Privacy policy

Privacy policy. Last updated: October 12, 2026. BASUP is a brand of Mirom, Inc.

1. Introduction

This Privacy Policy explains how Mirom, Inc. (“Mirom,” “we,” or “us”) collects, uses, shares, and protects your information when you use the BASUP website, your account, and our skin-assessment and skin-scanning tools (the “Services”). BASUP products are developed and manufactured by our partner, SKINLAB KOREA CO., LTD. (“SKINLAB KOREA”). Our AI Skin Concierge at basupskin.com is operated separately and has its own privacy notice. This Policy is part of our Terms of Service.

2. Information We Collect

We collect information that identifies, relates to, describes, or is reasonably capable of being associated with you:

— Account details: Name, email address, phone number, shipping and billing address, and date of birth (used to confirm you are 18 or older).
— Payment information: Payments are collected and processed by our payment provider. We do not store your full card number.
— Skin profile: Your answers to our 24-question skin assessment, including lifestyle, routine, skin-concern, and health-related questions.
— Skin scan images and results: Six LED and UV close-up images of small patches of skin (forehead and both cheeks), captured with the phone-clip microscope or the BASUP Skin Scanner, stored in non-identifiable form, along with your analysis results and scan history.
— Orders and preferences: What you order, subscription activity, shipping status, and your account settings (such as device and communication preferences).
— Messages: What you send us through the contact form, email, or phone.
— Technical data: IP address, browser and device type, and pages viewed. We use cookies and similar technologies that are needed to run the site, keep you signed in, and process your cart and checkout. If we add analytics or advertising cookies, we will update this Policy and ask for your consent first. You can review or change your cookie choices at any time with Cookie Settings in the footer, and we treat a Global Privacy Control browser signal as a request to turn optional cookies off.

Note: Our technology analyzes skin texture and health metrics from small, specific areas. We do not perform facial recognition, and we do not collect full-face images that could be used to identify you.

3. How We Use Your Information

We use your information to:

— Analyze your skin using AI-assisted analysis and, in some cases, human expert review, and formulate your personalized essence, serum, and ampoule booster every 28 days.
— Track your skin progress and provide your skin results and reports.
— Process payments, deliver products, manage your subscription, and provide customer support.
— Send order and shipping updates and, if you have them turned on, scan reminders. We send marketing emails only if you choose to receive them, and you can turn them off at any time in Settings.
— Confirm you are 18 or older, prevent fraud, keep the Services secure, and comply with the law.
— Improve the Services using aggregated or de-identified information, which does not include your skin scan images.

4. Biometric & Sensitive Data Notice

While our scans are localized and non-identifiable, we treat all skin data, and your health-related assessment answers, with the highest level of sensitivity. We collect your skin scan images only with your consent, which we ask for when you create your account. You can withdraw it at any time by deleting your data or cancelling your subscription.

Purpose Limitation: Your skin scan images are used only to analyze your skin and to formulate and deliver your personalized products.
No Sale of Data: We do not sell, rent, lease, trade, or otherwise profit from your skin scan data or personal information.
No Advertisers or Data Brokers: Your skin data is never shared with data brokers or advertisers.

5. How We Share Information

— SKINLAB KOREA. SKINLAB KOREA develops the BASUP analysis technology and manufactures your products, so it receives your scan images, assessment answers, and results as needed to analyze your skin and formulate your kit. Your information may therefore be accessed or processed in South Korea. We require SKINLAB KOREA to protect it and to use it only to provide the Services.
— Service providers. Companies that help us run the Services, such as payment processing, our e-commerce platform, shipping carriers, cloud hosting, and email or text messaging. They may use your information only to perform services for us.
— Shopify. Our online store, checkout, payments, and customer accounts are provided with Shopify Inc. (“Shopify”). Shopify collects and processes personal information about how you use the store to provide and improve its services, and for some purposes, such as fraud prevention and, where available, advertising across merchants, Shopify is responsible for your information. To learn more about how Shopify uses your information and the rights you may have, see the Shopify Consumer Privacy Policy (https://www.shopify.com/legal/privacy/app-users) and the Shopify Privacy Portal (https://privacy.shopify.com/en).
— Legal reasons. When the law requires, or to protect the rights, safety, or property of you, us, or others.
— Business changes. If Mirom is involved in a merger, acquisition, or sale of assets, your information may be transferred, and it will remain subject to this Policy.

We do not sell your personal information for money. Some service providers, including Shopify, may use information about your online activity to show you advertisements (for example, based on items you viewed or added to your cart). Where the law treats that as “sharing” for targeted advertising, you can opt out as described in Section 7.

International transfers. We and our service providers, including SKINLAB KOREA in South Korea and Shopify, may transfer, store, and process your information in countries other than the one where you live, including the United States and South Korea. We require these providers to protect your information as described in this Policy.

6. Data Security

We use administrative, technical, and physical safeguards to protect your information, including encryption of data in transit and at rest, and we limit access to raw skin images to authorized personnel who need it for analysis, quality control, and system maintenance. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach affects your information, we will notify you as the law requires.

7. Your Rights (CCPA/CPRA & Other State Laws)

Depending on where you live, you may have the right to:

— Know and Access: Request the personal information we have collected about you and how we use it.
— Delete: Request that we delete your personal information, including your skin scan history.
— Correct: Request correction of inaccurate personal information.
— Receive a Copy: Get your information in a portable format.
— Opt Out: Opt out of the sale or sharing of your personal information, or of targeted advertising, at https://shop.basup.us/pages/data-sharing-opt-out. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a request to opt out for that browser and device. We do not respond to other “Do Not Track” signals. You can turn off marketing messages at any time in Settings or with the unsubscribe link in our emails.
— Limit Use of Sensitive Information: We use sensitive information only for the purposes in this Policy.
— Non-Discrimination: We will not treat you differently for exercising your rights.

How to make a request. Sign in and use Privacy & Data Control in your account to view your assessment answers and scans, download a copy of your data, or delete it. You can also email info@basup.us with the subject “Privacy Request.” We may need to verify your identity, and you may use an authorized agent. We respond within 45 days, and may extend that once by up to 45 more days if we tell you why. If we deny a request, you may appeal by emailing us with the subject “Privacy Appeal.”

8. Data Retention

We keep your skin scan images and assessment answers only as long as you maintain an active subscription. When you cancel, or when you ask us to delete your data, we delete your skin scan images, assessment answers, and profile immediately; there is no retention window. The only exceptions are records we must keep by law, such as order and tax records. You can request deletion at any time from Privacy & Data Control in your account.

9. Children’s Privacy

The Services are for people 18 and older. We do not knowingly collect information from anyone under 18. If you believe a child has given us information, contact us and we will delete it.

10. Changes to This Policy

We may update this Policy from time to time. We will post the new version here with a new “Last Updated” date and, if the changes are significant, tell you by email or on the site before they take effect.