Privacy Policy

Who we are

VÉL is a hair-analysis app ("we", "us"). This policy explains what information the app handles, where it goes, and the choices you have. It applies to the VÉL mobile app and the analysis service behind it.

The short version: your photos are analysed, not kept. Your scan history lives on your phone, not on our servers. We do not sell your data, we do not show ads, and we do not use your photos to identify you.

At a glance

• Photos you take for a scan are sent for analysis and are not stored on our servers.
• Your scan history and progress photos are stored only on your device.
• Your answer to the gender question never leaves your phone.
• We do not sell or share your personal information for advertising.
• We do not use facial recognition and never build a template that could identify you.
• You can delete your account and everything with it at any time, from Profile in the app — see "Retention and deleting your data".

Information we collect

We collect only what the app needs to work:

• Account details — your email address and, if you choose to give one, a name. Your password is never stored as written: we keep only a salted cryptographic hash (scrypt), from which the password cannot be recovered.
• Hair photos — up to five angles per scan, taken by you in the app.
• Quiz answers — your hair goals and history (for example concern, wash routine, colour and heat history). These shape your analysis and product suggestions. A copy is kept on your device so you are not asked the same questions every time you open the app.
• Sign-in session — while you are signed in, your email address, your name if you gave one, and a sign-in token are stored on your device. This is what lets the app remember you between launches instead of returning you to the introduction. Signing out or deleting your account removes it.
• Scan results — the scores, summary and suggestions the analysis returns.
• Purchase status — whether your account has unlocked paid features. This is handled and kept by the app store (Apple/Google) and our payments provider (Superwall), not stored on our own servers.
• Usage events — which screens you visit inside the app. These stay on your device in a small local log and are not transmitted to us or to any analytics company.
• Push notification token — if you allow notifications, the token Apple's or Google's push service assigns your device is stored on your account so we can deliver reminders and occasional messages to your phone. It identifies this app installation for delivery only and can't be used to identify you personally. It's removed if you turn notifications off for VÉL or delete your account.

How your photos are handled

When you run a scan, your photos travel over an encrypted connection to our server, which passes them to Anthropic (the AI provider that performs the analysis) and returns the result to your phone.

Our server does not keep your photos or your scan results. They are processed in memory and discarded once your result is returned. The copies you see afterwards — progress photos and scan history — are stored on your device only, and are removed if you delete the app.

Anthropic processes the photos as our service provider under its commercial API terms, which state that API inputs and outputs are not used to train its models.

The risk we cannot remove: for the seconds your photos are in transit and being analysed, they exist outside your phone — on our server and on our provider's. Keeping nothing afterwards makes the window small, but it is not zero, and you should know that before you press the shutter.

Biometric information

Some laws (for example in Illinois, Texas and Washington) regulate "biometric identifiers" — data like face geometry that can identify a specific person.

VÉL analyses the appearance and condition of your hair. We do not perform facial recognition, we do not create or keep any face-geometry or other biometric template, and we cannot and do not use your photos to identify you. We never sell, lease or trade biometric information — we do not have any.

You are always in control of capture: photos are only ever taken when you press the shutter, after you have chosen to start a scan.

Health-related information

A hair reading can include observations that some laws (such as Washington's My Health My Data Act and Nevada's Consumer Health Data Privacy Act) treat as consumer health data — for example an assessment of scalp condition.

For that data: we collect it from the photos and quiz answers you provide; we use it solely to produce your reading and suggestions; we share it only with Anthropic as the processor performing the analysis; we do not sell it or use it for advertising; and you may withdraw consent and have it deleted at any time, either from Profile in the app or using the contact below. Because results are stored on your device rather than our servers, deleting the app removes them.

Washington's My Health My Data Act and Nevada's Consumer Health Data Privacy Act each require certain disclosures regarding the use of "consumer health data." Those disclosures and related privacy rights can be found in our Consumer Health Data Privacy Policy.

