VIPAD Privacy Policy

1. Who is responsible

VIPAD is the name of this service and of the data controller responsible for your personal data in it. VIPAD is not a registered company yet; if that changes, a new version of this policy will say so. Privacy contact, including any request about your data: support@vipad.app.

We collect your data directly from you, through the VIPAD app, when you create an account, use a feature or contact us.

2. The data we handle

Account

• Your email address. If you sign in with email, we use it to send you a one time sign in code; there is no password. If you sign in with Google or Apple, see the next section.

• Country, region, language, currency, platform, the time you signed up and the time you were last active, and an account status used to stop abuse.

• Your answer to the age question (at least 16, or under 16), the policy version and the time. Never a date of birth or an identity document.

• On iPhone you can also continue as a guest, without an email address or a name. VIPAD then creates an account for you on its server, and everything you do is kept with it as with any other account. You can save it at any time with Sign in with Apple; the account and everything in it stay the same. If you sign out or remove the app before saving it, the app can no longer open that account. Like any account, you can delete it in Settings at any time.

Signing in with Google or Apple

You can sign in with your email address, with Google or with Apple. Signing in with Google or Apple is optional.

Signing in with Google

When you choose Continue with Google, Google asks for your permission and then shares with VIPAD only the basic sign in information: your name, your email address, whether that email address is verified, the web address of your Google profile picture and a Google account identifier (the openid, email and profile permissions). VIPAD never receives your Google password, and does not ask for or access your Gmail, contacts, calendar, Drive, photos or any other Google data.

• Why we use it: only to create your VIPAD account, to sign you in and keep you signed in, and to contact you about your account. VIPAD does not show or use your Google name or profile picture in the app; your display name is what you enter in your Beauty Profile.

• Where it is stored: Supabase, our sign in and database provider (section 6), keeps your email address, the Google account identifier and the basic profile information Google sent, as part of your sign in record.

• Sharing: we do not sell it, do not share it with advertisers or data brokers, do not use it for advertising and do not use it to train artificial intelligence models. It is never sent to OpenAI. Only Supabase processes it on our behalf, to run sign in.

• VIPAD's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• How long we keep it, and how to delete it: while your account exists. When you delete your account in Settings, your sign in record, including the information Google shared, is deleted with it (section 7). You can also remove VIPAD's access at any time in your Google Account, under Security, then Your connections to third party apps and services. That stops future sign ins with Google; it does not delete your VIPAD account or the data in it.

• Security: see section 9.

Signing in with Apple

When you choose Sign in with Apple, Apple shares an Apple account identifier and the email address you choose (your real address, or a private relay address Apple creates). The first time only, and only if you allow it, Apple also shares your name, which VIPAD uses to fill in your display name; you can change it at any time. The purposes, storage, sharing, retention and deletion are the same as for Google above. You can stop using Apple sign in for VIPAD in your Apple Account settings.

Questions about sign in data: support@vipad.app.

Your Beauty Profile, products and records

• What you choose to enter: display name, skin and hair details, concerns, sensitivities, preferences, budget, an optional age range and an optional profile photo.

• Products you add, with the shade or variant, size, notes, dates, rating and optional product photos (VIPAD does not ask what you paid); routines, goals, treatments, appointments, outcomes you report and progress photos you take. Your own photos are kept in private storage.

• Products you add stay yours. They are never added to the VIPAD Store, never shown to other people and never used to recommend products to anyone else.

Adding a product from a photo

• If you choose to add a product by photographing its packaging, the photo is sent to OpenAI only to read what is printed on the label: the brand, the name, the shade or variant, the size and the barcode. You check and correct every field before anything is saved.

• VIPAD does not store the photo it sent for reading. It records only that a reading happened, whether it worked and how long it took. A product photo is kept only if you choose to keep one in My Products, in your private storage.

• Photograph the product, not a person.

Beauty Concerns suggested from your results

• After a Skin Analysis, VIPAD may suggest up to three Beauty Concerns where a measurement is low, for example dryness when hydration is low. A suggestion becomes part of your Beauty Profile only if you confirm it.

• We keep each suggestion with the measurement it came from and your decision. A concern you dismissed is not suggested again for 90 days.

Beauty Tools, Style & Fashion Tools and Photo & Video Tools

• Only if you give the separate Beauty Tools Data Processing and Photo Consent. For a tool that Perfect Corp performs, the photo or video you choose, any reference picture or marked area, your options and any text you type are sent to Perfect Corp to produce the result. For the tools that OpenAI performs, listed in that consent, the photo or photos you choose, your options and any text you type are sent to OpenAI to produce the result. For Hair Color, Bangs, Lipstick, Colored Lenses and Nail Preview, the one photo you choose and your options, and for Image Generator the description you write, your options and, only if you add one, a reference picture, are sent to fal.ai, which produces the picture with an image model that Google provides, so what you send is also processed by Google. No tool sends a video to any provider: the two video tools of an earlier version (Video Generator and Frame Rate Enhancement) are not offered. Nothing is sent before you start a tool, and a tool that is not available in the app sends nothing, whichever provider would perform it.

• VIPAD deletes the copy it sent to the provider as soon as the operation ends; for a fal.ai tool, VIPAD asks fal.ai not to store the request and to delete the produced picture after two hours (section 6). VIPAD keeps one private copy of your photo with the result in your history, under the Beauty, Looks or Studio tab of the tool. Only you can see it, and it is deleted when you delete that result or your account. The result (a measurement, written guidance, or a picture) is stored privately in that history.

• For the three measurement tools, an explanation is written automatically by OpenAI from the measurements, the tool options, your language and the previous result of the same tool, and, once you have accepted the Beauty Tools consent version 3 or later, the Beauty Concerns you chose or confirmed that relate to the tool (at most five), the kinds of related products in My Products (at most five), and the brand and name of at most one of your products whose kind usually suits one of those concerns. For this explanation, OpenAI never receives a link, a seller, a price, promotion or sponsorship, payment information, contacts, your exact location or any photo (see section 6).

• Skin Care Plan sends no photo. While the Beauty Tools Data Processing and Photo Consent is in force, it sends to OpenAI, as text, the measurements of your latest Skin Analysis, the Beauty Profile facts you approved, the skin type, skin sensitivity, skin concerns and ingredient or other sensitivities you entered in your Beauty Profile, the titles of your active goals, your skin routines (when and how often you follow them, and only the names of their steps), the answers you give in the tool and, only if you answer there that they may be used, the brand, name and kind of your products in My Products. What you told VIPAD is used as your own statement, never as a measurement. Without that consent, only the answers you give in the tool are sent.

• For each tool operation VIPAD keeps the reference number the provider assigned to the request and the amount of processing it reported, to account for its costs; these records hold no photo, no picture and no guidance text.

Face data

• What we collect: when you start a tool with a photo of your face, VIPAD handles that photo and what is produced from it: the measurements (for example skin scores, skin type, face shape or a colour direction), the written guidance and the produced picture. This is the only face data VIPAD collects, and only after you have given the Beauty Tools Data Processing and Photo Consent.

• What we do not do: VIPAD does not use face data to identify or recognise you, does not create face templates, face geometry or any other biometric identifier, does not use Face ID or face tracking, and does not combine face data with data from other sources.

• How it is used: only to produce the result you asked for, to keep it for you in your history and, if you approve them, to propose Beauty Profile facts. Face data is never used for advertising, never sold, never shared with data brokers and never used by VIPAD to train artificial intelligence models.

• Who receives it: the photo goes only to the provider that performs the tool you started (Perfect Corp, OpenAI, or fal.ai, which uses an image model that Google provides), and only to produce your result. The measurements and the Beauty Profile facts you approved may be sent as text, never as a photo, to OpenAI to write explanations, the Skin Care Plan and Beauty AI answers, as described above. Section 6 describes each provider. No other third party receives your face data.

• Where it is stored: in VIPAD's private storage at Supabase, hosted in London, United Kingdom, encrypted at rest. In the app, only your account can open it; section 6 describes the few administrators who can technically reach the storage.

• How long we keep it, and how to delete it: the copy sent to the provider is deleted as soon as the operation ends (section 6 says what each provider states about its own retention). VIPAD keeps one private copy of your photo with its result for at most 365 days. You can delete a result in your history at any time; its photo and picture are then deleted from storage within about two days. Deleting your account in Settings deletes all of your face data in the same way.

Beauty Profile facts from your results

• A Beauty Tool result may propose facts for your Beauty Profile, for example a face shape or a colour direction. A fact becomes part of your profile only if you approve it, unless you switch on automatic approval in Settings. Each fact is kept with the tool, the result and the date it came from.

• If you delete the result a fact came from, the fact is marked invalid at once and is no longer used by Beauty AI, by the Store or by any plan. Results of Style & Fashion Tools and Photo & Video Tools never propose a fact, and results of Photo & Video Tools never influence Beauty AI, your Beauty Profile, the Store or any recommendation.

VIPAD Beauty AI

• Your messages and the answers, kept in your conversations.

• To answer you, we send to OpenAI your message, recent turns of the same conversation, your language and country, and a limited summary you created in VIPAD: Beauty Profile details, the concerns you chose or confirmed, the Beauty Profile facts you approved, goals, products, routines, outcomes, and the latest measurement of each of the three measurement tools.

• For each of your concerns we also send which kinds of products usually suit it, which of your own products belong to those kinds, and at most two VIPAD Store products chosen for how well they suit that concern: only their brand, name and category, never a price, a seller or a link.

• We never send your email address, payment records, photos, pictures or videos.

VIPAD Store

• The Store shows products from VIPAD's own catalogue. Which products you see for your needs, and in what order, depends on how well they suit your Beauty Profile, your concerns and the results you reported. Whether VIPAD earns a commission never changes that order.

• A Store link opens the seller's own website, which handles any purchase under its own terms. VIPAD may earn a commission and receives no personal data about you from the seller.

Saving and sharing a result

• Saving happens only when you tap Save; VIPAD asks only for permission to write to your photos. The file is the unchanged result, with no watermark and no added metadata. A copy on your phone is yours and our retention no longer applies to it.

• Sharing always goes through your phone's own share options. VIPAD posts nothing and has no access to any social account. The app you choose handles the file under its own rules.

• We record that a save or share happened, the destination you picked, whether it was a picture or a video, and a short failure word. Not the file and not anything about your face.

Creative results and reports

• Before your first generated media, you confirm the media is yours or the people in it agreed, and that you will not use the result to deceive, impersonate, harass or sexualise anyone. We store the version you accepted and the date.

• AI made or AI edited results are labelled in the app and before you share them.

• You can report an AI result. A report stores the tool, a category, an optional note you write and whether you asked for the media to be included; VIPAD does not copy the picture or video into the report.

Salon search

• Only when you search. If you tap Near Me, we read an approximate position while the app is open; our server rounds it to about one kilometre. We do not store your position or what you typed; we store that a search happened, without its content.

Purchases

• Purchases are made through the Apple App Store or Google Play, which process your payment; VIPAD never receives card details. When purchases are available, we receive a transaction reference, the pack and its status through our purchase service, and keep ledgers of the VIPAD Credits and Beauty AI Messages added and used.

Welcome reward

• After you sign in, VIPAD gives a one time Welcome reward of 3 VIPAD Credits and 3 Beauty AI Messages, once per phone. To give it only to the genuine VIPAD app on a genuine phone, and only once per phone, the app runs a device check. If the check is not possible, the reward is not given and everything else in VIPAD works as usual.

• On Android, the app asks Google Play Integrity for a verdict on the app and the phone, and sends it with the identifier Android gives VIPAD on this phone. That identifier is different in every app, stays the same when VIPAD is reinstalled and changes when the phone is reset to factory settings. VIPAD never stores it: it keeps only a one way fingerprint of it (a salted hash).

• On iPhone, the app uses Apple App Attest to show that it is the genuine VIPAD app, and Apple DeviceCheck, which lets VIPAD record on Apple's side that this phone has received the reward. DeviceCheck holds two bits per phone for VIPAD and no personal data.

• With your account we keep the outcome of each check (genuine or not, and when). We do not use the check, the identifier or its fingerprint for advertising, for tracking or for anything other than this reward and preventing its abuse.

How the app is used

• Which screens and tools you open, the steps of a tool (started, finished or failed, and how long it took), the steps of a purchase, and Store actions such as opening or saving a product or going to a retailer, with the app version, platform and language. Never your photos, results, messages, Beauty Profile details or other personal content.

• It is recorded under a pseudonymous reference, not under your email address, and is never shared or sold. The events needed to keep the service working are always recorded. The rest is on by default, and you can switch it off at any time in Settings, Privacy and consent.

News and offers

• Only if you agree, on the welcome page or later in Settings, Privacy and consent: news and offers about VIPAD by email and, if you allow notifications for VIPAD on your phone, by notification, in the language you use in the app. We use your email address, language, country and whether you have made a purchase.

• Emails are sent by Resend (section 6). For a news email we may record whether it was delivered, opened and which link was clicked. You can withdraw at any time in Settings, Privacy and consent, or with the unsubscribe link in every news email. Not agreeing never limits anything in VIPAD.

Support, consent and usage records

• What you write to support, and technical details (app version, platform, system version, language, country) only if you tick the box.

• Which version of each legal document you accepted, acknowledged or withdrew, when, and a fingerprint of that exact text.

• Product cards you opened or saved, tool and AI operations with their outcome and duration, and administrator actions on your account.

Advertising

• VIPAD shows a short ad before some Beauty Tools and rewarded ads that you choose to watch to earn ad points. There are no banner ads.

• Ads are on for people who have confirmed they are at least 16, and you can switch them off at any time in Settings, Privacy and consent. In the European Economic Area, the United Kingdom and Switzerland, Google first shows its own consent message, and you can change that choice later in the same place.

• Google AdMob shows the ads. It receives information about your device and the app, such as the device model, system version, language and IP address, and the advertising identifier only where your device allows it. For a rewarded ad it also receives a pseudonymous reference and a one time code, so that VIPAD can credit the reward. It never receives your email address, photos, results or beauty data. Privacy policy: policies.google.com/privacy.

• AppsFlyer tells VIPAD which ad campaign an installation came from, for example a TikTok ad. While product measurement is on, it receives information about your device and the app, the first opening, the completion of registration and confirmed Credit purchases with only the pack, price and currency. On iPhone it works through Apple's SKAdNetwork, without the advertising identifier; on Android it may receive the advertising identifier, which you can reset or delete in your device settings. It never receives your email address, photos, results or beauty data. Privacy policy: appsflyer.com/legal/privacy-policy.

3. Features that are switched off today

• Push notifications from our server are not being sent. If you allow notifications, we store a push token for your device so they can be sent later; reminders you set are scheduled on your device.

• We do not sell personal data. We send news and offers only if you agree (section 2, News and offers).

4. Why we use your data and on what legal basis

• Your account and the app features you use: to perform our contract with you.

• Photos and videos used in Beauty Tools, and the measurements made from them: your explicit consent, which you can withdraw.

• Keeping the service secure, preventing abuse and fixing errors (including crash reports): our legitimate interest.

• Purchase records and records the law requires: our contract with you and our legal obligations.

• Operational and product measurement of the service: our legitimate interest in running and improving it; you can switch product measurement off at any time. Advertising and campaign measurement: our legitimate interest in keeping most of VIPAD free and, in the European Economic Area, the United Kingdom and Switzerland, your choice in Google's consent message; you can switch advertising off at any time. News and offers: your consent, only if you give it.

5. Automated results

Beauty Tool results, written guidance, measurement explanations, produced pictures, concern suggestions, proposed Beauty Profile facts, Store suggestions, daily suggestions and Beauty AI answers are produced automatically. A proposed Beauty Profile fact changes nothing until you approve it. A concern suggestion changes nothing until you confirm it. They are cosmetic guidance and have no legal or similarly significant effect on you. People Like You insights use only grouped figures and appear only when a group has at least 30 people and 30 completed outcomes.

6. Who receives data, and where

• Supabase: database, sign in (including sign in with Google or Apple), file storage and server functions, hosted in London, United Kingdom.

• Google and Apple (sign in): only if you choose to sign in with them. They confirm who you are and send VIPAD the basic account information described in section 2, Signing in with Google or Apple.

• Perfect Corp: performs Skin Analysis, Skin Care Preview, Fitzpatrick Type and Hair Length among the Beauty Tools, Aging Preview, Clothes Try-On, Hair Extension, Hairstyle Preset and Hairstyle From Photo among the Style & Fashion Tools, and Color Correction, Object Removal, Photo Colorize and Photo Enhancement among the Photo & Video Tools; the seven Beauty Tools that the Beauty Tools Data Processing and Photo Consent lists (Face and Feature Analysis, Personal Color Analysis, Makeup Planner, Hair Style Advisor, Natural Look Guide, Beauty Progress and Skin Care Plan) are performed by OpenAI, not by Perfect Corp. Receives what is described in section 2. VIPAD sends a deletion request for each finished task, including after a failure or timeout (for Skin Care Preview, Perfect Corp refuses that request), except when VIPAD's server or Perfect Corp fails unexpectedly before VIPAD has recorded the task's reference. Perfect Corp has not confirmed to VIPAD in writing its retention period or the countries where it processes this data; this text will be updated when it does.

• OpenAI: writes Beauty AI answers, the explanations of the three measurement tools and the Skin Care Plan (from the information described in section 2), reads the label of a product photo you choose to use when adding a product, and, only with the Beauty Tools Data Processing and Photo Consent and only when you start one of the tools it lists, reads the photo you choose for a Beauty Tool, through its API. VIPAD sends every request with storage switched off. OpenAI states that data sent to its API is not used to train or improve its models unless the customer opts in, and VIPAD has not opted in. OpenAI states that it keeps abuse monitoring logs, which may contain a request and its answer, for up to 30 days unless a longer period is required by law or to protect its services, that an image is checked on arrival for illegal content involving minors and may be kept for review if flagged, and that it processes requests in the United States and other countries where it operates. OpenAI has not confirmed to VIPAD in writing any period or condition beyond the ones it publishes; this text will be updated when it does.

• fal.ai (Features & Labels, Inc., San Francisco, United States): performs five Style & Fashion Tools (Hair Color, Bangs, Lipstick, Colored Lenses and Nail Preview) and the Photo & Video Tool Image Generator, through its API, only with the Beauty Tools Data Processing and Photo Consent, only when you start one of them and only while that tool is available in the app. Receives the one photo you choose, or for Image Generator the description you write and, only if you add one, a reference picture, together with VIPAD's fixed instruction for the tool and your options, and returns one picture. For Image Generator no photo of you is needed, and what this paragraph says about the photo applies in the same way to the description and to any reference picture. The picture is made by an image model that Google provides through fal.ai; fal.ai states that content sent to such a partner model is transferred to that partner, so the photo is also processed by Google, and neither fal.ai nor Google has told VIPAD how long Google keeps it or what else Google does with it. VIPAD sends every request with the fal.ai setting that stops fal.ai from storing the request and its answer, and asks fal.ai to delete the produced picture after two hours; VIPAD downloads it at once. fal.ai's API terms state that it will not use customer content to create or train its products or services, except for services it marks as not yet ready for enterprise use or announces in advance, and its data processing terms allow it to use data from which personal details have been removed to improve its services; VIPAD does not ask fal.ai or Google to use your photo for training. fal.ai states that it applies automated moderation to detect harmful content, that it is based in the United States, that data is processed there under contractual safeguards, and that it encrypts the personal data it transmits. Privacy policies: fal.ai/legal/privacy-policy and policies.google.com/privacy. fal.ai and Google have not confirmed anything to VIPAD in writing beyond what fal.ai publishes; this text will be updated when they do.

• Sentry: crash reports from the app. Personal data is removed before sending; no screenshots, no screen recordings.

• Resend: sends your sign in codes by email and, only if you agreed, our news and offers. Receives your email address and the code or the message, and tells VIPAD whether a news email was delivered, opened or clicked.

• Google (Places): salon search, when you use it. Receives the category, your language and country, and the rounded position or the area you typed.

• Apple and Google: purchases and app delivery. RevenueCat, our purchase service, receives your VIPAD account number and the store transaction when purchases are available.

• Google (Play Integrity) and Apple (App Attest and DeviceCheck): the device check for the Welcome reward, described in section 2. They return a verdict to VIPAD and receive no email address, photo, result or beauty data from VIPAD.

• Expo push service: sends notifications when they are switched on. Receives a push token and the notification text, which never contains your results.

• Google (AdMob): shows the ads described in section 2, Advertising.

• AppsFlyer: campaign measurement, described in section 2, Advertising.

Your data may be processed outside your country: in the United Kingdom, where our database is hosted, and in the countries where the providers above process it. It is transferred to them only for the purposes described for each of them above.

Who at VIPAD can see what: other people using VIPAD cannot see your data. Control Center, the tool VIPAD staff use, shows operational data (your email address, account status, balances, support tickets and the category and note of any report you make); it does not show your photos, Beauty Tool results, Beauty Profile or conversations. The few people who hold administrator access to VIPAD's hosting accounts can technically reach the database and private storage; they may do so only when necessary to operate, secure or repair the service, or when the law requires it.

7. How long we keep data

• The photo or video you give a Beauty Tool: the copy VIPAD sent to the provider is deleted as soon as the operation ends; for a fal.ai tool, VIPAD asks fal.ai to delete the produced picture after two hours, as described in section 6. VIPAD keeps ONE private copy with the result in your Beauty History, where only you can open it. It follows the result: if you delete the result, its file is deleted within about two days, and if you do nothing it expires with the result after 365 days.

