Privacy Policy

Vessa is an iPhone app that scans your face, scores your skin and builds a skincare routine. This policy covers the app and this website. Vessa decides how the data described here is used, and can be reached at support@vessa.care.

It is written to be read. Where a term has a legal meaning — “processing”, “controller”, “legitimate interests” — it carries that meaning under the GDPR and equivalent laws.

Only what the app needs to do its job. There is no advertising SDK and no third-party analytics.

Account

Your email address, or the private relay address Apple gives us if you use Sign in with Apple. A display name if you set one.

Skin profile

Your onboarding answers: skin type, sensitivity, concerns, goals, age range, sex, whether you are pregnant or breastfeeding, skin tone, experience level, budget, prescription actives and known conditions. The pregnancy and prescription answers exist to keep unsafe ingredients out of your routine.

Face scans

The photo you take, the nine scores derived from it and the written summary. Only your most recent scan photo and AI portrait are kept in storage — a new scan replaces the previous image — while the scores stay so your progress chart has a history.

Product scans

Photos of products you scan and what the model read from them: name, brand, category, price and ingredients.

Your shelf

The products you own or save, and the routines generated from them, including which steps you check off each day.

Chats

Your messages to Vessa AI, its replies, and short notes it keeps about what you agreed — for example that retinol is Tuesday and Friday.

Location

Only the city you pick for weather, and the weather fetched for it. Vessa does not track your position.

Notifications

The push token of each device you allow notifications on.

Subscription

Whether you have an active subscription, which product, and when it renews or expires. Apple handles the payment; Vessa never sees your card.

Technical

Counts of AI requests, used for rate limits and for spotting failures. Server logs may hold an IP address briefly.

• To provide the app — scanning, scoring, routine generation, chat and progress are the service you asked for. Without this data there is no product (GDPR Art. 6(1)(b), performance of a contract).
• With your consent — the camera, your photos and your skin and health answers are only processed because you chose to take a scan and answer them. You can withdraw consent by deleting the data or your account (Art. 6(1)(a), and Art. 9(2)(a) for health-related answers).
• To keep it working and fair — rate limits, abuse prevention and crash-level logging (Art. 6(1)(f), legitimate interests).
• To meet obligations — tax and consumer-law records for purchases (Art. 6(1)(c)).

Vessa is a small operation and uses established providers rather than running its own infrastructure. Each one only receives what it needs.

Supabase

Database, authentication and photo storage. Your data lives in Frankfurt, Germany (EU).

OpenAI and xAI

The models that read a scan, identify a product, write a routine and answer in chat. Your photo and the relevant parts of your profile are sent for that request. These providers process data in the United States under the European Commission's standard contractual clauses.

Apple

Sign in with Apple, App Store purchases and the delivery of notifications.

RevenueCat

Keeps track of whether your subscription is active.

Expo

Delivers push notifications to your device.

Open-Meteo

Returns the weather for the city you chose. It receives the location, not your identity.

Nobody buys this data, and it is not sold, rented or handed to advertisers. It is not used to train anyone's general-purpose AI models.

The database and the photo storage are hosted in Frankfurt, Germany (EU). Every table is protected by row-level security, which means your rows are readable only by your signed-in account. Photos sit in a private bucket and are served through short-lived signed links — there is no public URL for anyone to guess.

• Scan photos and your AI portrait: the latest one only. Taking a new scan overwrites the previous image.
• Scores, routines, shelf and chats: kept while your account exists, so your history and progress make sense.
• Purchase records: kept as long as tax and consumer law requires, even after an account is deleted.

Delete everything from inside the app. Profile → Delete account removes your account and, with it, your photos, scans, routines, shelf, chats and notes. It is immediate and cannot be undone.

You also have the right to a copy of your data, to correct it, to restrict or object to its use, and to complain to your national data protection authority. Email support@vessa.care and you will get an answer within 30 days.

Notifications can be turned off in iOS Settings at any time, and camera access can be revoked there too — scanning simply stops working until you grant it again.

Vessa is rated 12+ and is not intended for children under 13, or under the minimum age of consent where you live if that is higher. If you believe a child has created an account, email support@vessa.care and it will be deleted.

When this policy changes, the date at the top changes with it. If a change materially affects how your data is used, the app will tell you before it takes effect rather than relying on you to re-read this page.