 

For US residents, where you provide “prior express consent” within the meaning of the Telephone Consumer Protection Act (47 USC § 227), and its implementing regulations adopted by the Federal Communications Commission (47 CFR § 64.1200), as amended from time-to-time (“TCPA”), you consent to receive telephone calls, including artificial voice calls, pre-recorded messages and/or calls (including SMS text messages) delivered via automated technology, to the telephone number(s) that you provided.

To stop receiving mobile text messages from IL MAKIAGE, please reply “STOP” to the text message that you received from us. Please note this preference will only apply to the phone number that received the text message. Please reply “HELP” to receive help information. Please note that you are not required to provide this consent in order to obtain access to the Offerings, and your consent simply allows IL MAKIAGE® to contact you via these means. The frequency of SMS text messages that you receive from us may vary. Standard message and data rates may apply. Where you provide your consent as set forth above, you represent that you are the line subscriber and primary user of the telephone number that you provided (“Active Telephone Number”) and, as such, have the authority to agree to receive SMS text messages on the Active Telephone Number. Please be advised that by agreeing to this Privacy Policy, you are obligated to immediately inform us if and when your Active Telephone Number changes. Without limiting the foregoing, if you: (a) have your Active Telephone Number reassigned to another person or entity; (b) give up your Active Telephone Number so that it is no longer used by you; (c) port your Active Telephone Number to a landline or vice versa; or (d) otherwise stop using your Active Telephone Number for any reason (collectively “Phone Number Change”), you agree that you shall promptly notify IL MAKIAGE® of the Phone Number Change via e-mail at: [email protected], or by using one of the methods set forth in the “Contact Us” section below.

6. YOUR RIGHTS REGARDING YOUR PERSONAL DATA

6.1 Depending on the jurisdiction in which you reside, you may have certain rights under relevant applicable laws regarding the collection and processing of your Personal Data. To the extent these rights apply and concern you, you can contact us via the contact details available below and ask to exercise the following rights.

• 6.1.1. Rights of access to your Personal Data: You have the right to receive confirmation as to whether or not Personal Data concerning you is being processed, and access your stored Personal Data, together with supplementary information.

• 6.1.2. Right of data portability: You have the right to request us to move, copy and transfer your Personal Data easily from one IT environment to another, in a safe and secure way, without affecting its usability.

• 6.1.3. Right of rectification: You have the right to request rectification of your Personal Data in our control in the event that you believe the Personal Data held by us is inaccurate, incomplete or outdated.

• 6.1.4. Right of deletion/erasure: You have the right to request that IL MAKIAGE erase or delete Personal Data held about you at any time. Please note that we may not be able to completely remove Personal Data from our systems in certain circumstances. This will be true if one of the exceptions for data erasure under applicable law applies. During the period of retention, we will ensure that such data continues to be stored securely.

• 6.1.5. Right to restriction or objection to processing: You have the right to request that we restrict or cease to process Personal Data.

• 6.1.6. Right to withdraw your consent: To the extent we process Personal Data based on your consent, you have the right to withdraw your given consent at any time.

• 6.1.7. Right not to be subject to automated decision making: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significant effects to you.

Prior to responding to your requests, we may verify your identity by matching any identifying information you provide against the information we have about you.

Please note that these rights are not absolute and may be subject to our own legitimate interests and regulatory requirements. You are welcome to contact us with any questions or requests through our contact details below. We will make an effort to reply within a reasonable timeframe. If you are unsatisfied with our response, you can lodge a complaint with the applicable data protection supervisory authority or appeal our denial of your request by contacting us as set out in the “Contact Us” section below.

6.2. Additional information for US residents

Depending on your state of residence in the US, you may have certain additional rights under relevant applicable states laws regarding the collection and processing of your Personal Data, in addition to the rights described above.

• 6.2.1. Right to opt-out of sale or share of Personal Data: In the event that we sell or share your Personal Data for behavioral advertising purposes, you have the right to submit a request to opt-out via the webform here: https://www.ilmakiage.com/privacy_policy/CCPA_Form/ . After you opt-out, we may continue disclosing some Personal Data to our partners to help us perform business-related functions such as providing the Services, ensuring security, producing aggregate statistics and preventing fraud.

• 6.2.2. Right to limit the use and disclosure of sensitive Personal Data: You may request that we limit the collection and disclosure of your sensitive Personal Data only to what is necessary to perform our Services, or as otherwise permitted by applicable US data protection laws.

• 6.2.3. Right to non-discrimination: You have the right to be free from discrimination for exercising your rights, including different pricing, products or quality of services, based solely upon your request.

• 6.2.4. Right to content removal: If you are a California resident under the Age of Majority and over the age of Sixteen (16), you may request removal of content you submitted to the Services by emailing [email protected].