• Tool results, written guidance and explanations, in the Beauty, Looks and Studio tabs of your history: 365 days. After that, a daily job removes the result from your Beauty History, and the stored picture or video file is deleted from our storage within about one more day. If you delete a result earlier, it leaves your history at once and its file is deleted within about two days. Saving a copy to your phone or sharing it does not extend this. A Beauty Tool result cannot currently be saved to My Looks, so every result follows this rule.

• Your Beauty Profile, products, routines, goals, appointments, outcomes and your own photos: until you delete them or your account. There is no automatic deletion for inactivity.

• Beauty AI conversations: until you delete a conversation or your account.

• Beauty Concern suggestions: as long as the result they came from, at most 365 days, or until you delete that result or your account. A concern you confirmed stays in your Beauty Profile until you remove it.

• Beauty Profile facts from your results: until you remove them or delete your account; a fact whose result you deleted is marked invalid at once and is kept only as a record for 30 days.

• A product photo sent for reading the label: not stored by VIPAD.

• Consent records: while your account exists; they are deleted with it.

• Support tickets: until you delete your account.

• Reports of an AI result: until you delete your account. If the result itself is deleted or reaches 365 days, the report keeps only the tool, the category, your note and whether you asked for the media to be included.

• Salon search events: 30 days. Product interaction events: 90 days. Unused place references: 12 months. App measurement: operational events 90 days, product events 180 days, advertising events 90 days. Delivery, open and click records of news emails: 180 days.

• Purchases: your VIPAD Credit and Beauty AI Message ledgers and the purchase records linked to your account are deleted when you delete your account. Records of store purchase events stay, with your VIPAD account removed from them; each keeps the event type, the product, the time, the platform and the store's own transaction reference. Apple and Google keep their own purchase records under their terms.

• The Welcome reward check: the outcome of each check stays with your account and is deleted with it. The one way fingerprint of a phone that received the reward, together with a one way fingerprint of the account that received it, is kept after the account is deleted, so that the reward is not given to that phone again; it contains no email address, no identifier and nothing else that names you.

• After you delete your account we also keep a one way fingerprint of the deleted account with the deletion date, operation statistics without your identity, and administrator audit entries.

8. Your rights

• You can read, correct and delete your data in the app, and delete your account in Settings, which removes your stored files and records as described in section 7.

• You can withdraw the Beauty Tools Data Processing and Photo Consent, and any advertising, measurement or marketing consent, in Settings, Privacy and consent. Withdrawing stops future processing; after you withdraw the Beauty Tools consent, VIPAD also stops using your measurements and the Beauty Profile facts you approved as personal context for Beauty AI until you give that consent again. Skin Care Plan keeps working with only the answers you give in the tool. Withdrawing cannot undo processing a provider has already completed, and a copy a provider keeps under its own terms, as described in section 6, may not be erased at once where the law or the provider's own retention prevents it.

• Depending on where you live, you also have rights such as: to learn whether your data is processed and to request information about it; to learn the purpose and whether it is used for that purpose; to know the third parties it is transferred to, in your country or abroad; to have incomplete or incorrect data corrected; to have data deleted or destroyed, and to have third parties informed of that; to object to a result against you that arises only from automated analysis; to data portability where it applies; and to claim compensation for damage from unlawful processing.

• Write to support@vipad.app; we answer within 30 days at the latest. In Türkiye, if your request is refused, the answer is insufficient or no answer comes in time, you can complain to the Personal Data Protection Board (KVK Kurulu). Elsewhere you can contact your data protection authority, for example the Information Commissioner's Office in the United Kingdom or the authority where you live in the European Union.

• Data export inside the app is not available yet; ask us at support@vipad.app.

9. Security

Data is encrypted in transit, and our hosting provider encrypts stored data at rest. Access to sign in data, including anything Google or Apple shared, is limited to the few administrators described in section 6. Your personal records are protected so that, through the app, only your own account can read them; shared catalogue information, such as product and tool descriptions, is the same for everyone. Photos are in private storage and shown through short lived links. Sensitive operations run on our servers, never with secret keys in the app.

10. Age

VIPAD is only for people aged 16 and over. Do not use a photo or video of anyone under 16.

11. Changes

When we publish a new version, the app shows it to you before you continue. Earlier versions are kept.