How the AI preview works

In short

• The personal AI preview is a paid feature (Lashvue Plus) and for adults only.
• Only a crop showing both eyes is transferred, without GPS and EXIF information – and only after your explicit consent and a verified Apple purchase.
• This crop is a personal image and not anonymous.
• Your full photo and the face geometry stay on the device.
• The result is a preview, not a diagnosis and not a promise of a result at a studio.

The flow, step by step

1. Checking the photo (on the device): the app checks locally whether exactly one face is visible, both eyes can be seen and sharpness and light are sufficient. Nothing is uploaded for this.
2. Creating the crop (on the device): the app creates one shared crop showing both eyes, removes capture data such as GPS and EXIF, and shows you the crop for confirmation.
3. Consent and purchase: the app names the recipients and asks separately for your consent. Our server itself checks that consent and a verified purchase entitlement exist.
4. Upload: only now is the eye crop transferred to the Lashvue backend on Cloudflare and placed in private storage there.
5. Generation: for each look you chose, our backend sends the crop with a style description defined by us via OpenRouter to the pinned model endpoint. Each look is a separate request; you cannot enter free-text instructions.
6. Checks: our server checks the response technically (format, size, expected image content). The app additionally checks the eye geometry.
7. Compositing (on the device): the app takes only the lash area from the edited crop. All other pixels come from your original photo.
8. Clean-up: as soon as the app has confirmed local storage, our server deletes the result – and the uploaded crop once all variants have finished.

What is transferred – and what is not

To our backend

• the eye crop (JPEG or PNG),
• style, intensity and colour per variant,
• the version of your consent and technical details such as checksum and image size.

From our backend to OpenRouter and the model endpoint

• the eye crop,
• the style description defined on our server, with intensity and colour.

Not transferred

• the full photo, the face geometry and the position of the crop within the photo,
• installation, purchase or contact data to OpenRouter or the model provider,
• notes, favourites, exports or reminders.

Recipients in the processing chain

The table names each recipient and its role. The right-hand column shows what still has to be confirmed before release. We do not claim contracts, certifications or processing locations that have not been evidenced.

Cloudflare, OpenRouter and the model provider are involved in image processing. RevenueCat and Apple receive no photos; they are involved in purchases, subscription status and app integrity.

Model endpoint

For the AI preview, the model “google/gemini-3.1-flash-lite-image” via the OpenRouter endpoint “google-vertex/global” (Google Vertex AI) is pinned. The operator approved this endpoint on 21 September 2026 after image quality and cost had been tested with real requests. The approval concerns technical suitability. Contract documents, retention, exclusion of training and processing locations of the external providers are not confirmed by it; the status is shown in the recipients table.

• Our backend pins exactly one endpoint and allows no automatic rerouting to other providers.
• If no endpoint is approved, or the approved endpoint is unavailable, the production environment refuses generation instead of falling back to another route.
• A change of provider leads to updated recipient information and, where required, renewed consent in the app.

The same endpoint is named in the consent screen in the app.

Training on your images

Our own backend stores the eye crop only temporarily (see retention) and contains no function that collects user images for training models. Your consent to creating the preview is not consent to research or model training.

For the external providers: with every request to OpenRouter our backend demands routing without data retention (“Zero Data Retention”), excludes providers that collect inputs, and allows exactly one endpoint with no fallback route. The same requirement is additionally enforced in the OpenRouter account; OpenRouter refuses requests that do not meet it.

These are technical settings. We hold no contract documents of our own from OpenRouter or the model provider that rule out training. We therefore do not promise that no training takes place anywhere in the chain.

Retention

After expiry our server blocks access immediately; physical deletion follows with the next clean-up run, which runs at least hourly – so with a 24-hour expiry after up to about 25 hours.

How long OpenRouter and the model provider technically hold data has to be considered separately. The goal is a configuration without storage at the provider (“zero data retention”). According to OpenRouter’s public documentation, this does not rule out brief in-memory caching and the processing of technical metadata.

We cannot verify ourselves how long OpenRouter and the model provider actually keep data, and we hold no assurance of our own from these providers. All retention periods of our own systems are listed in the privacy notice.

Limits of the preview

• The preview is a visual approximation. The real result may differ; the professional assesses feasibility and suitability.
• There is no beauty rating, no diagnosis, no glue or treatment recommendation and no technical lash map with millimetre or curl specifications.
• In the first version only the upper lashes are changed. Lower lashes, eyebrows, eye shape and eye colour are meant to stay unchanged.
• Existing artificial lashes can impair the preview; the app does not promise reliable digital removal.
• The style names describe a visual effect, not a binding professional technique.

Quality checks and technical problems

AI models can make mistakes – for example change the eye shape or produce artefacts. That is why there is a double safeguard: outside the lash area the app always uses the pixels of your original photo. Inside the area it checks the geometry and does not show implausible results as a finished preview.

• Generations that fail for technical reasons do not count towards your monthly limit.
• For a technically unusable result you can report a technical problem in the app. Only an error code is transferred for this, no additional image. There is one repair attempt per result without additional counting.
• If the uploaded crop has already been deleted, a repair only starts if you explicitly upload the crop again. We do not secretly keep images longer in order to enable repairs.

Labelling as an AI preview

Results are recognisable as an AI preview in the app. Exports – comparison image, story card, short video and the reference card for your appointment – contain the note “AI preview”; the reference card additionally says “Visual inspiration, not a technical treatment instruction”. All exports are created locally, without another upload.

The labelling in the app is a product decision. It does not amount to a legal assessment of which statutory transparency and labelling duties apply to AI-generated images in detail.

Consent and withdrawal

The app obtains your consent before a crop is transferred for the first time. The iOS camera permission does not replace it. You can withdraw it at any time under Settings → “AI consent” → “Withdraw consent”. After that our server refuses uploads and new jobs and cancels variants that have not started yet. Your locally stored results are kept.

How to delete data is described on the page Delete your data.

No push notification when a result is ready

A job continues on our server even when you leave the app. The app uses no push service and therefore does not notify you when a result is ready. Open the app to see the status and load finished results.

Results are available for retrieval on the server for at most 24 hours.