Privacy Policy

Who we are

VÉL is a hair-analysis app operated by VÉL [legal entity name to be confirmed] ("we", "us"). This policy explains what information the app handles, where it goes, and the choices you have. It applies to the VÉL mobile app and the analysis service behind it.

The short version: your photos are analysed, not kept. Your scan history lives on your phone, not on our servers. We do not sell your data, we do not show ads, and we do not use your photos to identify you.

At a glance

• Photos you take for a scan are sent for analysis and are not stored on our servers.
• Your scan history and progress photos are stored only on your device.
• Your answer to the gender question never leaves your phone.
• We do not sell or share your personal information for advertising.
• We do not use facial recognition and never build a template that could identify you.
• You can delete your account and everything with it at any time, from Profile in the app — see "Retention and deleting your data".

Information we collect

We collect only what the app needs to work:

• Account details — your email address and, if you choose to give one, a name. Your password is never stored as written: we keep only a salted cryptographic hash (scrypt), from which the password cannot be recovered.
• Hair photos — up to five angles per scan, taken by you in the app.
• Quiz answers — your hair goals and history (for example concern, wash routine, colour and heat history). These shape your analysis and product suggestions. A copy is kept on your device so you are not asked the same questions every time you open the app.
• Sign-in session — while you are signed in, your email address, your name if you gave one, and a sign-in token are stored on your device. This is what lets the app remember you between launches instead of returning you to the introduction. Signing out or deleting your account removes it.
• Scan results — the scores, summary and suggestions the analysis returns.
• Purchase status — whether your account has unlocked paid features (kept on your device; handled by the app store once payments are live).
• Usage events — which screens you visit inside the app. These stay on your device in a small local log and are not transmitted to us or to any analytics company.

How your photos are handled

When you run a scan, your photos travel over an encrypted connection to our server, which passes them to Anthropic (the AI provider that performs the analysis) and returns the result to your phone.

Our server does not keep your photos or your scan results. They are processed in memory and discarded once your result is returned. The copies you see afterwards — progress photos and scan history — are stored on your device only, and are removed if you delete the app.

Anthropic processes the photos as our service provider under its commercial API terms, which state that API inputs and outputs are not used to train its models.

The risk we cannot remove: for the seconds your photos are in transit and being analysed, they exist outside your phone — on our server and on our provider's. Keeping nothing afterwards makes the window small, but it is not zero, and you should know that before you press the shutter.

Biometric information

Some laws (for example in Illinois, Texas and Washington) regulate "biometric identifiers" — data like face geometry that can identify a specific person.

VÉL analyses the appearance and condition of your hair. We do not perform facial recognition, we do not create or keep any face-geometry or other biometric template, and we cannot and do not use your photos to identify you. We never sell, lease or trade biometric information — we do not have any.

You are always in control of capture: photos are only ever taken when you press the shutter, after you have chosen to start a scan.

Health-related information

A hair reading can include observations that some laws (such as Washington's My Health My Data Act) treat as consumer health data — for example an assessment of scalp condition.

For that data: we collect it from the photos and quiz answers you provide; we use it solely to produce your reading and suggestions; we share it only with Anthropic as the processor performing the analysis; we do not sell it or use it for advertising; and you may withdraw consent and have it deleted at any time, either from Profile in the app or using the contact below. Because results are stored on your device rather than our servers, deleting the app removes them.

VÉL is a cosmetic and general-wellness tool. It does not diagnose or treat any condition — see the Terms of Service.

What never leaves your phone

• Your answer to the gender question — used only to pick the outline drawn on the camera guide, and stripped from every request before it is sent.
• Your scan history and progress photos.
• The local usage log (screen views).
• Your notification preference — reminders are scheduled locally on the device; we hold no push token and cannot send you messages.

Third parties

We do not sell personal information, and no advertising or data-broker company receives anything from VÉL. The app touches these third parties, each for one job:

• Anthropic — performs the AI analysis of your photos and quiz answers, as our service provider.
• Amazon — product images in the app are loaded by your device directly from Amazon's image servers, which means Amazon may see your IP address, as with any image on the internet. Product links, where present, are affiliate links (see the Terms).
• Apple App Store / Google Play — handle payment and subscription management once paid features go live. We never see your card details.
• Formspree — receives and stores the email address you submit to join the waitlist on this website, as our form-processing provider.

Security

Traffic between the app and our server is encrypted in transit. Passwords are stored only as salted scrypt hashes. Access to the analysis service is gated by a key held by the app, and the server validates and limits every request. No method of transmission or storage is perfectly secure, but we design so that the most sensitive things — your photos and history — are not sitting on our servers to be breached.

Retention and deleting your data

Our servers retain only your account record (email, optional name, password hash, and creation date). Photos and scan results are not retained server-side at all.

You can delete your account from inside the app: Profile, then Delete account. We ask you to confirm, and then it goes — your account record is removed from our servers, and your scan history, progress photos, saved sign-in session and settings are erased from this phone. None of it can be recovered, by you or by us.

Signing out is the lesser step and destroys nothing: it removes the saved session from this device so the app stops opening on your account, while your scan history and progress photos stay on the phone and reappear when you sign in again.

If you cannot reach that button — you have lost access to the phone, for instance — email privacy@velapp.co.site from the address on the account and we will delete the record for you. Deleting the app from your phone also removes everything stored on the device, but it leaves the account record standing; use the button or write to us if you want that gone too.

Your rights

Depending on where you live (for example under the GDPR in Europe and the UK, or the CCPA/CPRA in California), you may have the right to access the personal information we hold about you, correct it, delete it, receive a copy of it, object to certain processing, and not be discriminated against for exercising any of these rights.

Because we hold so little — an account record — most requests are simple. Deletion you can do yourself, immediately, from Profile in the app; for anything else email privacy@velapp.co.site and we will respond within the time the applicable law requires. We do not sell or share personal information as those terms are defined in the CCPA, so there is nothing to opt out of.

You can withdraw your consent at any time. Deleting your account withdraws it for everything we hold; you can also simply stop scanning, since nothing is collected unless you start a scan. Withdrawing consent means we can no longer provide the analysis, but it costs you nothing else.

If you are in Canada

Our handling of your personal information is subject to the federal Personal Information Protection and Electronic Documents Act (PIPEDA). VÉL is not offered in Quebec.

[Privacy officer name and title to be confirmed] is accountable for our compliance with that Act. Reach them at privacy@velapp.co.site. If we do not resolve your concern, you may complain to the Office of the Privacy Commissioner of Canada.

Alongside the rights described above, you have these:

• Access and correction — you can ask what personal information we hold about you and how it has been used, and have it corrected if it is wrong.
• Automated processing — your reading is produced entirely by an AI model, with no person involved in the result. You can ask us what information was used to produce it and the main factors behind it, and you can ask a person to review it.
• Breach notification — if a breach creates a real risk of significant harm to you, we will tell you and notify the Privacy Commissioner, and we keep a record of every such breach.
• Sensitive information — a hair and scalp reading is treated as sensitive, which means we ask for it plainly and use it only for the purpose you gave it for.

Children

VÉL is not directed at children and is not for anyone under 13 (or the higher minimum age your country sets for consenting to data processing). We do not knowingly collect personal information from children; if you believe a child has created an account, contact us and we will delete it.

International transfers

Our server and our AI provider process data in the United States. If you use the app from elsewhere, your photos and quiz answers are transferred there for the moments needed to produce your reading, under the safeguards described in this policy.

Information in the United States is subject to United States law while it is there, which means US courts and public authorities could in principle compel access to it. This is true of any service that processes data in another country; we mention it because you are entitled to know before you decide. What limits it here is how little there is to reach — your photos are not stored, and your history stays on your phone.

This website

Separately from the app, this website (the page you're reading now) collects one thing: if you join the waitlist, we store the email address you submit. It is collected and held by Formspree, a third-party form service, and used only to notify you when VÉL is available and, occasionally, with launch updates — never sold, shared, or used for anything else.

We keep it until launch outreach is complete or you ask us to remove it, whichever comes first. To be removed, email privacy@velapp.co.site with the address you signed up with.

Changes to this policy

If we change what the app collects or how it is used, we will update this policy, change the date at the top, and — for material changes — tell you in the app before the change applies to you.

Contact

Questions, requests or complaints: privacy@velapp.co.site.