Limit the Use of My Sensitive Personal Information

The California Privacy Rights Act, codified at California Civil Code §1798.121, gives consumers the right to direct a business that collects sensitive personal information to limit its use and disclosure of that information to what is necessary to perform the services the consumer requested. Comparable rights apply under the Colorado Privacy Act, Connecticut Data Privacy Act, Delaware Personal Data Privacy Act, Maryland Online Data Privacy Act, Montana Consumer Data Privacy Act, Nebraska Data Privacy Act, New Hampshire SB-255, New Jersey Data Privacy Act, Oregon Consumer Privacy Act, and Rhode Island Data Transparency and Privacy Protection Act.

What qualifies as sensitive personal information

Under California Civil Code §1798.140(ae), sensitive personal information includes:

• Government-issued identifiers (Social Security number, driver's license number, state identification card, passport number).
• Account log-in credentials, financial account numbers, debit or credit card numbers paired with security codes or passwords that would permit account access.
• Precise geolocation, defined as any location data that identifies a consumer within a radius of 1,850 feet (§7000(t) of Title 11 of the California Code of Regulations).
• Racial or ethnic origin, religious or philosophical beliefs, union membership.
• The contents of a consumer's mail, email, and text messages where the business is not the intended recipient.
• Genetic data.
• Biometric information processed for the purpose of uniquely identifying a consumer.
• Personal information collected and analyzed concerning a consumer's health.
• Personal information concerning a consumer's sex life or sexual orientation.

What sensitive personal information Opuliss collects

Opuliss collects the following categories of sensitive personal information in the course of running opuliss.com:

• Account log-in credentials and payment card numbers when a customer creates an account or completes checkout. These are processed strictly to authenticate the consumer and complete the requested transaction. Payment card data is handled by Shopify Payments and the consumer's card network, not stored on opuliss.com servers.

Opuliss does not collect:

• Government identifiers beyond what payment processors require for fraud screening.
• Precise geolocation. We collect general geographic data via IP address for shipping, tax, and language purposes, which is not "precise geolocation" under §7000(t).
• Racial or ethnic origin, religion, union membership, mail or email contents, genetic data, biometric identifiers, health data, or information about sex life or sexual orientation. Our optional Virtual Try-On and Shade Finder read face or skin data only on your own device and never transmit or store it, so no biometric identifier ever reaches Opuliss (see "Biometric face and skin data" below).

Biometric face and skin data: our Virtual Try-On and Shade Finder

Opuliss offers two optional camera tools: a Virtual Try-On that previews a makeup shade on your face, and a Shade Finder that estimates your skin tone. To work, each reads the position of your facial features, or your skin color, from your camera. Because a camera reading of face geometry or skin can be treated as a biometric identifier under laws such as the Illinois Biometric Information Privacy Act and the Texas Capture or Use of Biometric Identifiers Act, we describe exactly how these tools handle it:

• Processed only on your own device. The reading happens in your browser, in the moment, and is discarded instantly, frame by frame, as the preview updates. Opuliss never receives, stores, shares, or sells any image or biometric identifier from these tools, and none of it ever leaves your device. There is nothing for us to retain, so there is no retention schedule and nothing to delete.
• Strictly opt-in, and simple to opt out. The camera never turns on until you give explicit, feature-specific consent on the tool itself, and you never need an account. Declining that consent, closing the tool, or simply not using it is your opt-out; there is no separate step to take, and nothing is collected in the meantime.
• Used only to show you the preview. The on-device reading is used solely to place the shade, or estimate your tone, while you are using the tool. It is never used to identify you, to infer characteristics about you, or for advertising.
• For people aged 13 and older.

If Opuliss ever offers an optional way to save or share a rendered image (which would send a photo to an imaging partner), that feature will carry its own clear, separate consent and its own notice. We will not change this on-device promise quietly.

If we launch any other feature that would newly collect a sensitive category (for example, a skin-type quiz that infers health information, or a precise geolocation feature), we will likewise update this page before that feature goes live and offer a separate, prominent opt-out for that category.

How we use the sensitive personal information we do collect

Account credentials and payment card numbers are used solely for the purposes permitted under §7027(m) of the regulations: performing the services that the consumer requested, ensuring security and integrity of the service, short-term transient use, and complying with legal obligations. We do not use either category for inference of consumer characteristics, advertising profiling, or any purpose beyond delivering and securing the service the consumer requested. Because our use is already limited to those permitted purposes, the §1798.121 right does not require an additional limitation.

How to exercise this right

If you would like written confirmation that Opuliss has limited the use of your sensitive personal information to the purposes described above, write to info@opuliss.com with the subject line "Limit Sensitive PI." Include your account email or order number so we can verify your identity. We will respond within 15 business days, the deadline that applies to opt-out and limit-use requests under §7022 of the California regulations.

You may also submit a Global Privacy Control signal from your browser. We honor GPC signals as both an opt-out of sale and sharing under §1798.135 and as a request to limit the use of sensitive personal information under §1798.121, consistent with the 2026 CCPA regulatory update.

Other privacy rights

For the broader set of rights (knowing what we collect, deleting, correcting, opting out of sale or sharing, data portability, non-discrimination), see our Do Not Sell or Share My Personal Information page, our Virtual Try-On Privacy Notice, and our Privacy Policy.

This statement was last reviewed on 4 July 2026.