VÉL is a cosmetic and general-wellness tool. It does not diagnose or treat any condition — see the Terms of Service.

What never leaves your phone

• Your answer to the gender question — used only to pick the outline drawn on the camera guide, and stripped from every request before it is sent.
• Your scan history and progress photos.
• The local usage log (screen views).

Third parties

We do not sell personal information, and no advertising or data-broker company receives anything from VÉL. The app touches these third parties, each for one job:

• Anthropic — performs the AI analysis of your photos and quiz answers, as our service provider.
• Amazon — product images in the app are loaded by your device directly from Amazon's image servers, which means Amazon may see your IP address, as with any image on the internet. Product links, where present, are affiliate links (see the Terms).
• Apple App Store / Google Play — handle payment and subscription management. We never see your card details.
• Superwall — our subscription platform. It processes your purchase directly against the app store's payment system, tracks your subscription status, and receives your account identifier so your entitlement and any paywall targeting follow your account across devices.
• Expo's push notification service — delivers reminders and messages to your device using the push token described above, if you have notifications on.
• FormKeep — receives and stores the email address you submit to join the waitlist on this website, as our form-processing provider.

Security

Traffic between the app and our server is encrypted in transit. Passwords are stored only as salted scrypt hashes. Access to the analysis service is gated by a key held by the app, and the server validates and limits every request. No method of transmission or storage is perfectly secure, but we design so that the most sensitive things — your photos and history — are not sitting on our servers to be breached.

Retention and deleting your data

Our servers retain only your account record: email, optional name, password hash, creation date, your account identifier from Apple (if you signed in that way), and your push token (if notifications are on). Photos and scan results are not retained server-side at all.

You can delete your account from inside the app: Profile, then Delete account. We ask you to confirm, and then it goes — your account record is removed from our servers, and your scan history, progress photos, saved sign-in session and settings are erased from this phone. None of it can be recovered, by you or by us.

Signing out is the lesser step and destroys nothing: it removes the saved session from this device so the app stops opening on your account, while your scan history and progress photos stay on the phone and reappear when you sign in again.

If you cannot reach that button — you have lost access to the phone, for instance — email privacy@velapp.co from the address on the account and we will delete the record for you. Deleting the app from your phone also removes everything stored on the device, but it leaves the account record standing; use the button or write to us if you want that gone too.

Your rights

Depending on where you live (for example under the GDPR in Europe and the UK, or the CCPA/CPRA in California), you may have the right to access the personal information we hold about you, correct it, delete it, receive a copy of it, object to certain processing, and not be discriminated against for exercising any of these rights.

Because we hold so little — an account record — most requests are simple. Deletion you can do yourself, immediately, from Profile in the app; for anything else email privacy@velapp.co and we will respond within the time the applicable law requires. We do not sell or share personal information as those terms are defined in the CCPA, so there is nothing to opt out of.

You can withdraw your consent at any time. Deleting your account withdraws it for everything we hold; you can also simply stop scanning, since nothing is collected unless you start a scan. Withdrawing consent means we can no longer provide the analysis, but it costs you nothing else.

US state privacy rights

If you live in California, Colorado, Connecticut, Delaware, Florida, Maryland, Minnesota, Oregon, Texas, Virginia or another US state with a comprehensive privacy law, this section lists the categories of personal information we have collected about you in the past twelve months, as those laws define the categories, and whether we actually collect each one.

• Identifiers (email address, account identifier, IP address) — collected.
• Records categories such as name and contact details — collected (email address; a name only if you choose to give one).
• Protected classifications, for example gender — asked in the app, but kept on your device only and stripped before any request reaches our servers; not collected by us.
• Commercial information, such as purchase or subscription history — not collected by us; held by the app store and by Superwall.
• Biometric information — not collected. We do not perform facial recognition and hold no biometric template of any kind.
• Internet or network activity — your IP address is used briefly for rate-limiting and abuse prevention; in-app usage events stay on your device and are never sent to us.
• Geolocation data — not collected. The app does not request location access.
• Audio, visual or sensory information, meaning the hair photos you submit — collected for analysis; not retained afterwards.
• Professional, employment or education information — not collected.
• Inferences, meaning your hair health scores, summary and product suggestions — collected.
• Sensitive personal information, meaning your account password and health-related information such as scalp condition — collected; see "Third parties" above for how it is used.

