Skin & Pixel Lab

Privacy Policy

Last updated: May 5, 2026

At Skin & Pixel Lab S.A.S. (hereinafter "Skin & Pixel Lab", "we" or "the Company") we take the privacy of personal data of those who use our platform seriously. This policy describes how we collect, use, protect and share your information when you access our professional 3D simulation platform for aestheticians at xkinlab.com (hereinafter "the Service").

1. Scope

This Privacy Policy applies to all professional users (aestheticians, micropigmentation studios) who register and use the Skin & Pixel Lab platform.

It also applies to the handling of data of end clients whose photographs are uploaded by professional aestheticians for purposes of 3D simulation and pre-procedure design of micropigmentation.

2. Data controller

The controller of your personal data processing is:

  • Legal name: Skin & Pixel Lab S.A.S.
  • Tax ID: 0000
  • Domicile: Medellín, Antioquia, Colombia
  • Email for privacy matters: legal@xkinlab.com

3. Data we collect

We collect different types of information based on your role:

3.1 Professional users (aestheticians)

    3.2 End clients (data managed by aestheticians)

      4. Purpose of processing

      We use your personal data for the following purposes:

        5. Legal basis for processing

        We process your personal data on the following legal bases:

          6. Sharing information with third parties

          We do not sell your personal data to third parties. We share information only with the following service providers under strict confidentiality agreements:

            7. Data security

            We implement technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure or destruction.

              8. Google Account Data (OAuth)

              When you register or sign in using your Google account through Google OAuth 2.0, we access specific information from your Google account. This section details what information we access and how we use it, in compliance with the Google API Services User Data Policy.

              8.1 OAuth Permissions Requested

              We request the following Google OAuth scopes, all non-sensitive:

                8.2 Specific Data Accessed

                Through the above scopes we access exclusively:

                  8.3 Data We Do NOT Access

                  To guarantee your privacy, we do NOT access or request permissions for:

                    8.4 Specific Use of Google Data

                    The data obtained from your Google account is used exclusively for:

                      8.5 What We Do NOT Do With Your Google Data

                        8.6 Storage and Security

                          8.7 Data Deletion and Access Revocation

                          You have full control over your data:

                            8.8 Regulatory Compliance

                            We comply with the Google API Services User Data Policy, including Limited Use requirements. Our platform is also governed by applicable data protection laws, including Law 1581 of 2012 (Habeas Data) in Colombia, GDPR in Europe, and CCPA in California.

                            8. Retention period

                            We retain your personal data for as long as you maintain an active account and for an additional period necessary to comply with legal obligations (minimum 5 years for accounting and tax records).

                            9. Your rights

                            As a personal data owner, you have the following rights:

                              To exercise any of these rights, write to legal@xkinlab.com clearly indicating your request. We will respond within a maximum of 15 business days.

                              10. Minors

                              Our Service is intended exclusively for professionals over 18 years of age. We do not intentionally collect personal data from minors. If a professional aesthetician wishes to simulate a procedure on an underage client, they must obtain express consent from parents or legal representatives, in accordance with applicable legislation.

                              11. International data transfer

                              Your data may be transferred and processed in countries outside Colombia, mainly the United States and Europe, where our service providers are located. These providers comply with international data protection standards such as GDPR, CCPA and LGPD.

                              12. Changes to this policy

                              We may update this Privacy Policy periodically. Material changes will be notified at least 30 days in advance through the registered email or through a prominent notice on the platform.

                              13. Contact

                              If you have questions about this policy or wish to exercise your rights, you can contact us at: