Privacy Policy

1. Information We Collect

We collect information you provide, information generated when you use Avella, and information from sign-in, purchase, analytics, and advertising providers. Depending on the features you use, this includes:

• Account details: account identifiers, name, email address, phone number if you sign in with it, and your sign-in method (Apple, Google, or phone).
• Skin profile: answers you give during onboarding and in settings, such as your age, skin type, skin concerns, sensitivities, goals, and routine, and how you heard about Avella, including any social media link you share with us.
• Photos: selfies and other photos you take or choose for skin scans and progress tracking, photos of products or your product shelf, and images you attach in chat.
• Skin analysis: results we generate from your photos, such as skin scores, detected concerns like acne, redness, or dryness, where they appear on your face, and your progress over time (see section 3).
• Products and routines: products you scan, search for, or save, barcodes, ingredient checks, and your routines.
• Chat: messages you send to Avella’s AI assistant and the replies it generates.
• Purchases: subscription status, products, transaction and renewal records, amounts, and currencies.
• Technical and activity data: device and advertising identifiers, push notification tokens, IP address, device details, app activity and interactions, referral and campaign information, crash and performance data, and sampled recordings of app screens (session replay).

Information is generally linked to your account.

2. How We Use Information

We use information to provide skin scans, analysis, routines, product checks, AI chat, progress tracking, subscriptions, notifications, and support; personalize recommendations; understand and improve Avella; diagnose problems, keep accounts secure, and prevent fraud; measure and improve Avella’s advertising; and handle legal obligations, billing, disputes, and privacy requests.

To generate skin analysis, recommendations, and chat replies, we send the relevant photos, skin profile details, and messages to the AI providers listed in section 4. We do not use your photos, skin analysis, or chat messages for advertising.

For EU/UK users, our legal bases are performance of our contract for the service, legal obligations for required records and compliance, and legitimate interests in maintaining, securing, and improving Avella where those interests do not override your rights. We rely on consent where required, including for advertising tracking and optional device access. Facial photos and skin analysis can be special category data; we process them only with your explicit consent, which you can withdraw at any time by contacting us or deleting your account. Required account and transaction information is needed for the relevant service; optional permissions support the features that use them.

3. Facial Photos and Skin Health Information

When you run a skin scan, Avella analyzes your facial photos to find skin areas and generate your skin analysis. Some laws treat facial images and information derived from them as biometric information, and skin analysis as health information, so we apply these extra commitments:

• Purpose: we use your facial photos only to provide skin analysis and show your results and progress. We do not use them to identify or recognize you.
• Sharing: we do not sell, lease, or trade your facial photos or skin analysis, or otherwise profit from them, and we do not share them with advertising partners. They are shared only with service providers that process them on our behalf to provide Avella.
• Retention: we keep your facial photos and skin analysis with your account and delete them when you delete your account. In any case, we permanently destroy information derived from your facial photos once the purpose for collecting it has been satisfied, and no later than 3 years after your last interaction with Avella, unless the law requires us to keep it longer.
• Your rights: you can ask to access or delete this information, or withdraw your consent, by emailing support@uselumeskin.com. Residents of Washington, Nevada, and other states with consumer health data laws can use the same address for those rights.

4. Sharing and Advertising

We use service providers that receive information relevant to their roles and process it on our behalf:

• Google (Firebase and Google Cloud) for sign-in, databases, file storage, backend services, and processing your scans.
• OpenAI and Google (Gemini) for AI skin analysis, recommendations, and chat. They process the photos, skin profile details, and messages needed to generate results for us.
• RevenueCat for subscription management. Apple processes payments.
• PostHog for analytics, diagnostics, and session replay. Session replays are sampled recordings of app screens. From app version 1.0.23, photos and text you type are hidden in these recordings.
• Expo and Apple for push notifications.
• Product data providers for product search, ingredient, price, and retailer information. They receive product searches, not your photos.

We also use our own attribution service, operated by Kazuo Corporation, to understand which creators and campaigns bring people to Avella. It receives your account identifier, email, phone number if provided, your answer about how you heard about Avella, and any link you share with us.

We use advertising and attribution partners, including Meta and Apple Search Ads, to measure and improve Avella advertising, including targeting and delivery. Depending on their role, these partners receive relevant identifiers, app activity such as app opens, purchase events, and campaign information. Available contact details are also used for matching with Meta. Contact information may be hashed for matching; hashing does not make it anonymous. Advertising partners do not receive your photos, skin analysis, or chat messages. See Meta’s privacy policy for its data practices and privacy controls.

For covered collection and transmission through the Facebook SDK for App Events for advertising targeting and delivery, we and Meta Platforms Ireland Limited (EU) or Meta Platforms, Inc. (UK) are joint controllers under Meta’s EU and UK controller arrangements. We provide information about this processing; Meta handles applicable data-rights requests concerning information it stores. You may also contact us. Meta separately controls subsequent processing.

We do not sell personal information for money. Under some US state laws, sharing information with advertising partners for targeted advertising can count as “selling” or “sharing” personal information; section 5 explains how to opt out.

Third parties receiving personal information must provide at least the protection described in this policy and required by applicable rules. We may also disclose information when required by law, when necessary to protect legal rights and safety, or as part of a merger, acquisition, or sale of assets, subject to this policy.

5. Your Choices

• Permissions: manage camera, photos, and notifications in your device’s Settings for Avella. Camera or photo access is needed for skin scans.
• Tracking: on iOS, allow or decline tracking across other companies’ apps and websites through the system prompt or Settings → Privacy & Security → Tracking. Tracking permission is not required for core features.
• Targeted advertising: to opt out of targeted advertising and the “sale” or “sharing” of your personal information, decline tracking and email support@uselumeskin.com with the subject “Opt out of targeted advertising”. We will stop using your contact details for advertising matching.
• Notifications: turn off push notifications at any time in your device settings.
• Website: avellaskin.app does not use advertising or analytics cookies.

Contact us to withdraw consent for other consent-based processing or to get help with privacy choices. Withdrawal does not affect earlier lawful processing. Changing permissions does not by itself delete information already collected.

6. Retention and Deletion

We retain information for as long as needed for the purposes described here, subject to the limits in section 3. Retention depends on the information, your account and service use, support and security needs, and legal recordkeeping obligations.

Delete your account in Avella through Settings → Delete Account. This deletes your account and the profile, photos, scans, progress, and routines stored with it. You can also email support@uselumeskin.com to request deletion of your account or any remaining personal information, including information held by our service providers. Requests may require identity verification and manual processing. We will explain any additional time needed and any information that must be retained by law. Deleting the app from your device does not delete your account.

Account deletion does not automatically cancel an Apple subscription; manage cancellation through the App Store.

7. Privacy Rights and Complaints

Depending on where you live, you may request access to, correction of, deletion of, or a portable copy of your information; object to or restrict processing based on legitimate interests; opt out of targeted advertising and the “sale” or “sharing” of personal information; limit the use of sensitive information; and withdraw consent. Send requests to support@uselumeskin.com. You may use an authorized agent where the law allows; we may need to verify your identity and the agent’s authority. We will not discriminate against you for exercising your rights. If we decline a request, you can appeal by replying to our response. EU/UK rights requests are generally handled within one month, with any permitted extension explained to you.

You can object to direct marketing, including related profiling, at any time by contacting us.

Send privacy complaints to the same address. We acknowledge complaints within 30 days and investigate, provide updates, and communicate the outcome without undue delay. You may also complain to your local data protection authority, including the UK Information Commissioner’s Office or the authority in your EU country of residence or work.

8. International Processing and Security

Information may be processed in the United States and other countries where we or our providers operate. Where EU/UK transfer rules apply, appropriate safeguards are required, such as an applicable adequacy decision or approved contractual safeguards. Contact us for details about transfers or a copy of applicable safeguards.

We use technical and organisational measures, including access controls and encryption in transit, to protect information. No storage or transmission method is completely secure.

9. Children

Avella is not intended for children under 13, and we do not knowingly collect their information. Contact us if you believe we have collected a child’s information so we can investigate and take the required action, including deletion.

10. Policy Updates

We update this page and its date when our practices change, and provide additional notice or request consent for material changes where required by law.

11. Contact

For privacy questions, requests, or complaints, email support@uselumeskin.com.