Privacy Policy

1. The short version

If you read nothing else, read this:

• Vella Studio is an AI-powered makeup and color analysis app. To work, it sends photos you choose to upload to third-party AI services for processing.
• The AI providers we share photos with are Google (image generation), OpenAI (analysis), and Replicate (cloud infrastructure). We name them explicitly because you deserve to know.
• We don't store your photos on our servers. Photos stay on your device. They are sent to AI providers only when you actively use a feature, and discarded after processing.
• We don't sell your photos or train AI on them. Ever.
• You can revoke AI permissions any time in Settings → Privacy & AI.
• You can delete your data in the App via Settings → Delete my data (this deletes your anonymous server profile and resets the App). You can also contact us. Uninstalling alone may not delete server-side records.
• Analytics and ads measurement: We use product analytics (Amplitude) and a mobile measurement partner (AppsFlyer) to understand installs, usage, and marketing performance. On iOS, IDFA-based tracking requires your App Tracking Transparency permission. On Android, AppsFlyer may use the Google Advertising ID where permitted. We do not show third-party banner ads inside Vella Studio. See Sections 6 and 7.

The full details are below.

2. Who runs Vella Studio

LSA Management (Services) Australia Pty Ltd is the legal entity responsible for Vella Studio and is the "data controller" under applicable privacy laws including the Australian Privacy Act 1988, the EU General Data Protection Regulation (GDPR), the UK GDPR, and the various US state privacy laws (CCPA, VCDPA, CPA, CTDPA, UCPA).

3. Data we collect

3.1 Photos and images you upload

When you use Vella Studio's AI features, you choose photos to upload from your device — typically selfies, makeup photos, or inspiration images. These are the most sensitive data we handle.

• Selfies (no makeup): Used for color season analysis and as the base image for AI-generated makeup looks.
• Makeup photos: Used by Roast Mode to provide AI feedback on your makeup application.
• Inspiration images: Used by the "Recreate Any Look" feature to match a reference look to your features.

We treat photos as biometric-adjacent data and apply additional safeguards even where the law does not strictly require it.

3.2 Profile and preference data

You may provide the following information during onboarding or in Settings:

• Skin type, age range, makeup style preferences, climate, daily routine pace, makeup budget
• Selected color season (after AI analysis) and selected makeup looks
• Settings preferences (e.g., notifications, AI consent state)

Preference answers are stored primarily on your device. We also create an anonymous guest account on our servers (tied to a device-based identifier) so features like AI processing and subscriptions can work across sessions. Product analytics events may include preference-related funnel signals without your photos.

3.3 Subscription and purchase data

When you start a free trial or subscribe, the transaction is handled by the store you used:

• Apple App Store (iOS) or Google Play (Android) for in-app subscriptions
• In some cases, a web purchase redeemed into the App (managed via RevenueCat / Stripe)

Through RevenueCat we receive:

• Anonymous purchase identifiers and receipt / purchase-token validation
• Subscription status (active / trial / expired / cancelled)
• Product information (which subscription tier you bought)

We do not receive your name, email, payment card, or billing address from Apple or Google. Your payment information stays with the applicable store (or web payment processor, for web purchases).

3.4 Device, usage, and diagnostic data

To make the app work and improve it, we collect:

• Device model, operating system version, app version
• Anonymous device / guest identifiers (including AppsFlyer device ID and RevenueCat anonymous IDs)
• App opens, feature usage, session duration (Amplitude)
• Crash reports and error logs (Bugsnag) — not your facial photos
• Approximate (coarse) location, derived from IP address — used primarily to localize responses; measurement partners may receive IP-derived region signals as described in Sections 6–7
• iOS: advertising / device identifiers for measurement (for example IDFA / IDFV) — IDFA only if you allow tracking under App Tracking Transparency
• Android: Google Advertising ID (GAID) and related device signals used by AppsFlyer / RevenueCat for attribution, where permitted by Google Play policies and your device settings

3.5 Generated content

AI features produce outputs such as: color season analyses, makeup descriptions, after-images of your face with AI-applied makeup, and roast-mode feedback. These outputs are linked to your input photos and stored locally on your device. They are not transmitted to our servers.

