Try a look

Privacy

Updated November 5, 2026

Deleting your data

You can delete your account and everything stored with it at any time, yourself: in the app, open Profile and choose Delete account, or do the same in the web app at https://app.petalface.com. The account deletion page explains what is deleted and what is kept.

You can also ask us by email: write to support@petalface.com from the email address of your account. We delete the account within one month and confirm it to you.

Apple and Google keep their own records of App Store and Google Play purchases and of signing in with them. Ask them to delete those.

What this policy covers

This policy explains what Petalface collects, why, who helps us run it, and what you can do about your data. It covers:

Who is responsible

Petalface is run by Lucero Studio, Morlans, San Sebastián, Spain. We decide how your data is used, so we are responsible for it: the "controller" under the EU and UK GDPR.

Your data is yours. We use it only as this policy says.

Privacy questions and requests: support@petalface.com. Help with the app: support@petalface.com.

What we collect

What you give us

  • Your account: your email address, and a password if you set one. It is stored in a form we cannot read.
  • Your photos: the photos you upload to make a design, from your camera or your photo library: of your face, or of your hand for nails.
  • Pictures of a look to copy: in Copy a look, Copy a hairstyle and Copy a manicure, the second picture you add beside your own photo (a screenshot, a picture from a website or a magazine, or an example from the Ideas section). In the assistant, a photo you attach for it to take a look from is one of the photos you attach, below. A picture of a look may show another person.
  • Your words: what you type to describe a look or an occasion.
  • Your designs: the designs made for you, the tool, words and options you chose, and whether you liked or disliked a design or an idea.
  • Design notes: a short note under each design, written by an AI model, saying what changed and suggesting a next step.
  • The assistant (Pro): your messages, the photos you attach to them, and its replies.
  • Emails to us: what you write, and the details the app adds to a message you start from Contact us: the app version, your device model and system version, your app language and your account's email address.

Photos of your face and hands

The photos you add of yourself show your face or your hand. Like any photo of you, they can show things that are sensitive, such as your skin tone, which someone could link to your ethnic origin, or a head covering such as a hijab, which someone could link to your religion. We use them only to make the designs you ask for and to show them to you. We never use them to work out your ethnic origin, your religion, your health or anything else sensitive about you, we do not use them to identify you or to judge you, and we make no decision about you from them. We work out nothing from them but what the photo read below describes, and we never use them for anything else.

Pictures of a look to copy

A picture of a look to copy may show another person, even their face. Nothing is asked of that person, and we do not know who they are. We use the picture only to make your design: the instructions to the image model say to take the makeup, the hairstyle or the nails from it and adapt them to you, and not to take the other person's face or features. We do not use it to identify anyone, we make no face scan or other biometric template from it, and the photo read below never looks at it: the read looks only at your own photo, the one the design starts from.

The picture is stored like your other photos, in private storage that only your account can read, in the same folder as the rest of that design. It is sent to the image model, OpenAI's GPT Image, through OpenRouter or, while we finish moving, through WaveSpeed (all named under "The services we use" below), together with your photo, to make the design. We keep it until you delete the design or your account, as described under "How long we keep it" below; OpenAI's copy is kept for up to 30 days, as its entry below says. We do not use it for advertising or to train AI models.

For the person shown in such a picture, we rely on legitimate interests (GDPR Article 6(1)(f)): yours, in trying a look you have seen on someone, and ours, in offering it. We have weighed them against that person's rights: only their makeup, hairstyle or nails are used, never their face; the picture stays private to your account and is never published or shown to anyone else; and it is deleted with the design. That person can object, or ask us to delete the picture: they can write to support@petalface.com with what they know of it, such as the account that added it or the look it was used for. As Petalface does not recognise faces, we cannot search the pictures for a face, but we delete any picture that we find from what they tell us.

Add only a picture you are allowed to use. A photo from a magazine, a website or social media usually belongs to whoever took or published it. Petalface uses it only privately, to make your design, and never shows or publishes it, but making sure you may use it is up to you, as the terms say.

The photo read

Before it makes a design, Petalface has an AI model look at the photo the design starts from and describe how you look in it, in four short answers: your skin depth, your skin's undertone, your hair's texture, and whether your hair is covered (for example by a hijab, a scarf or a hat). From a photo of a hand, only the skin depth and undertone are used. Petalface puts these words into the instructions for the image model, only so that the design you asked for keeps your skin, your hair's texture or your head covering as they are, and changes only what you asked for.

  • It describes what the photo shows, nothing more. The read takes only what can be seen: the colour of your skin, the texture of your hair, and whether something covers it. It is never used to work out or record your ethnic origin, your religion or anything else about who you are, and no decision about you is made from it.
  • It is not kept. The words are never shown to you, never stored, never logged and never sent in a usage event: they exist only inside that one request, and are gone once the design is made. If the read fails, the design is made without them.
  • It does not recognise faces. Petalface makes no face scan, no faceprint and no other biometric template of you or anyone else, and it does not match your face against any other photo or any database.

Your photo may show your skin tone or a head covering, as any photo of you does, and Petalface uses the photo and the read only to make the design you asked for. We do this to provide Petalface to you, under our contract with you (GDPR Article 6(1)(b)). The AI model that reads your photo is reached through OpenRouter, named under "The services we use" below, like the one that writes the design notes.

Signing in with Apple or Google

You can sign in with your email and a password (confirmed with a code we email you), with Apple or with Google. If you use Apple or Google, we receive what they share with us for sign-in: an account identifier, your email address (with Apple, you can hide it behind a relay address) and, if they share them, your name and profile picture. We do not get your Apple or Google password, and we do not read anything else in those accounts.

What we collect automatically

  • Language and time zone: your app language and time zone. We use them to write emails, notifications and design notes in your language, and to know when your day starts for the daily limits.
  • Sessions and security logs: your sign-in session, your IP address and your device's browser or app information, which our database provider keeps in its sessions and security logs. An account can be signed in on one device at a time: signing in on a new device signs out the others.
  • Checks that calls come from the real app: to stop abuse, each call to our server functions carries a short-lived pass that shows it comes from Petalface. To get it, the web app runs a Cloudflare Turnstile check in your browser; on iPhone and iPad, Apple's App Attest makes a key on your device, and we keep its public part with your account; on Android, Google Play Integrity checks the app and the device. These checks see device and browser signals, never your photos.
  • Push tokens: a token for each device where notifications are on, linked to the sign-in session that registered it.
  • Plan and purchases: which plan you have, when it renews, and your purchase history. We never see your card details.
  • Daily counts: how many designs and assistant messages you used today, to apply the daily limits.
  • Crash reports: when the app crashes or hits an error, what went wrong, the app version, and the device and system version, with performance measurements and error logs. Reports carry your account's random identifier, never your email or name.
  • Usage data: how the app is used, for example which screens you open, which tools you try, and whether a design finished. These events carry your account's random identifier, the app version, the device and system version, and plain values such as a tool name. They never carry your email, your name, your photos or what you type. PostHog, which receives them, also gets your device's IP address with them, and discards it: it does not store IP addresses. Before discarding it, PostHog may work out an approximate location (such as the country and city) from it, and keeps only that. Usage data is on unless you turn it off: in Profile, turn off Share usage data, and the app records and sends no more usage events from that device.

What is stored on your device or in your browser

  • Sign-in and settings: the apps keep your sign-in session (encrypted) and your settings, such as your language and whether usage data is shared, on your device. The web app keeps them in your browser's storage. They are needed for Petalface to work.
  • Usage data: while Share usage data is on, PostHog keeps an analytics identifier and the usage events waiting to be sent: on your device in the apps, and in your browser's storage in the web app. Turn off Share usage data in Profile to stop it.