• 6.2.5. California “Shine the Light”: California residents may request information about our disclosure of Personal Data to third parties for direct marketing. Email [email protected]. We are required to respond to one such request per year.

• 6.2.6. Authorized agent: Depending on your residence state, you may designate an authorized agent to submit privacy requests on your behalf, subject to identity and authorization verification.

7. OUR SECURITY MEASURES

We have implemented administrative, technical, and physical safeguards to help prevent unauthorized access, use, or disclosure of your Personal Data. While we seek to protect your information to ensure that it is kept confidential, we cannot guarantee the security of any information. You should be aware that there is always some risk involved in transmitting information over the internet and that there is also some risk that others could find a way to thwart our security systems. Such breaches can lead to things such as reputational harm, fraud or identity theft. Therefore, we encourage you to exercise discretion regarding the Personal Data you choose to disclose. If you feel that your privacy was treated not in accordance with our Policy, or if any person attempted to abuse the Services or acted in an inappropriate manner, please contact us directly via our contact details available below.

8. MINOR'S PRIVACY

Our Services are intended solely for users who are at least eighteen (18) years of age and can form a legally binding contract under applicable law ("Age of Majority") or are at least sixteen (16) years of age, provided that their parent or legal guardian consents to our Terms of Use and this Privacy Policy. Additionally, in specific jurisdictions, we may, at our sole discretion, implement further measures or requirements to ensure compliance with applicable laws and regulations regarding consent or age restrictions.

Under no circumstances are users under the age of sixteen (16) permitted to use the Services. Any registration, use, or access to the Services by anyone under the Age of Majority without appropriate parental or guardian consent is unauthorized and constitutes a violation of our Terms of Use. We reserve the right to request proof of age or parental/legal guardian consent at any time. We may suspend or block access to the Services if we suspect that a user does not meet the applicable age requirements. 

If we learn that we have inadvertently collected Personal Data from a person under the Age of Majority without proper consent (other than as expressly permitted in the relevant jurisdiction), we will deactivate the account and delete that information as quickly as possible. If you believe that we might have any such information, please contact us at: [email protected]. We encourage all parents, guardians, and adults to guide individuals under the Age of Majority in understanding the importance of not sharing Personal Data online without permission.

9. INTERNATIONAL TRANSFERS OF PERSONAL DATA

We operate globally. Any information that we collect, disclose or share, including your Personal Data, can be stored and processed in various jurisdictions around the world, including (but not limited to) the Australia, European Economic Area ("EEA"), United Kingdom and United States, for the purposes detailed in this Privacy Policy. To the extent that the GDPR or the UK GDPR is applicable, we will only transfer or share your Personal Data to data recipients:

• 9.1. located in the EEA or in the United Kingdom;

• 9.2. located in non-EEA countries or the United Kingdom that have been approved as providing adequate level of data protection; or

• 9.3. who have entered into legal agreements ensuring an adequate level of data protection.

10. HOW LONG WE KEEP YOUR PERSONAL DATA?

We generally keep your Personal Data for as long as necessary to provide our Offerings and Services, and as necessary to comply with our legal obligations, to resolve disputes, or defend against legal claims. Retention periods will be determined to take into account factors such as the type of personal data that is collected and the purpose for which it is collected, bearing in mind the requirements applicable to the situation and the need to destroy outdated, unused information at the earliest reasonable time.

11. MODIFICATIONS OF THIS PRIVACY POLICY

IL MAKIAGE® reserves the right to change or update this Privacy Policy at any time by posting a notice on the Services that we are changing our Privacy Policy. The most current version will always be posted on our Services (as reflected in the "Last Updated" heading). You are advised to check for updates regularly. By continuing to access or use our Services after any revisions become effective, you agree to be bound by the updated Privacy Policy.

12. DATA PROTECTION OFFICER

We have appointed a Data Protection Officer responsible for overseeing privacy and data protection matters. If you have any questions about this Privacy Policy, you may contact the Data Protection Officer at: [email protected].

13. CONTACT US & REPRESENTATIVE

If you have any questions or comments regarding this Privacy Policy, the Services or how we process or use your Personal Data, please contact us as follow: 

• If you reside in the US or Canada – please contact us by email at: [email protected] .

• If you reside in Australia – please contact us by email at: [email protected] .

• If you reside in the UK – please contact us by email at: [email protected] .

• If you reside in the EU – please contact us by email at: [email protected] . Otherwise, you may contact Achieved Compliance Advocacy, our appointed representative in the EU, at the following addresses:

  • [email protected]

  • by mail: Achieved Compliance Advocacy, Ltd. C/o Renata Kloss, Singel 250, 1016 AB Amsterdam, Netherlands.

• If you reside in Israel – please contact us by email at: [email protected] .