Last updated: 24 September 2026
Roots Tracker is a monthly hair-progress tracking service. It allows users to upload consistent photographs over time so they can build a visual record of their hair progress.
This Privacy Notice explains what information we collect, why we collect it, how we use it and your rights.
1. Who we are
Roots Tracker is operated by:
Archie Warren
Email: hello@rootstracker.co.uk
For the purposes of UK data protection law, we are the data controller for the personal information collected through Roots Tracker.
2. Information we collect
When you use Roots Tracker, we may collect:
Your first name
Your email address
Hair-progress photographs you upload
The date and time of each progress submission
Notes or information you choose to add
Information required to administer your account or purchase
Technical information relating to your use of the service where applicable
Your photographs and tracker information may reveal information about your health or physical condition. Where this constitutes special-category personal data, we treat it accordingly.
3. Why we collect your information
We use your information to:
Create your initial hair-progress baseline
Store your progress photographs
Allow you to track changes over time
Remind you when your next monthly check-in is due
Provide your progress history or photo comparisons
Operate and administer Roots Tracker
Respond to support or deletion requests
Improve the service using aggregated or anonymised information where appropriate
We do not make your progress photographs publicly available.
We do not make your photographs visible to other Roots Tracker users unless you separately and clearly choose to participate in a feature that allows this.
4. Our lawful basis for using your information
For ordinary personal information, such as your name, email address and account information, our lawful basis may include processing necessary to provide the service you have requested and, where appropriate, our legitimate interests in operating and improving Roots Tracker.
Where your photographs or other tracker information constitute special-category health data, we rely on your explicit consent under Article 9 of the UK GDPR.
You can withdraw that consent at any time.
The ICO requires explicit consent to be given through a clear statement referring specifically to the sensitive data involved, rather than being inferred from general agreement.
5. Your consent
Before uploading progress photographs, we ask you to actively confirm:
“I explicitly consent to Roots Tracker storing and using my hair-progress photographs and tracker information to provide my monthly hair-tracking service.”
This consent is separate from any marketing consent.
You can withdraw your consent at any time by contacting:
[privacy@rootstracker.co.uk / hello@rootstracker.co.uk]
Withdrawal of consent will not affect processing that took place before you withdrew it.
6. How your photographs are used
Your photographs are used to provide your personal tracking record.
They may be used to:
Display your baseline photographs
Compare different monthly check-ins
Generate your personal progress timeline
Produce side-by-side comparisons for you
We will not use identifiable progress photographs for:
Advertising
Social media
Testimonials
Training AI models
Public before-and-after examples
unless you give separate, specific permission for that purpose.
That separation matters because consent should be granular and specific rather than bundled together.
7. Who we share information with
We use third-party providers to help operate Roots Tracker.
These may include:
Tally, for forms and photo submissions
Stripe, if used for payments
Email providers, for monthly reminders and service communications
Cloud or database providers used to securely store tracker information
Other technical providers necessary to operate the service
These organisations may process information on our behalf.
We do not sell your personal information.
As your technology stack changes, update this section with the actual providers you use.
8. Where your information is stored
Your information may be processed or stored by our technology providers.
Where personal information is transferred outside the UK, we will use appropriate safeguards required by UK data protection law where applicable.
You should update this section once you know exactly which storage/database and email provider you are using, because the ICO expects you to explain relevant overseas transfers.
9. How long we keep your information
We only keep personal information for as long as reasonably necessary for the purpose for which it was collected.
A sensible starting policy for Roots would be:
Active users: information and photographs retained while the tracker remains active.
After account deletion or withdrawal of consent: personal progress photographs deleted within 30 days, unless we are legally required to retain particular information.
Payment records: certain transaction records may need to be retained for accounting, tax or legal purposes.
I’d use an actual defined timeframe rather than saying you’ll keep things “as long as necessary.”
10. How we protect your information
We take appropriate technical and organisational measures to protect personal information.
These measures may include:
Restricting access to user photographs
Password-protected administrative accounts
Encryption provided by our technology providers
Collecting only the information needed to provide the service
Regularly reviewing access to stored information
Because special-category information is particularly sensitive, the ICO emphasises data minimisation, security and transparency.
Avoid saying things like “your information is 100% secure”, because no online service can legitimately guarantee that.
11. Your rights
Depending on the circumstances, you may have the right to:
Ask for a copy of your personal information
Correct inaccurate information
Ask us to delete your information
Restrict how your information is used
Object to certain processing
Request transfer of certain information
Withdraw consent at any time
To exercise any of these rights, contact:
[privacy@rootstracker.co.uk]
12. Deleting your Roots Tracker data
You can ask us to delete your progress record at any time.
Email:
privacy@rootstracker.co.uk
with the subject:
Delete My Roots Tracker Data
We may need to verify that the request relates to your account before deleting the information.
13. Marketing emails
Service messages, such as monthly tracker reminders, are different from promotional marketing.
If you later want to send newsletters, product recommendations or marketing emails, I would add a separate optional marketing checkbox such as:
“I’d like to receive Roots Tracker updates, hair-tracking content and product news by email.”
Do not bundle that into the photo-consent checkbox.
14. Age requirements
For the first version, I would strongly consider making Roots Tracker 18+ only.
You could state:
Roots Tracker is intended for people aged 18 and over. We do not knowingly collect hair-progress photographs from children.
That dramatically simplifies things while you’re validating the product.
15. Changes to this Privacy Notice
We may update this Privacy Notice as Roots Tracker develops.
Where changes are significant, we will take reasonable steps to bring them to your attention.
The latest version will always be available at:
track.rootstracker.co.uk/privacy
16. Complaints
If you have concerns about how we use your personal information, please contact us first at:
privacy@rootstracker.co.uk
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator