Privacy Policy.

1. Data we collect

We try to collect as little personal information as possible. We do not ask for your name, email address, or password. The data we process falls into the following broad categories:

• Data generated by your use of the App. When you first open the App, an anonymous identifier is created for your device so we can save your generated images, coin balance, and subscription status. Photos you upload (including selfies and other photos of faces), the styling options and prompts you choose for AI generation, and the styled images produced are stored in the cloud so you can access them across sessions. If you choose to answer the optional onboarding questions (such as your style preferences, gender for content filtering, or where you heard about us), those answers are stored as anonymous analytics events.
• Photos and face data. The core of the App is processing photos you upload — including selfies that contain your face or the faces of others you have permission to use — to produce styled results such as color palettes, hairstyles, outfits, retouched photos, and professional headshots. These photos are sent to our cloud storage and to the third-party AI providers listed in section 4 for the sole purpose of generating your result. We do not use this imagery to identify you, to build a facial-recognition profile, or for any purpose other than producing the result you requested.
• Automatic usage data. Standard technical information (app version, operating system, device model, language, network metadata) and in-app events such as screens viewed and features used. Some in-App interactions may be recorded by our analytics provider — see the list of providers below and their privacy policies for details.
• Purchase data. When you subscribe or buy coins, the purchase is processed by the Apple App Store or Google Play and relayed to RevenueCat, which gives us your subscription status and coin balance. We do not see your payment card, bank details, or full billing address.
• Push notification token. If you grant notification permission, your device push token is stored so we can deliver the notifications you have enabled (for example, when your styled image is ready).

2. How we use this data

We use the data above to:

• Provide the core service — process your uploaded photos to generate the styled images you request, save your results, and track your coin balance and subscription.
• Diagnose bugs and errors and improve the App.
• Deliver push notifications you have opted into.
• Process purchases and manage subscriptions.
• Prevent abuse, enforce our content safety rules, and comply with legal obligations.

3. Legal basis for processing (EEA and UK users)

If you are located in the European Economic Area or the United Kingdom, we process your personal data on the following legal bases: performance of a contract (to deliver the App and its features, including processing the photos you upload), legitimate interests (to keep the App secure, diagnose issues, and improve the service), consent (for processing photos you upload — including face imagery — for AI styling, for iOS App Tracking Transparency, push notifications, and optional onboarding surveys, which you can withdraw at any time), and legal obligation (where we must retain records by law). Where the photos you upload are treated as special-category (biometric) data under applicable law, we rely on your explicit consent, given when you accept the in-app upload consent prompt before your first generation.

4. Third parties we share data with

We do not sell your personal data. Purchases are handled by the Apple App Store or Google Play — they process your payment and send us back only the information we need to unlock your subscription or coins. We never see your card or bank details.

Beyond that, we share limited data with the following service providers (sub-processors). Each is contractually bound to protect your data and to use it only for the purpose we specify:

• Firebase (Google) — anonymous authentication and identity.
• Cloudflare R2 — cloud hosting and storage of your uploaded photos and generated images.
• fal.ai — AI model provider that processes your uploaded photos and styling options to generate images. Your photos are sent to this provider only to produce your result.
• RevenueCat — subscription and in-app purchase status.
• PostHog — product analytics, including session replay of in-app interactions.
• Sentry — error and crash monitoring.
• Serper — web search used to power style and trend lookups.
• Expo, together with the Apple Push Notification service and Firebase Cloud Messaging — push notification delivery.

Our AI providers are contractually barred from using your uploaded photos or generated images to train their models, per their published API terms. We may add or replace sub-processors as the App evolves; for the current list, email elsaaisupport@gmail.com.

5. International data transfers

Our service providers may process your data — including the photos you upload — outside your country of residence, including in the United States. Where required by law, we rely on appropriate safeguards — including Standard Contractual Clauses where our providers use them — to protect your data during international transfers.

6. How long we keep data

We keep your data only as long as we need it for the purposes described above.

Your uploaded source photos and the styled images Elsa generates are stored on our cloud storage and kept until you delete the related item from within the App or delete your account. When you delete your account, your uploaded photos, generated images, and the anonymous user record tied to your device are deleted from our systems. Photos sent to our AI providers for processing are handled according to each provider's standard retention policy for API requests, after which they are deleted on the provider's side. Data held by our other service providers is retained according to each provider's standard retention policy and any applicable legal requirement.

You can email elsaaisupport@gmail.com at any time to request deletion of your data, or use the in-app data deletion option in Settings.

7. Your rights

Depending on where you live, you may have the right to access, rectify, delete, or restrict processing of your personal data (including the photos you have uploaded), the right to data portability, the right to withdraw consent (for example by deleting your uploaded photos, disabling App Tracking Transparency, or disabling push notifications in device settings), and the right to lodge a complaint with your data protection authority (in Türkiye: Kişisel Verileri Koruma Kurulu; in the EU: your national DPA).

To exercise any right, email elsaaisupport@gmail.com. Because Elsa uses anonymous authentication, please include enough information to help us locate your data — for example the anonymous user ID shown on the Settings screen, your device model, and the approximate date of first use. We respond within 30 days.

8. Data security

We use industry-standard measures to protect your data, including encryption in transit. Access to our systems is authenticated and limited. No system is perfectly secure; if we become aware of a breach that affects you, we will notify you where required by law.

9. Photos of other people

If you upload a photo that contains someone other than yourself, you confirm that you have that person's consent to upload their image and to have it processed by our AI providers to generate a styled result. Do not upload photos of other people without their permission, and never upload photos of children for editing.

10. Children's privacy

Elsa is an adults-only app intended solely for users aged 18 and over, and it is not directed to children. We do not knowingly collect personal information from anyone under 18. We also do not permit the App to be used to edit or generate styled images of children. If you are a parent or guardian and believe someone under 18 has used the App, email elsaaisupport@gmail.com and we will delete their data.

11. App Tracking Transparency (iOS)

On iOS, the App Tracking Transparency system prompts you before any cross-app or cross-website tracking occurs. If you decline, we do not track you across other companies' apps or websites. You can change your choice at any time in iOS Settings → Privacy & Security → Tracking.

12. Changes and contact

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the latest version, and material changes will be announced in the App or on this website before they take effect.

For any question, request, or complaint about this Privacy Policy, email elsaaisupport@gmail.com.