Privacy notice

Controller

The controller responsible for data processing in the Lashvue app and on this website is:

For privacy requests an informal e-mail to quizel.support@protonmail.com is sufficient. Further provider details are in the imprint (Impressum).

The essentials

• Lashvue is an iPhone app. There is no user account and no social login.
• Your full original photo, the face geometry, your library, comparisons, exports and optional appointment reminders stay on your device.
• For a personal AI preview, only a crop showing both eyes is uploaded. Capture data such as location (GPS) and other EXIF information is removed beforehand.
• The upload only happens when both conditions are met: your explicit AI consent and an Apple purchase verified by our server.
• The eye crop is a personal image and not anonymous. We treat it as image material that deserves protection.
• The processing chain is: app → Lashvue backend on Cloudflare → OpenRouter → pinned model endpoint. Contracts, processing locations and retention at the external providers still have to be confirmed before release; this is marked below wherever it applies.
• Lashvue contains no product analytics. Ad measurement with Meta only happens if you allow Lashvue to track in the iOS prompt – photos and eye crops are never part of it.

What stays on your iPhone

The app processes the following data locally only. Lashvue does not transfer it to our backend or to AI providers:

• your full original photo (from the camera or the system photo picker),
• the detection of face and eyes used for positioning. It runs on the device with iOS’s built-in tools; no recognition features are created and nobody is identified,
• the position of the eye crop within the full photo and the edit mask,
• drafts, finished previews, favourites, comparisons, notes and all exports,
• optional appointment reminders. They are scheduled as local notifications on the device; there is no calendar access and no server involved.

The app does not create a cloud gallery of its own and does not sync your library between devices. If you export an image to your photo library or pass it on via the share sheet, the settings and services you use yourself apply (for example your photo syncing).

The app only asks for the permissions a feature needs: camera for taking photos, adding to the photo library when saving, and notifications for reminders. For imports the app uses the system photo picker, so it only receives the images you select.

Connections that happen even without the AI feature

Even without AI consent and without a purchase, the app makes a few necessary connections. No photo and no image crop is transferred in the process:

• Public configuration: the app loads the style catalogue, maintenance status, minimum version and the current list of recipients from our backend.
• Pseudonymous installation: the app registers with a random installation ID. Our server issues a support ID (format “LL-…”) and short-lived access tokens for it. The ID is kept in your iPhone’s keychain. We do not ask for a name or e-mail address.
• App integrity: to protect against abuse, our server checks an integrity attestation issued for the app by Apple’s “App Attest” service.
• Offers and purchase status: the app retrieves the current subscription offers and your purchase status via Apple (StoreKit) and RevenueCat.

Each of these connections technically involves connection data, in particular your IP address, timestamps and the app version. We do not store full IP addresses in our own logs.

AI preview: what is transferred

The personal AI preview is a paid feature for adults. Before anything is transferred, the app shows you the eye crop, names the recipients and asks separately for your consent. This consent is not pre-selected and not bundled with other purposes. Our server checks consent and purchase entitlement itself – on upload and again when the job is created.

What is transferred

• an image crop showing both eyes in one shared image (JPEG or PNG, without GPS and EXIF information),
• your selection per variant: style, intensity and colour,
• the version of your consent and technical details of the job (for example a checksum and the image size).

Processing chain

1. The app sends the eye crop to the Lashvue backend. It runs on Cloudflare (Workers, D1 database, private R2 storage, Queues). The image storage is not publicly reachable.
2. Our backend sends the eye crop together with a style description defined by us to OpenRouter. There is no free-text input from you.
3. OpenRouter routes the request to exactly one pinned model endpoint. This is the model “google/gemini-3.1-flash-lite-image” via the endpoint “google-vertex/global” (Google Vertex AI). The operator approved this endpoint on 21 September 2026.
4. The result – an edited eye crop – is held temporarily in our private storage. The app downloads it, inserts only the lash area into your unchanged original photo on your device, and confirms local storage to our server.

What is not transferred

• your full photo, the face geometry and the position of the crop within the photo,
• name, e-mail address, location or contacts – the app does not collect these; the advertising ID is only used by the ad measurement with Meta, and only with your consent,
• installation, purchase or contact data to OpenRouter or the model provider.

If no endpoint is approved, or it is unavailable, the production environment refuses generation. A change of provider will be named here and in the consent screen in the app.

The page AI feature and recipients describes this in detail.

Purchases and subscription

“Lashvue Plus” is a subscription via Apple’s in-app purchase. Apple handles the payment; we receive no payment details such as card numbers and no information from your Apple account such as name or e-mail address.

• RevenueCat manages subscription status, offerings, restore and purchase events for us. For this, RevenueCat processes a random app user ID, purchase and transaction data from the App Store and technical information from the RevenueCat SDK.
• Our backend stores the linkage needed for access: store, environment, original transaction ID, subscription status, expiry date and the usage counters for the monthly limit of 16 new AI previews. Our server reads the status from RevenueCat rather than relying on what the app reports.
• The allowance belongs to the purchase account, not the device. That is why this linkage stays the same after reinstalling or restoring.

Which data fields the RevenueCat SDK transfers in detail and how long RevenueCat keeps them is governed by RevenueCat’s own information; we have not carried out a review of our own based on contract documents.

No product analytics

Lashvue contains no product analytics: no analytics endpoint, no usage events for us and no analytics SDK, and no session replay or screen recording either. The only SDK from an advertising provider is Meta’s SDK for ad measurement; without your consent it stays completely inactive (next section).

Separately, our server keeps operational and security metrics so that the service runs reliably and abuse is noticed: counts (for example jobs and errors), error codes and timestamps. These metrics contain no images and no full IP addresses.

Should usage analytics be added later, it would require a separate, voluntary opt-in and an updated privacy notice. The core feature and purchases would not depend on it.

Ad measurement with Meta (only with your consent)

Lashvue advertises on Facebook and Instagram. To learn which ads lead to installs and subscriptions, the app contains Meta’s SDK (module “FacebookCore”). It is configured to do nothing on its own: it does not start automatically, logs no events automatically and does not read the advertising ID. It only becomes active when everything comes together:

• you allow Lashvue to track in the iOS prompt (“App Tracking Transparency”, button “Allow”) – before it, the app explains on a page of its own, separate from the AI consent, what is measured; the choice is made in the iOS prompt, where “Ask App Not to Track” is just as easy,
• you have not switched measurement off in the app (Settings → “Ad measurement (Meta)”),
• a Meta app is configured in the app.

What is then sent to Meta

• that the app was installed and opened,
• that you started a subscription, with price and currency,
• technical device and app information the SDK sends along (for example device model, iOS and app version, language, time zone), and your IP address,
• your iPhone’s advertising ID (IDFA).

Never sent to Meta: photos, eye crops, looks, your choices, notes, your support ID or contact data.

Recipient and responsibility

The recipient is Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland. We and Meta are jointly responsible for collecting this data in the app and transmitting it to Meta (Art. 26 GDPR); Meta’s controller addendum is intended for this. What Meta does with the data afterwards – for example linking it to a Facebook or Instagram account and evaluating it for ads – is Meta’s sole responsibility; you can address requests about it directly to Meta. Meta may transfer data to the United States. We have not reviewed the basis for this ourselves; Meta’s privacy policy applies.

Legal basis, withdrawal, retention

The legal basis is your consent, which you give with “Allow” in the iOS prompt (Section 25(1) TDDDG for access to your device, Art. 6(1)(a) GDPR for the processing). You can withdraw it at any time in the app (Settings → “Ad measurement (Meta)”) or switch off tracking for Lashvue in iOS; from then on the app reports no more events to Meta, and from the next app start the SDK is no longer started. Processing carried out until then remains lawful. How long Meta stores the data is determined by Meta. Declining or withdrawing does not change what Lashvue can do.

Open before release Not yet confirmed: verification of the linked business portfolio, ad account and acceptance of the Meta Business Tools terms including the controller addendum, settings in Meta Events Manager, exact SDK data fields, transfer mechanism. Legal review pending.

Support by e-mail

When you write to us, we process your e-mail address, the content of your message and – if you provide it – your support ID. With the support ID, support only sees purchase and job status, timestamps and error codes, no photos. Please do not send us photos by e-mail; they are not needed to resolve technical problems.

The support mailbox is hosted by the e-mail service to which the address above belongs (protonmail.com). No fixed deletion period has been set for support e-mails; we delete them once your request is resolved and keeping them is no longer necessary.

This website

The website is a static site delivered via Cloudflare. It sets no cookies, uses no local browser storage, contains no scripts and embeds no third-party fonts, images, maps, videos or analytics services. There are no forms and no audience measurement.

When you visit, Cloudflare as the hosting provider processes the technically necessary connection data in order to deliver the page and fend off attacks – typically IP address, time, requested address, status code, amount of data transferred and information about browser and operating system. We ourselves keep no access logs for the website.

Links to other providers (for example to Apple) are plain links. Data is only transferred to the respective provider once you click them.

How long Cloudflare stores this connection data is determined by Cloudflare. We have not switched on any Cloudflare security features that would set a cookie.

Purposes and legal bases (draft)

Recipients

We only pass data to the services needed for operation. The rightmost column states openly what still has to be confirmed before release.

For ad measurement – only with your consent – Meta Platforms Ireland Ltd. is added (section “Ad measurement with Meta”). Meta receives no photos and no data from the AI feature.

If a provider in the AI processing chain changes, we re-examine the recipient list and the legal texts. Where required, the app asks for your consent again before anything is transferred.

Processing outside the EU and the EEA

Several of the services listed are offered by companies from the United States. Processing outside the European Union and the European Economic Area is therefore possible. The pinned model endpoint carries the label “global”; we therefore do not assume that processing is restricted to a particular region.

We do not claim exclusively European processing – not even where individual storage locations are in a European region. What matters is the entire chain including routing and the model provider.

We have not carried out a review of our own of the basis on which the individual recipients transfer data to third countries (for example an adequacy decision or standard contractual clauses) and which sub-processors they use. The linked information from the providers applies.

Retention and deletion

The following periods are the initial values of our own system.

Once a period has expired, our server blocks access immediately. Physical deletion is carried out by a clean-up run that runs at least hourly. With a 24-hour expiry, physical deletion can therefore take up to about 25 hours after the upload.

External providers

OpenRouter, the model provider, RevenueCat and Apple apply their own retention rules. Our periods above say nothing about how long these providers technically hold data. The goal for the AI chain is a configuration in which the provider does not store inputs and outputs (“zero data retention”) and OpenRouter does not log image content.

Our backend demands this configuration with every request, and OpenRouter refuses requests that do not meet it. We cannot verify ourselves which periods actually apply at the external providers, and we hold no assurance of our own from them.

Deleting data and withdrawing consent

In the app you can at any time delete individual projects, delete all local data, trigger the deletion of your data on our server and withdraw your AI consent (Settings → “Withdraw consent”, “Delete all data on this iPhone” and “Delete my server data”). Withdrawal applies to the future: uploads and new jobs are refused, and variants that have not started yet are cancelled. Processing carried out up to that point remains lawful.

Minimal purchase and allowance data remains separately for as long as it is needed for access and restoring purchases; we do not present it as deleted. Deleting data does not cancel a subscription. All routes, including without an internet connection or without access to the app, are described on the page Delete your data.

Your rights

Under the General Data Protection Regulation you have the right of access (Art. 15), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)).

Because there is no user account, we cannot find you in our systems by name or e-mail address. Please give us your support ID from the app (Settings → Support) when making a request; it is the link to your installation.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example where you live or work. The German Federal Commissioner for Data Protection publishes an overview of the German state authorities (in German): Kontakt zu den Landesbehörden.

For adults only

The personal AI feature and the purchase are intended exclusively for people aged 18 or over. The app asks for a simple self-declaration (“I am at least 18 years old”) – without ID and without a date of birth. Without this confirmation, the demo, style descriptions and legal information remain usable; upload and purchase are not offered.

The app does not estimate age or origin from your face. Please only use a photo of yourself and no photos of children or other people.

No automated decisions, no mandatory data

There is no automated decision-making with legal effect and no profiling (Art. 22 GDPR). The app does not rate your appearance, makes no diagnoses and gives no treatment recommendations.

You are not obliged to provide data. Without AI consent you can continue to use the app locally; the personal AI preview is then not available.

The local check of your photo (one face, both eyes visible, sharpness, light) only serves image quality and stays on the device.

Changes to this notice

We update this notice when the data processing changes – in particular when recipients, purposes or periods change. Version and date are shown at the top and bottom of this page. The app contains an offline copy that shows its version; when connected, it loads the current version from this website.