3.6 Push notifications token

If you enable notifications, Firebase Cloud Messaging issues an anonymous device token so we can send you reminders, feature announcements, or important updates. You can disable notifications at any time in your device settings (iOS or Android) or in the App where available.

3.7 Data we do not collect (and what we don’t use it for)

• We do not require or collect your name, email, phone number, or address (unless you contact us by email).
• We do not collect contact lists, social graph, or messages.
• We do not display banners, interstitials, or other third‑party advertisements inside the App.
• On iOS, we do not access Apple's Identifier for Advertisers (IDFA) unless you approve App Tracking Transparency — you can change that choice anytime in Apple Settings → Privacy & Security → Tracking.
• On Android, you can limit ad personalization / reset your Advertising ID in Google settings; that affects how advertising identifiers may be used for measurement.
• Aside from anonymized analytics and AppsFlyer attribution described in Sections 6 and 7, we don’t observe your browsing or activity in other unrelated apps.
• We do not collect precise GPS location.

4. How we use AI (and which providers)

Vella Studio's core features rely on artificial intelligence. We are transparent about exactly which AI providers we use, what data is shared, and why.

4.1 Google (Gemini and image generation models)

4.2 OpenAI

4.3 Replicate

4.4 What we explicitly don't do with your photos

• We don't sell your photos. Not to AI providers, not to advertisers, not to anyone.
• We don't use your photos to train AI models. We use commercial API tiers that contractually exclude training use.
• We don't store your photos on our servers. Photos pass through our backend only briefly while being relayed to the AI provider, and are not persisted.
• We don't share your photos with anyone except the AI providers listed above. Not advertisers, not data brokers, not analytics providers.
• We don't use facial recognition for identification. The AI does not match your face to any identity database. It only analyzes visual properties (skin tone, undertones, features) for makeup purposes.

4.5 Your control over AI processing

Before the first time the App sends a photo to any AI provider, we show you a consent screen explaining what will happen. You must tap "I agree, continue" for any AI processing to occur. If you decline, no photos will be sent to AI providers, but you will not be able to use the AI features.

You can revoke this consent at any time by going to Settings → Privacy & AI → Revoke AI permissions. After revocation, no further photos will be sent to AI providers until you grant consent again.

4.6 Automated decision-making

Vella Studio's AI features make automated decisions (e.g., classifying you as a "Soft Autumn" color season, recommending specific makeup shades). These decisions are not legally significant — they are aesthetic recommendations, not credit, employment, insurance, or housing decisions. You can disregard any AI output, request a different result, or stop using the app at any time.

5. How we use your data

We use the data described above only for the following purposes:

• Provide the App's features: Generate AI Glow Ups, perform color analysis, run Roast Mode, save your preferences.
• Manage your subscription: Validate purchases, restore purchases, deliver paid features to subscribers.
• Improve the App: Analyze aggregate, anonymized usage patterns to identify bugs and prioritize features.
• Send you essential communications: Push notifications about features you opted into, transactional messages about your subscription, reminders.
• Comply with legal obligations: Respond to lawful requests from authorities, defend our legal rights, prevent fraud or abuse.
• Measure advertising effectiveness: We use AppsFlyer (our mobile measurement partner) and, where linked, RevenueCat to send app events — such as installs, opens, completions, subscriptions, or purchases — so we can attribute installs to marketing campaigns (for example ads on Meta or TikTok) and optimize spend. This does not show ads inside the App. On iOS, IDFA-based cross-app measurement requires App Tracking Transparency permission where applicable.

We do not use your data for behavioral profiling for marketing unrelated to attributing campaigns you’ve seen nor for any purpose unrelated to providing or improving the App.

6. Third parties we share data with

Beyond the AI providers listed in Section 4, we share limited data with the following service providers as necessary to operate the App:

6.1 Apple Inc. (App Store) and Google LLC (Google Play)

What: Subscription / in-app purchase transactions, store receipt or purchase-token validation, app distribution. Apple or Google may also provide crash or usage diagnostics if you opted into sharing analytics with developers in your device settings.

Apple Privacy Policy: https://www.apple.com/legal/privacy/

Google Privacy Policy: https://policies.google.com/privacy

6.2 RevenueCat, Inc.

What: Subscription state management, receipt / purchase-token validation, anonymous user identifiers tied to your subscription. RevenueCat may collect device identifiers (including advertising IDs where permitted) and is linked to AppsFlyer so subscription events can be attributed to the correct install.

Privacy Policy: https://www.revenuecat.com/privacy/

6.3 Google (Firebase Cloud Messaging)

What: Firebase Cloud Messaging (FCM) delivers push notification tokens/messages between our backend and Apple’s / Google’s push gateways. Notifications are transactional (e.g. reminders, product updates).

Privacy Policy: https://firebase.google.com/support/privacy

6.4 Bugsnag (SmartBear monitoring tools)

What: Crash and error telemetry (logs, stack traces, device/OS/app version identifiers) — not your facial photos.

Privacy Policy: Bugsnag / SmartBear Privacy Policy

6.5 Amplitude Inc.

What: Anonymous product analytics — feature usage, funnel events, session lengths. Photos are not sent to Amplitude.

Privacy Policy: https://amplitude.com/privacy

6.6 AppsFlyer Ltd. (mobile measurement / attribution)

What: AppsFlyer is our mobile measurement partner (MMP). The AppsFlyer SDK collects in-app events — for example installs, sessions, completions, subscriptions, and purchases — plus device and network metadata used for attribution (including AppsFlyer device ID). On iOS, IDFA may be included when you allow App Tracking Transparency. On Android, the Google Advertising ID (GAID) and related signals may be used where permitted. Purchase / subscription events are also relayed via our RevenueCat ↔ AppsFlyer integration so renewals can be attributed without double-firing from the client.

Important: This is not an in-app advertising network and does not show third-party ads inside Vella Studio. AppsFlyer attributes installs to marketing campaigns you may have seen externally (for example on Meta or TikTok) and may share attribution / conversion signals with those advertising partners and with us for ROI reporting.

If you deny tracking on iOS, AppsFlyer continues in limited / aggregated measurement modes consistent with Apple’s rules and AppsFlyer’s documentation. On Android, limiting ad personalization or resetting your Advertising ID in Google settings may reduce identifier-based attribution.

Purpose: Measure installs and ROI from marketing campaigns, attribute conversions, improve media spend efficiency, and support fraud prevention for installs.

Privacy Policy: https://www.appsflyer.com/legal/privacy-policy/

6.7 Sales, brokers, and in-app advertisements

We don’t rent your identifiable profile to brokers. The App remains free of invasive third‑party banners. Partner SDKs described above—including AppsFlyer measurement—receive only the categories of telemetry each policy section lists.

7. Advertising measurement (iOS & Android)

7.1 iOS — App Tracking Transparency (ATT)

Apple requires apps to obtain permission before accessing the Identifier for Advertisers (IDFA) for cross-app measurement. During onboarding we may present an educational pre-prompt explaining why opt‑in matters, followed by Apple's system ATT dialog if tracking is still not determined.

• If you tap “Allow” on Apple’s prompt: AppsFlyer (and linked partners such as RevenueCat) may use the IDFA alongside other event data described in §6.6 for attribution.
• If you tap “Ask App Not to Track” or bypass the measurement prompt (“Not now”): We do not obtain IDFA via ATT at that moment; AppsFlyer relies on aggregated or limited attribution paths without IDFA.
• To change IDFA permission later: Open iOS Settings → Privacy & Security → Tracking → toggle tracking for “Vella Studio”.

7.2 Android — Advertising ID

On Android, Google Play apps that use the Advertising ID must declare that use. Vella Studio’s Android build includes the Advertising ID permission because AppsFlyer (and RevenueCat device-identifier collection linked for attribution) may read the Google Advertising ID to measure installs and conversions.

• We use Advertising ID for attribution and analytics, not to show third-party ads inside the App.
• You can reset or limit your Advertising ID in your device’s Google settings (wording varies by Android version — look for ads / ad personalization controls).
• When you use Delete my data in the App, we may send your Advertising ID to help fulfill deletion / OpenDSR-style erasure requests with measurement partners where supported.

7.3 Relationship to store privacy disclosures

Vella Studio’s App Store binaries declare AppsFlyer-related tracking domains in Apple’s privacy manifest (for example att.attr.whappsflyer.com and related AppsFlyer ATT domains) alongside our App Privacy Questionnaire disclosures in App Store Connect. On Google Play, our Data Safety form discloses collection and sharing consistent with this policy, including Advertising ID where applicable.