Exercising your US state rights

We have not sold or shared any personal information for cross-context behavioural advertising in the past twelve months, and do not intend to. We disclose personal information only to the service providers named under "Third parties" above, under contracts that limit their use of it to providing services to us.

Depending on your state, you may have the right to:

• know what personal information we have about you and how it has been used and disclosed;
• access and receive a copy of it;
• correct inaccurate information;
• delete it;
• opt out of the sale or sharing of personal information, or of profiling with legal effect — we do neither, so there is nothing to opt out of;
• not be discriminated against for exercising any of these rights;
• where the law allows it, designate an authorised agent to make a request on your behalf.

Other US privacy notices

To exercise any of the rights above, contact privacy@velapp.co. We will verify your identity before acting on a request, asking for no more information than that requires. If we decline a request, you may appeal by writing to the same address; we will respond in writing with the outcome and, where applicable, how to take the complaint further in your state.

California residents may also ask, once a year and free of charge, what personal information (if any) we have disclosed to third parties for their own direct marketing purposes in the past year. Because we do not do this, the answer today is none.

Some browsers and devices offer a "Do Not Track" signal. There is no accepted industry standard for how a service should respond to it, so — like most apps — we do not currently respond to DNT signals.

If you are in Canada

Our handling of your personal information is subject to the federal Personal Information Protection and Electronic Documents Act (PIPEDA). VÉL is not offered in Quebec.

Mena Shaker, Founder is accountable for our compliance with that Act. Reach them at privacy@velapp.co. If we do not resolve your concern, you may complain to the Office of the Privacy Commissioner of Canada.

PIPEDA lets us process personal information without consent only in narrow circumstances the law itself sets out — for example a legal obligation, a fraud investigation, or a court order — and we rely on that only where the law requires or allows it.

Alongside the rights described above, you have these:

• Access and correction — you can ask what personal information we hold about you and how it has been used, and have it corrected if it is wrong.
• Automated processing — your reading is produced entirely by an AI model, with no person involved in the result. You can ask us what information was used to produce it and the main factors behind it, and you can ask a person to review it.
• Breach notification — if a breach creates a real risk of significant harm to you, we will tell you and notify the Privacy Commissioner, and we keep a record of every such breach.
• Sensitive information — a hair and scalp reading is treated as sensitive, which means we ask for it plainly and use it only for the purpose you gave it for.

Children

VÉL is not directed at children and is not for anyone under 13 (or the higher minimum age your country sets for consenting to data processing). We do not knowingly collect personal information from children; if you believe a child has created an account, contact us and we will delete it.

International transfers

Our server and our AI provider process data in the United States. If you use the app from elsewhere, your photos and quiz answers are transferred there for the moments needed to produce your reading, under the safeguards described in this policy.

Information in the United States is subject to United States law while it is there, which means US courts and public authorities could in principle compel access to it. This is true of any service that processes data in another country; we mention it because you are entitled to know before you decide. What limits it here is how little there is to reach — your photos are not stored, and your history stays on your phone.

This website

Separately from the app, this website (the page you're reading now) collects one thing: if you join the waitlist, we store the email address you submit. It is collected and held by FormKeep, a third-party form service, and used only to notify you when VÉL is available and, occasionally, with launch updates — never sold, shared, or used for anything else.

We keep it until launch outreach is complete or you ask us to remove it, whichever comes first. To be removed, email privacy@velapp.co with the address you signed up with.

Changes to this policy

If we change what the app collects or how it is used, we will update this policy, change the date at the top, and — for material changes — tell you in the app before the change applies to you.

Contact

Questions, requests or complaints: privacy@velapp.co.