Privacy policy

Who we are

Boirelle is operated by Defo Labs LTD, the data controller for everything described here. For anything on this page, write to privacy@boirelle.com.

The short version

• There is no account. We do not ask for your name or your email.
• Your selfie is analysed and then discarded. We do not keep it.
• We never sell your data, and we never use your face to train anything.
• This marketing site sets no analytics or advertising cookies.

Your selfie

Before your photo leaves your device it is scaled down to 1024 pixels on its longest edge and re-encoded. That smaller version is sent over an encrypted connection to our analysis endpoint, where it is passed to a vision model, read, and then dropped. It is not written to a database, not written to object storage, and not retained after the request finishes.

Who else sees it

One party other than us processes your photograph: OpenAI, whose vision model performs the reading. The image is sent to their API over an encrypted connection, read, and returned as words. Under their API data usage policy, content sent through the API is not used to train their models, and is retained by them only briefly for abuse monitoring before deletion.

Nobody else receives it. It is not sold, not shared with advertisers, not given to data brokers, and not used to build a profile of you. There is no third-party analytics or advertising SDK in the app or on this site; the anonymous counts described below are our own, and identify no one.

Our own servers are in Germany, operated by Hetzner. OpenAI processes requests in the United States.

Third-party AI processing, in full

Because the reading is made by a third-party AI service, here is exactly what that involves.

• What is collected. The selfie you take or choose, and the language the app is set to. When you ask for a routine, the text of your reading and the occasion and time you picked. Nothing that identifies you — not your name, your email address, your Apple account or any identifier for your device — is sent to OpenAI.
• How it is collected. The photograph is scaled down on your iPhone to 1024 pixels on its longest side, then sent over an encrypted connection to our server, which forwards it to OpenAI. It is only ever sent after you have agreed to it on a screen in the app that sets all of this out, and only when you start a scan.
• Every use of it. To produce your skin reading and the routine written from it. It is not used for advertising, profiling, or training AI models, by us or by OpenAI, and it is used for nothing else.
• Who receives it. OpenAI, L.L.C., based in the United States, whose model performs the reading. Nobody else.
• How long it is kept. We do not store the photograph. We send it to OpenAI with response storage turned off. Under OpenAI’s API data usage policy, content sent through their API is not used to train their models and may be retained for up to 30 days to monitor for abuse, after which it is deleted.
• The protection it receives. OpenAI processes this data as our processor, on our instructions, under OpenAI’s Data Processing Addendum. It is protected to the same standard we apply to it ourselves: encrypted in transit, not used for any purpose of its own, not sold or shared, and deleted on the schedule above. Transfers to the United States rely on the Standard Contractual Clauses incorporated in that addendum.
• Your choice. Nothing is sent until you agree, and you can withdraw that agreement at any time from Account in the app. Once withdrawn, no further photograph is sent.

Face data

The app measures the angle of your head — how far it is turned, tilted and raised — so that a second scan can be taken from the same angle as the first. Two photographs taken at different angles cannot honestly be compared. It also locates the outline of the lips, eyes and cheeks so the try-on studio knows where to place a shade.

All of that happens on your device, using Apple’s Vision framework. Those measurements are never transmitted to us. Three numbers describing the angle are stored alongside the scan on your phone, and go when you delete the app.

We do not create a face template, a faceprint or any other biometric identifier. We do not perform face recognition, we cannot identify you from a photograph, and we never compare your face against anyone else’s.

What we do keep, briefly, is the result — the seven readings, the summary sentence, and whether the face in the photograph reads as feminine, masculine or neither, which decides whether the routine is written with colour cosmetics or with grooming. That last one is a guess made from a photograph, it is never treated as a statement about who you are, and it is used for nothing else. It is held in server memory for up to thirty minutes so that changing your occasion or your time budget does not require analysing the photo a second time. It contains no image. After thirty minutes it is gone.

On iOS, the app saves your session — the selfie, the reading and the routine — inside its own storage on your phone, so you can look back at it. That copy never leaves the device, is not synchronised to us, and is deleted when you delete the app.

On the web, your reading and routine are kept in your browser’s local storage so you can return to them. Your selfie is not. Clearing your browser data removes them.

What else we process

• An install identifier. The iOS app sends a per-install identifier so we can rate limit fairly. It is not an advertising identifier, it is not linked to you, and it changes if you reinstall.
• Your IP address. Used to rate limit and to keep the service standing up. Not used to profile you.
• Your language setting. So the routine comes back in a language you read.
• Payment records. See below — we never see your card.

Anonymous usage counts

The app counts, without identifying anyone, how many people reach each step: opening the app, signing in, seeing and answering the AI consent screen, sending a photograph, getting a reading, seeing a routine, seeing the purchase screen, and completing a purchase. It is how we find out where people give up, so we can fix that step.

Each count carries the name of the step and the language the app is set to, and nothing else. There is no account, no device identifier, no advertising identifier and nothing that links one step to another or to you. Our server resolves the country the request came from and then discards the address. The counts are kept as running totals — how many times a step happened — and never as a record of any one visit. They are not shared with anyone.

Cookies

This site sets three cookies, all first-party, and none of them are used for advertising or tracking. There are no third-party cookies at all.

• boirelle_lang — the language you chose from the picker, so you are not asked again and are not guessed at. Set only when you pick one. One year.
• boirelle_consent — what you answered about cookies, so we do not ask you twice. One year.
• boirelle_cid — a random string this browser makes up for itself, so a consent record can be matched to the answer that produced it. It is not linked to you, your account, or anything you do on the site. Two years.

When you answer the cookie notice we also send that answer to our own server and keep it for two years — the decision, the language you read it in, the page you were on, and the country the request came from. Consent is only valid if it can be shown to have been given, and that record is the showing of it. Your IP address is resolved to a country and then discarded; it is not stored.

Payments

Every purchase is made inside the iOS app and processed by Apple. Apple handles your card details directly — they never reach our servers. We receive only a confirmation that a payment succeeded and a reference for it.

Who else touches your data

• OpenAI — provides the vision model that reads the photo. The image is sent for that single request and is not used to train models.
• Apple — payments in the iOS app.
• Hetzner — runs the servers in Germany that the API answers from.

These are processors acting on our instructions. Nobody else receives your data, and we do not sell it to anyone under any circumstances.

Where your data goes

Processing may take place outside your country, including in the United States. Where that happens, transfers are covered by the appropriate safeguards, such as Standard Contractual Clauses.

Our legal basis

• Performing our contract with you — analysing your photo and building your routine is the thing you asked for.
• Legitimate interests — rate limiting and keeping the service secure and available.
• Legal obligation — keeping records of sales.

A photograph of a face can constitute biometric data where it is used to identify someone. Boirelle does not do that: it reads visible surface qualities of skin and features. It does not build a faceprint, it does not match you against any database, and it cannot recognise you in another photograph.

Your rights

You can ask us for a copy of your data, ask us to correct it, ask us to delete it, object to processing, or ask for it in a portable form. Write to privacy@boirelle.com and we will answer within one month.

Because there is no account, the fastest deletion is in your own hands: delete the iOS app, or clear this site's cookies from your browser. That removes everything held about you locally, and the server holds nothing beyond the thirty-minute window described above.

If you are unhappy with how we have handled your data, you have the right to complain to your local data protection authority.

Children

Boirelle is not intended for anyone under 16, and we do not knowingly process their data. If you believe a child has used it, write to us and we will act.

Changes

If this policy changes in a way that matters, we will change the date at the top and say so in the app.