8. Where data is stored and for how long

8.1 On-device storage (your phone)

Most of your data — photos, generated images, color analysis results, makeup preferences, subscription cache — is stored locally on your device. We do not maintain a full copy of this media on our servers. If you uninstall the App, on-device data is removed with it; use Delete my data (or contact us) to request deletion of anonymous server-side records.

8.2 Backend processing (transient)

When you use an AI feature, your photo passes through our backend infrastructure (hosted on Google Cloud) on its way to the AI provider. The photo is held in memory only as long as needed to forward the request and is not written to persistent storage. We also store an anonymous guest profile needed to operate the service until you delete it.

8.3 AI provider retention

See Section 4 for each provider's specific retention period. In summary: Replicate (~1 hour), OpenAI (up to 30 days), Google (up to 30 days). After these periods, the data is deleted by the provider.

8.4 Analytics, attribution, and crash data

Anonymous analytics (Amplitude), error telemetry (Bugsnag), AppsFlyer measurement events, plus campaign / subscription attribution records are retained per each vendor’s schedules (typically 14–24 months for analytics backends unless deprecated earlier). AppsFlyer aggregates or deletes attribution data pursuant to its retention policies disclosed in AppsFlyer’s documentation.

8.5 Subscription records

Subscription transaction records are retained as required by tax and accounting law (typically 7 years in Australia).

9. Your rights and choices

Depending on where you live, you have rights under the Australian Privacy Act, EU/UK GDPR, CCPA, and other privacy laws. Globally, we offer the following choices to all users:

9.1 Within the App

• Delete my data: Settings / Profile → Delete my data — permanently deletes your photos, AI results, and anonymous profile from our servers (where stored), helps request erasure with measurement partners where supported, and resets the App. This does not cancel an App Store or Google Play subscription; manage or cancel that in the store’s subscription settings.
• Revoke AI consent: Settings → Privacy & AI → Revoke AI permissions
• View what AI providers do: Settings → Privacy & AI → How AI is used
• Delete generated content: Delete individual entries from your "My Looks" gallery (where available), or uninstall the App to remove locally stored media
• Disable notifications: Settings → Notifications (and/or your device notification settings)
• Disable anonymous product analytics: Settings → Privacy & AI → Anonymous analytics (toggle off), where available
• iOS measurement / ATT: iOS Settings → Privacy & Security → Tracking → disallow tracking for “Vella Studio”
• Android Advertising ID: Google settings → ads / ad personalization controls (reset or limit Advertising ID)

9.2 By contacting us

You can email info@mobisec.lk to:

• Request access to any personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data (right to erasure)
• Request portability — a machine-readable copy of your data
• Object to processing on legitimate-interest grounds
• Withdraw consent previously given
• Lodge a complaint with us before going to a regulator

We respond within 30 days for most requests. We may need to verify your identity before responding (typically by asking you to send a request from the email tied to your subscription, if applicable).

10. International data transfers

Vella Studio is operated from Australia, but our service providers—including AI partners and US-based measurement / analytics platforms such as AppsFlyer, Amplitude, RevenueCat, and Bugsnag—may process data internationally, primarily in the United States. When you use AI features, your photos are transferred internationally to AI providers as described in Section 4.

For users in the EU, UK, and other jurisdictions with cross-border data restrictions, transfers are protected by:

• Standard Contractual Clauses (SCCs) approved by the European Commission, where applicable
• UK International Data Transfer Agreement (IDTA) for transfers from the UK
• EU-US Data Privacy Framework certifications held by our US-based providers, where applicable
• Your explicit consent, where you have opted into AI processing knowing the providers are US-based

For users in Australia, transfers comply with Australian Privacy Principle 8 (cross-border disclosure) — we take reasonable steps to ensure overseas recipients handle your data consistent with the Australian Privacy Principles.

11. Region-specific rights

11.1 Australia (Privacy Act 1988 & APPs)

If you are in Australia, you have rights under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. You can:

• Access and correct your personal information
• Make a complaint to us, then to the Office of the Australian Information Commissioner (OAIC) if unresolved
• Opt out of receiving direct marketing communications

11.2 European Union (GDPR)

If you are in the EU, you have rights under the General Data Protection Regulation (GDPR), including:

• The right to access, rectification, erasure, restriction of processing, and data portability
• The right to object to processing based on legitimate interests
• The right to withdraw consent at any time
• The right to lodge a complaint with your national supervisory authority

Our legal bases for processing include: (a) your consent (including AI uploads and, where required, advertising measurement frameworks such as ATT); (b) performance of a contract (to deliver the subscribed App); (c) our legitimate interests (product improvement, attribution reporting at an aggregate level, fraud prevention).

11.3 United Kingdom (UK GDPR)

UK residents have substantially the same rights as EU residents under the UK GDPR. You may also lodge a complaint with the UK Information Commissioner's Office (ICO).

11.4 California (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act:

• Right to know: Request what personal information we've collected about you in the past 12 months
• Right to delete: Request deletion of your personal information (including via in-app Delete my data)
• Right to correct: Request correction of inaccurate personal information
• Right to opt out of sale or sharing: We don't sell covered information for money. Device identifiers may be disclosed to AppsFlyer and advertising partners for cross-context advertising measurement; on iOS you may opt out by withholding App Tracking Transparency authorization; on Android you may reset or limit your Advertising ID in Google settings, as explained in Sections 6 and 7.
• Right to limit use of sensitive personal information: The photos you upload may be considered sensitive personal information. We use them only to provide the AI features you requested.
• Right to non-discrimination: We will not deny services or charge differently because you exercised these rights.

Categories of personal information collected in the past 12 months (examples): Identifiers (guest UUID, AppsFlyer ID, advertiser IDs when permitted); commercial/subscription identifiers (via RevenueCat / App Store / Google Play); internet or electronic network activity (in-app telemetry, AppsFlyer attribution & Amplitude funnel events without photos); coarse geolocation (IP-derived locality); biometric-adjacent photos when you voluntarily run AI workflows; inferred preferences derived from uploads.

We do not knowingly collect personal information from California consumers under 16 without opt-in consent.

11.5 Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA)

Residents of these states have rights similar to California consumers:

• Right to access, correct, delete, and obtain a portable copy of personal data
• Right to opt out of “sale”, profiling, or targeted ads where applicable — we don’t monetize catalogs. If AppsFlyer attribution constitutes processing under local law, you may withdraw or limit permission using Apple Tracking controls, Android Advertising ID settings, and vendor policies referenced in Sections 7.
• Right to opt out of profiling that produces legally significant effects — Vella Studio's AI does not perform such profiling
• Right to appeal a denial of a privacy request — appeal decisions are made within 45–60 days depending on your state

11.6 Brazil (LGPD)

Brazilian residents have rights under the Lei Geral de Proteção de Dados Pessoais (LGPD), including access, correction, deletion, anonymization, portability, and the right to withdraw consent at any time. International transfers from Brazil are governed by LGPD-compliant mechanisms including standard contractual clauses and your explicit consent.

11.7 Other jurisdictions

If you are in a jurisdiction not specifically listed, you may still have privacy rights under your local law. Please contact us at info@mobisec.lk to exercise them and we will respond consistent with applicable law.

12. Children's privacy

Vella Studio is intended for users aged 17 and older. The App is rated for mature teens / adults on the Apple App Store and Google Play (exact rating labels may vary by store). We do not knowingly collect personal information from children under 13 (or 16 in the EU/UK, or other ages where applicable law sets a higher threshold).

If you are a parent or guardian and believe your child under the relevant age has provided us personal information, please contact us at info@mobisec.lk and we will promptly delete that information.

13. Security

We protect your data using industry-standard security measures, including:

• Encryption in transit: All communications between the App, our backend, and AI providers use TLS 1.2 or higher
• On-device storage: Most of your data never leaves your device
• Restricted server access: Backend infrastructure is access-controlled and audited
• No persistent server-side photo storage: Photos are not written to disk on our servers
• Vetted AI partners: We use only commercial-tier APIs with contractual data protection commitments

No system is perfectly secure. If we ever experience a data breach affecting your personal information, we will notify you and applicable regulators as required by law (typically within 72 hours under GDPR).

14. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Notify you within the App (e.g., a one-time banner or modal on app open)
• Where required by law, ask for your renewed consent

If you continue using the App after a change takes effect, you accept the updated policy.

15. Contact us