Petalface uses no advertising identifiers and no advertising or cross-app tracking tools, and it does not recognise faces. The web app sets no cookies of its own. The marketing website at https://petalface.com does use a cookie, to measure how it is used, and records visits (see "This website" below).

Permissions on your device

Petalface asks for these only when you use the feature that needs them. You can refuse, or change your answer in your device's settings.

  • Camera: to take a photo of your face or hand for a design.
  • Photo library: to pick photos for a design, through the system's photo picker, and to save designs to your photos.
  • Notifications: to tell you when a design is ready.
  • Network: to reach our servers. Petalface needs an internet connection.

How we use it

  • To provide Petalface (our contract with you): your account and sign-in, making designs and their notes, reading your photo as described above, the assistant, notifications you asked for, your plan, and its daily limits.
  • To answer you (our contract with you, or our legitimate interest in helping you): your emails and requests.
  • To keep Petalface working and safe (our legitimate interests): crash reports, fixing errors, preventing fraud and abuse, the checks that calls come from the real app, and the one-device sign-in rule.
  • To improve Petalface (our legitimate interest in learning how Petalface is used, with an easy way to say no): usage data. It is on from the start, and you can turn it off at any time: in Profile, turn off Share usage data. From then on, the app records and sends no usage data from that device.
  • To meet legal duties: for example keeping tax and accounting records, and answering lawful requests from authorities.
  • To tell you about Petalface: important changes to Petalface, these terms or this policy, by email or in the app.
  • If Petalface changes hands: in a merger, sale or reorganisation, the data passes to the new owner, who must keep this policy.

We do not sell your data. Petalface shows no ads, and we do not use your photos, designs or messages for advertising or to train AI models.

Who we share it with

We share data only with the companies below, who process it for us to run Petalface, and only what each needs:

  • Hosting, database and storage: Supabase and Cloudflare.
  • AI models: OpenRouter, for the assistant, the design notes, the photo read and the designs, and the companies that run the models behind it. They receive the photos, your messages and our instructions only to make the result and send it back. We ask OpenRouter to send the requests of the assistant, the notes and the photo read only to model providers that do not train on them or keep them for other uses; some keep them briefly to prevent abuse. OpenRouter sends designs only to OpenAI, which does not use them for training and keeps them for up to 30 days to check for abuse. While we finish moving, some designs are still made through WaveSpeed.
  • Payments: RevenueCat, Stripe, Apple and Google.
  • Crash reports and usage data: Sentry and PostHog.
  • Checks that calls come from the real app: Cloudflare, Apple and Google.
  • Notifications and email: Expo, Apple and Google for notifications, and Cloudflare for the codes and account emails we send you.

The full list, with what each does and its privacy policy, is under "The services we use" below. Apple and Google, as app stores and sign-in providers, handle data under their own privacy policies.

We may also share data when the law requires it, to protect people's safety or our rights, or with a new owner if Petalface is sold.

Petalface and this website link to other services, such as the App Store and Google Play. This policy does not cover them.

The services we use

  • Supabase (Supabase, Inc.): our database, file storage and sign-in. It holds your account, sessions, photos, designs, notes and chat messages. Privacy policy
  • WaveSpeed (WaveSpeedAI Pte. Ltd.): while we finish moving, some designs are still made through WaveSpeed. It runs the image model, OpenAI's GPT Image, that makes those designs. It receives the photos for a design and our instructions for the model, and returns the image. We use it only to make designs, and send it no account details. Under its terms, the photos and designs stay ours and it may use them to make the design; beyond that, it may use only aggregated, anonymised information about the use of its service, to improve it. Its terms say its service relies on other companies' offerings, so OpenAI, which makes the model, may also process them to make the image. Its privacy policy sets no fixed period for keeping them: it keeps data as long as it needs to provide its service, with backup copies for a limited time. Privacy policy
  • OpenRouter (OpenRouter, Inc.): connects the assistant, the design notes and the photo read to AI models, DeepSeek models for the assistant and the notes and a Google Gemini model for the photo read today, run by providers that OpenRouter picks among those that do not train on the data or keep it for other uses (some keep it briefly to prevent abuse). It also connects the designs to OpenAI's image model, and to no other company. It receives your messages, the photos and designs they are about, for a design's note the photo and the design, for the photo read the photo the design starts from, and for a design the photos and our instructions for the model. Prompt logging is off in our OpenRouter account, so for the assistant, the design notes and the photo read OpenRouter does not store your messages, photos or the replies. Privacy policy
  • OpenAI (OpenAI, L.L.C. and its affiliates): runs the image model, GPT Image, that makes the designs. We reach it through OpenRouter, so it receives the photos for a design and our instructions for the model, and returns the image, with no account details. It does not use them to train its models. It keeps them for up to 30 days to check for abuse, then deletes them, unless the law requires it to keep them longer or it needs them to deal with harm. Privacy policy
  • RevenueCat (RevenueCat, Inc.): manages purchases, subscriptions and the web checkout. It knows your account's random identifier and your purchases, and, for a web purchase, what you enter at its checkout. Privacy policy
  • Stripe (Stripe, Inc. and its affiliates): processes card payments on the web. Privacy policy
  • Sentry (Functional Software, Inc.): crash and error reports, stored in its EU region. Privacy policy
  • PostHog (PostHog, Inc.): usage data from the app while Share usage data is on, and visit counts and recordings of visits for this website. It discards IP addresses. Privacy policy
  • Expo (650 Industries, Inc.): sends push notifications to your device, through Apple and Google. Privacy policy
  • Cloudflare (Cloudflare, Inc.): hosts this website and the web app, runs the Turnstile check in the web app, and sends the codes (sign-up, password reset and password change) and other account emails, from noreply@petalface.com, through its Email Service. It handles your IP address to deliver the pages and protect them. For the emails, it receives your email address and the email it sends you, and keeps a record of their delivery; we have turned off its option to keep the emails for us to read. Privacy policy
  • Apple (Apple Inc.): Sign in with Apple, the App Store and its payments, App Attest, and notifications on Apple devices. Privacy policy
  • Google (Google LLC): Sign in with Google, Google Play and its payments, Play Integrity, and notifications on Android. Privacy policy

International transfers

Our providers may process data outside your country, including in the United States. When data leaves the EU, the UK or Switzerland, we rely on safeguards the law accepts, such as the European Commission's standard contractual clauses or an adequacy decision.

How long we keep it

We keep data only as long as we need it for the purposes above.

  • Account, photos, designs, notes and chat messages: until you delete them or your account. Deleting a design deletes its photos, including a picture of a look to copy, and its images. Start over in the assistant deletes your messages and their photos.
  • The photo read: it is not kept. The words it produces live only inside the request that makes the design.
  • Push tokens: until you sign out on that device or it stops receiving notifications. We keep the 20 devices you used most recently.
  • Crash reports: Sentry deletes them after at most 90 days (Sentry's retention periods).
  • Usage data: PostHog keeps usage events for 7 years, the retention period of our PostHog plan (PostHog's retention periods), then deletes them. They carry your account's random identifier, never your email or name.
  • Recordings of visits to this website: PostHog deletes them after 30 days.
  • Purchase records: RevenueCat's record is deleted with your account. Apple and Google keep their own records under their policies. We keep what tax and accounting law requires, for as long as it requires.
  • Emails to us: as long as we need them to help you, and as the law requires.

Security

We protect your data with encryption in transit, private storage for your photos and designs that only your account can read, and access limited to what each part of Petalface needs. In the iPhone, iPad and Android apps, your sign-in session is stored encrypted on the device. No system is completely secure, so we cannot promise that your data will never be accessed without permission. If a breach puts your data at risk, we tell you and the authorities as the law requires.

