Esmaline

Privacy Policy

Esmaline is a personal venture of Dan Francis, based in Texas, USA. This policy explains what we collect, why we collect it, who we share it with, and what you can do about it. It covers the Esmaline website at esmaline.com and the Esmaline iPhone app once it launches.

The short version

  • Your hand photos are what the app needs. Face and outfit photos are optional, and we ask for them separately.
  • We send photos to an AI image provider only after you say yes on a consent screen in the app.
  • We do not use your photos to train AI models, and we do not use them for ads.
  • We delete uploaded photos and generated images automatically after 30 days, unless you save a look.
  • You can export or delete your data at any time.
  • We do not try to work out your ethnicity, health, or skin conditions from your photos.

1. What we collect

Waitlist and website

When you join the waitlist we store:

  • Your email address.
  • The exact consent wording you agreed to, its version, and the time you agreed.
  • The page you landed on, which part of the page you signed up from, and any campaign tags in the link (UTM tags).
  • Your browser's user-agent string (browser and device type), and a hashed version of your IP address. The hash is scrambled with a secret value, so we cannot read your address from it. We use these two only to spot and block abuse of the form.

Our first-party site analytics record which pages and parts of the page are used. Each event stores the page path, the page you arrived from, any campaign tags, and a random session id that your browser tab makes up. Events do not include your IP address, your user agent, or your email address.

How long we keep it. Waitlist entries are deleted 24 months after you join. Analytics events are deleted after 13 months. If you unsubscribe from launch emails, our email provider (Brevo) records it and we stop emailing you; ask us and we will also delete your waitlist entry straight away.

The app (after launch)

  • Account details: your email address, and your Apple sign-in identifier if you use Sign in with Apple.
  • Your style profile: preferred nail shapes and lengths, colors and finishes, occasions, and manicure habits. You can also tell us about allergies or sensitivities. This is optional.
  • Photos you choose to upload: hands (for fingernails) and feet (for toenails) when you use the try-on, plus face or outfit photos only if you turn those on.
  • Generated designs, saved looks, and favorites.
  • Purchase status from Apple. We do not receive your payment card details.
  • Crash and error reports. These never include the content of your photos.
  • A notification token, only if you allow notifications.

2. How photos work

Consent comes first. Before any photo leaves your phone, the app shows a consent screen. It names the image provider, explains what gets sent and why, and says that the provider will not train on your photos. We record the time you agreed. If we change to a different provider, we ask you again before anything new is sent.

Optional photos stay optional. You can use the app with hand photos alone. Face and outfit photos are a separate choice with their own consent screen. The app works if you say no.

We strip hidden data. Before a photo is sent, we remove location and camera details embedded in the file.

We send the smallest image we can. Where possible, we send a cropped image of the hand or foot rather than the whole photo.

Who processes photos. Our image provider is OpenAI, Google, or both. The consent screen names the provider that will process your photos on the day you agree. Each provider must agree in writing not to train its models on your photos. Providers may keep a short-term copy for safety checks under their own policies. We will link to those policies on the consent screen.

Storage and access. Photos and generated images are encrypted in storage and sent over encrypted connections. Only our systems can reach them. The app loads them through links that expire within minutes.

How long we keep them. Uploaded photos and generated images are deleted automatically 30 days after they were created. The exception is a look you save. A saved look, and the photo it was made from, stay until you delete the look or your account.

Model training. We do not train AI models on your photos. We do not give your photos to anyone to train their models. If we ever want to use photos for training, we will ask you first, in a separate request you can refuse.

3. Sensitive information

  • We do not infer ethnicity, race, health conditions, skin conditions, or other sensitive traits from your photos.
  • We do not identify people from their faces. We do not create face templates or other biometric identifiers. Hand-position data is used while your photo is being processed and then discarded.
  • Allergy or sensitivity notes are optional. We store them encrypted, we do not send them to image providers, and we do not use them to give medical advice.

4. How we use your information

  • To run the app and the website.
  • To send the emails you asked for, such as waitlist updates and account messages.
  • To keep the service secure and to stop abuse. This includes checks that block nudity, images of minors, and photos of people who have not agreed to be in them.
  • To fix bugs and measure how the site and app are used.
  • To meet legal obligations.

We do not sell your personal information. We do not share it for targeted advertising.

5. Who we share it with

We use these service providers. Each one may only process your information to do the job we hire it for.

  • Image provider (OpenAI, Google, or both): processes photos you have consented to send. Only after your consent.
  • Apple: Sign in with Apple, App Store purchases, and app delivery.
  • Brevo: holds the waitlist mailing list and sends launch emails. It receives your email address, the consent wording and time, the campaign tags and the page you landed on.
  • Mailgun: delivers the emails our own servers send.
  • Web hosting provider: hosts the website, the app's server, and the database.
  • Our internal operations system (dan-cp): receives each waitlist sign-up (your email address, the consent wording, the campaign tags and the page you landed on) so it can add you to the Brevo list, plus error reports and site health signals. It does not receive your photos.

We may also disclose information when the law requires it, or when needed to protect someone's safety or to stop fraud. If Esmaline is sold or merged, your information may transfer to the new owner under this policy, and we will tell you if it does.

Every email we send is also kept in an internal records mailbox so that we can show what we sent.

6. Your choices and rights

You can do the following at any time, whether or not you live in Texas or California. We extend the rights in the Texas Data Privacy and Security Act and the California Consumer Privacy Act to everyone.

  • Access and export. Export your data from the app, or ask us by email. You will get a file with your profile, designs, saved looks, and photos. We respond within 45 days.
  • Delete. Delete single photos or looks in the app, or delete your whole account. We remove your data from active systems within 30 days of your request. Backups that still hold a copy are overwritten on their normal rotation, which takes no longer than 35 days. We ask image providers to delete copies they hold, and we keep a record that the request was made and confirmed. We do not keep the photos themselves.
  • Withdraw consent. Turn off photo consent in the app at any time. We stop processing and delete the photos you withdrew.
  • Correct. Edit your style profile in the app, or ask us to correct other information.
  • Opt out of marketing emails. Use the unsubscribe link in any marketing email.
  • Appeal. If we decline a request, reply to our answer and ask us to review it. We will reply within 45 days.

We will not charge you more or treat you differently for using these rights. We may ask you to confirm you control the email address on your account before we act on a request. You can use an authorized agent to make a request on your behalf.

7. Security

We encrypt data in transit and at rest. We limit staff and system access to what each job needs, keep secrets out of our code, and log access to sensitive data. No system is perfectly secure. If a breach affects your information, we will notify you and any regulators as Texas law requires.

8. Children

Esmaline is not for children under 13, and we do not knowingly collect information from them. If you learn that a child under 13 has given us information, contact us and we will delete it. Users aged 13 to 17 may use the app only with a parent or guardian's permission.

9. Where your information is processed

Our systems and our main providers process information in the United States. Providers may process it elsewhere under their own terms.

10. Website storage

The website sets no cookies. It uses your browser's session storage, which is cleared when you close the tab, to hold a random session id for our analytics, the campaign tags and address of the page you landed on, and the page you arrived from, so that a later waitlist sign-up in the same tab can be credited to the right campaign. We do not use advertising cookies or advertising trackers.

11. Changes to this policy

We will post changes on this page and update the date at the top. If a change adds a new processor or a new use of photos, we will ask for your consent again before the change applies to you.

12. Contact us

Email claude@dansventures.com. We answer privacy requests within 45 days.