Privacy Policy

4. ENSELORA privacy details

Data processed by ENSELORA

Depending on the features you use, ENSELORA may process:

• profile preferences such as name, style, occasions, and reminder time;
• clothing photos, originals, local previews, masks, and wardrobe-item descriptions;
• saved outfits, wear history, travel plans, favourites, and feedback;
• for an optional account, an internal identifier and the email address hidden or provided through Sign in with Apple;
• approximate location after optional permission, used for local weather through Apple WeatherKit;
• optionally selected calendar event titles, processed on device to infer the type of activity and not stored by ENSELORA;
• technical subscription, quota, security, analytics, or crash data as described below; and
• information you choose to send to support.

Local data, optional account, and cloud sync

Without signing in, the wardrobe, profile, photos, outfits, and history remain stored locally in the iPhone app. Try-On history, including the person photo and result, remains local unless an eligible user separately enables Try-On sync.

Optional Sign in with Apple creates an account through Supabase Auth. If an eligible ENSELORA+ user enables sync, profile, wardrobe, outfit, wear-history, shopping-list and travel-plan records, plus clothing photos, are stored in a private Supabase database and storage bucket. If Try-On sync is explicitly enabled, its source and result photos are stored in a separate private bucket. Access rules restrict an account to its own records and files. Changes are saved locally before transfer over HTTPS.

AI and image processing

Basic foreground separation may run on the iPhone through Apple Vision. If you choose remote clothing recognition, fallback background removal, multi-item or video-frame wardrobe scanning, outfit generation, or virtual Try-On, the information required for that request is sent through the ENSELORA service after the relevant consent. Google Gemini may process clothing recognition and outfit composition. Replicate may process fallback background removal through 851 Labs and virtual Try-On through configured model providers. A higher-quality Try-On request may compare approved model outputs and use Gemini to select the strongest preservation result. Try-On may include a full-body photo and photos of selected clothes.

Submitted photos are not used by Gabriel Falis for advertising or to train a proprietary model. ENSELORA does not create a permanent server photo archive or intentionally log photo content. Technical request caches expire within 15 minutes. Pseudonymous daily or monthly quota counters expire within 32 days. External providers process requests under their own terms, retention rules, and data-processing safeguards.

Weather, location, and calendar

Location is optional. If allowed, approximate location is used with Apple WeatherKit to retrieve local weather. A destination entered for a travel plan may be geocoded and queried through WeatherKit without requesting the device location. Coordinates and forecast details may be retained with that travel plan and included in optional cloud sync. Weather responses are also kept in a time-limited device cache. Location is not used for advertising or cross-app tracking. Optional calendar event titles are processed on device and are not stored by ENSELORA.

Subscriptions

Apple processes purchases through the App Store. RevenueCat helps verify subscription status and consumable Try-On credits and may process a pseudonymous app-user identifier, product, transaction, webhook event, credit-ledger entry, and entitlement information. ENSELORA does not receive the full payment-card number.

Optional analytics and diagnostics

PostHog product analytics and Sentry crash diagnostics are separate, off-by-default choices. After consent, ENSELORA sends only predefined feature events or technical diagnostics needed to understand use and investigate failures. It does not send wardrobe photos, clothing names, outfit text, or the account email. Session replay, automatic screen capture, and cross-app tracking are not used. Consent can be withdrawn in the app under Account & Sync.

The server records pseudonymous AI operation, model, token or unit count, estimated cost, request identifier, and timestamp for quota, abuse prevention, cost monitoring, and operations. It does not store the submitted image or generated image in those cost records. App Attest may store a device-generated public key, receipt, assertion counter, and last-use time to verify genuine app requests.

5. Odovzdaj privacy details

Local reports and optional cloud

Odovzdaj creates property inspection and handover reports on the iPhone without requiring an account. Local drafts, saved properties, reminders, photos, annotations, signatures, generated PDFs, and history remain on the device unless you choose an eligible cloud feature. Local notifications are scheduled by iOS.

Optional Sign in with Apple creates a Supabase account. Annual Pro or Team users can explicitly upload completed PDFs and basic report metadata, or sync a sanitised draft. A synced draft excludes room photos, evidence files, company logos, signatures, remote-approval certificates, and embedded reference-report copies. Private database, storage, and row-level access rules restrict account data.

Team workspaces

Team may store shared property templates and sanitised drafts, member identifiers, a member-provided display name or Sign in with Apple email, roles, invitations, and a change audit. Invitations use a random token; only its SHA-256 hash is stored. A workspace owner’s active Team entitlement is checked server-side before shared content can be changed.

Photos, on-device assistance, and remote approval

Apple Vision can classify a selected room photo on the device to suggest neutral wording. It does not determine damage and does not upload the photo for this feature. If you create a seven-day remote approval link, the recipient sees the confirmation form rather than the report PDF, address, or report photos. The service stores request status, signer name, optional response note, and an approved signature.

Camera and photo-library access are used only when you attach photos, scan a meter display on device, or select a company logo. The system contact picker shares only the contact you explicitly select. Denying optional access does not prevent use of the remaining report features.

Optional tenant self-inspection

An eligible annual Pro user may create a seven-day, single-use link for a tenant to record the condition of named rooms. Supabase stores the account owner, protocol reference, expected name, property label, room list, request status and timestamps, plus the submitted room condition, note, and optional photograph. Only a SHA-256 hash of the random invitation token is retained by the service.

The form is served through gfcodes.com and forwards the submission to the Odovzdaj service. Evidence photographs are stored in a private bucket and are available only to the authenticated invitation owner. The link becomes unusable after submission, expiry, or cancellation.

Purchases, retention, and deletion

Apple processes App Store payments. RevenueCat may process a pseudonymous app-user identifier, product and transaction identifiers, webhook event identifiers, expiry, environment, and entitlement status. It does not provide payment-card details to Odovzdaj. Verified webhook events are deduplicated and retained in a minimised support record rather than as a full billing payload.

You can delete individual cloud PDFs and drafts, disconnect without deleting, or permanently delete the cloud account in the app. Account deletion removes the user’s cloud records and private files; audit authorship may become anonymous where shared team data must remain for other members. Deleting the app removes local data but does not itself delete cloud data.