Your rights

Wherever you live, you can ask us to:

  • See the data we hold about you, and get a copy.
  • Correct it if it is wrong.
  • Delete it. You can delete your account yourself at any time.
  • Stop using it for usage data: turn off Share usage data in Profile.

Write to support@petalface.com from the email address of your account, so we know the request is yours. We answer within one month, and it is free unless a request is clearly unfounded or excessive.

In the EU and the UK

Under the GDPR you also have the right to:

  • Restrict our use of your data.
  • Object to uses based on our legitimate interests.
  • Receive your data in a portable format, or have it sent to another company.
  • Withdraw your consent at any time, where we rely on it.
  • Complain to the data protection authority where you live or work, or where we are established. We would like to hear from you first.

In California

Under the CCPA you have the right to know what personal information we collect, use and disclose, and why; to get a copy of it in a portable format; to correct it; and to delete it. You can ask twice in 12 months. We do not sell your personal information or share it for cross-context behavioral advertising, and we do not use sensitive personal information to infer things about you. We will not treat you differently, charge you more or give you a worse service for using these rights. You can ask through someone you authorise, and we may need to confirm who you are and that they may act for you.

Children

Petalface is not for anyone under 17, and we do not knowingly collect their data. Photos of a child may not be uploaded. If you believe a child uses Petalface or appears in a photo uploaded to it, write to support@petalface.com and we will delete the data.

Images made with AI

Designs, design notes and the example looks in the Ideas section are made by AI, and so are the people in the example pictures on this website: none of them is a real customer. On this website, every image made with AI is marked as made with AI in the image file. The main pictures also carry a visible "Made with AI" label, and the footer of every page says that its pictures are made with AI.

This website

This website uses cookies to measure how it is used, from the first page you open until you turn them off in Cookie settings at the foot of every page.

  • The tool: PostHog. Its cookie, `ph_…_posthog`, is set for this website's address only, so no other website or subdomain can read it, and PostHog keeps values named `ph_…` in your browser's storage. They hold a random identifier that recognises your browser when you come back, and the address of the first page you opened here and of the page that led you to it, with advertising click ids masked. The cookie expires 365 days after PostHog last wrote it.
  • What is recorded: the pages you open and the buttons you press that open the app. PostHog gets your IP address, works out your country and city from it, and discards the address.
  • Recordings of visits: PostHog also records what the page showed, how far you scrolled, where you moved the pointer and what you pressed. What you type is hidden. A recording spans the pages of a visit, is not linked to an account, and is deleted after 30 days.
  • Why: to see which pages people read, which buttons open the app and, in the recordings, what goes wrong on a page. This is our legitimate interest in learning how Petalface is used, with an easy way to say no.
  • Saying no: press Turn off in Cookie settings. PostHog then stops at once: it deletes its cookie and values, your browser keeps only your choice (`site.ad-choice` and `__ph_opt_in_out_…`), and recording stops. With Global Privacy Control on, the website starts off in the same way until you press Turn on, and with Global Privacy Control or Do Not Track on nothing is recorded, even after you press it. Visits are still counted, day by day, without a cookie and without an identifier kept in your browser. To count one browser once a day, PostHog makes a hashed identifier that changes every day from your IP address, your browser's user agent (the text naming its type and version), this website's address and the date, and it does not store your IP address or user agent with the visit. That count has no country or city.
  • How long, and what we cannot delete: PostHog keeps these events for the same period as usage events (see "Usage data" under "How long we keep it"), and recordings for 30 days. They carry your browser's random identifier, not your account's, so we cannot find them from your name or email address. Deleting your account, or asking us to delete your data, does not reach them, and a no does not undo what was already recorded.

Cloudflare, which hosts the website, handles your IP address to deliver the pages.

Changes to this policy

We may update this policy. The date at the top shows the latest version. If a change matters to you, we tell you in the app or by email before it applies.

Contact