Nailvory Privacy Policy
Last updated: 21 September 2026
This policy explains what personal data the Nailvory iOS app collects, why, how long we keep it and what your rights are. It is written to meet the EU General Data Protection Regulation (GDPR), because we are based in the Slovak Republic, and the privacy laws of the United States and Canada, where the app is sold.
Controller: Mário Otruba, individual developer, Martina Hattalu 2973, Slovakia (European Union), hello@nailvory.com. There is no separate data-protection officer; this address handles every privacy request.
1. What we collect and why
| Data | Where it comes from | Why we use it | Legal basis (GDPR) |
|---|---|---|---|
| Photos of your hand (My Hands mode), inspiration images and sketches you add | You | To generate the nail design you asked for | Performance of a contract (Art. 6(1)(b)) |
| The designs generated for you, the options and text you chose and the prompt used | Created by the app | To show, save, edit and share your designs in your library | Contract |
| An anonymous account ID | Created by the app on first launch | To tie your library, free allowance and subscription to your device | Contract |
| Email address and name (only if you sign in with Apple or Google; Apple lets you hide your email) | Apple or Google | To let you sign in on other devices and merge your library | Contract |
| Subscription status, product and expiry, and Apple's transaction identifier | Apple | To unlock the features you paid for and to keep them unlocked across devices | Contract; legal obligation (accounting) |
| A device attestation key (Apple App Attest) | Your device | To stop automated abuse of the free allowance | Legitimate interest (Art. 6(1)(f)): preventing fraud and controlling cost |
| Basic usage events: which screens are used, whether a generation succeeded, which plan was shown | The app | To fix problems and understand which features are used | Legitimate interest: improving the Service |
| Crash reports (only if you allowed Apple to share them) | Apple | To fix crashes | Legitimate interest |
We do not collect your location, contacts, precise identifiers for advertising, or anything for tracking you across other apps or websites. We do not sell personal data and we do not show ads.
2. How the AI processing works
To paint the nails, your Input (photo, reference image, sketch, text) and the generated image are sent over encrypted connections to the following processors, which act on our instructions:
- fal.ai, Inc. (USA): runs the image model that paints the design.
- Anthropic, PBC (USA): refines the text instructions, describes reference images and checks that the generated hand looks correct.
- Supabase, Inc. (USA): hosts our database, file storage, authentication and server code (data centre in the United States).
- Apple Inc.: sign-in, purchases, App Attest and crash reports under Apple's own privacy policy.
- Google LLC: only if you choose Sign in with Google.
Reference images, sketches and length guides are deleted from our servers immediately after generation. Your hand photo and the generated images stay in your private library until you delete them. Images are never public: they are served through short-lived signed links that only your app can obtain. Our providers process your images to deliver the result and, under their API terms, do not use API inputs to train their models.
3. International transfers
We are in the EU; our processors are in the United States. Transfers rely on the EU-U.S. Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses.
4. How long we keep data
- Designs, photos and account data: until you delete them or delete your account. Deleting your account (Settings → Privacy → Delete my data) removes your account, every image and every design from our servers immediately; backups are overwritten within 30 days.
- Usage events: 24 months, then deleted or anonymised.
- Purchase records: as long as required by tax and accounting law (10 years in Slovakia), in anonymised form where possible.
- Reference images, sketches, length guides: seconds, deleted right after generation.
5. Your rights
Under GDPR (and similar laws in California, Virginia, Colorado, Connecticut, Utah, Quebec and other places) you can ask us to access, correct, delete or export your data, to restrict or object to processing, and to withdraw consent. Most of this you can do yourself in the app: the library shows everything we hold, and Delete my data erases it. For anything else email hello@nailvory.com; we answer within 30 days and never charge for it. If you are in the EU you can also complain to the Slovak supervisory authority, Úrad na ochranu osobných údajov Slovenskej republiky (dataprotection.gov.sk), or to the authority in your country. We do not discriminate against anyone for exercising their rights.
6. Security
Data travels over TLS and is stored encrypted at rest. Access to your images is restricted to your account through row-level security; server code runs with keys that are never included in the app. Sessions are stored in the iOS Keychain. No system is perfectly secure, so please contact us if you believe your account has been compromised.
7. Children
Nailvory is not directed at children under 13 and we do not knowingly collect their data. If you believe a child has used the app, email us and we will delete the data.
8. Automated decisions and AI
Generation is automated, but no decision with legal or similarly significant effects on you is made automatically. Generated images are AI-made and may not be reproducible in a salon.
9. Changes
We will post updates on this page and change the date at the top. Material changes will be announced in the app.
10. Contact
Mário Otruba, Martina Hattalu 2973, Slovakia · hello@nailvory.com