Last updated: September 17, 2026

1. Introduction

Codereltech LLC ("we", "our", or "us") operates the Ephora AI mobile application ("Ephora" or the "app"). This Privacy Policy explains what information we collect when you use the app, how we use it, who we share it with, how long we keep it, and the choices you have. Ephora is an AI photo editor: the edits you request are performed by third-party AI providers on our behalf, and Section 4 and Section 5 describe exactly what that means for your photos.

2. Information We Collect

2.1 Information You Provide

• Photos and images you select from your photo library, or capture with the camera, for editing. Depending on the feature you choose, these photos may contain your face or the faces of other people (see Section 5). Some features accept a second image (for example a background, a product photo or a logo).
• Edit instructions: the tool you selected, and, for eraser tools, the mask (the area you painted over the photo). For most tools the text instruction sent to the AI model is written by the app, not by you; for Product Mockup the colour codes you choose are added to it.
• Account information if you create an account: email address, display name, and the sign-in provider you use (Apple, Google, Facebook or email and password).
• Contact information when you reach out to our support team.
• Payment information for credit packs. Payments are processed by the Apple App Store or Google Play; we never receive your card details.
• Coupon codes you redeem in the app.

2.2 Automatically Collected Information

• Device information: model, operating system version, app version, language, and a random app-instance identifier.
• Usage data: features used, edits started and completed, credits earned and spent.
• Diagnostic and crash logs.
• IP address, recorded by our server when you redeem a coupon (fraud prevention) and in standard server request logs.
• Analytics data as described in Section 7. Analytics is optional and can be turned off in the app.

We do not collect your contacts or your precise location. Your device's advertising identifier is used only if you allow tracking in the iOS App Tracking Transparency prompt (Section 7).

3. How We Use Your Information

We use the collected information to:

• Provide the AI photo editing features you request, using AI models operated by our service providers (Section 4)
• Manage your account and your credit balance
• Detect and prevent fraud or abuse (for example repeated coupon redemptions)
• Improve and optimize the application (only if you allow analytics)
• Respond to your inquiries and support requests
• Send important updates about the service and, if you opt in, push notifications

We do not use your photos, prompts or edited results for advertising, for profiling, for identity verification, or to train AI models.

4. Photo Processing and Third-Party AI Processing

Ephora does not run AI models on your device or on our own hardware. Every edit is performed by a third-party AI provider on our behalf. We want to be precise about what happens.

What we send. When you start an edit (for example Remove Background, Change Background, Erase Object, Text Eraser, Ephora It, CV / Headshot Photo or Product Mockup), the app sends:

• the photo you selected, compressed and resized on your device (at most 1024 pixels on the longest side) before upload;
• for some features, a second image you selected (for example a background, a product photo or a logo);
• the mask you painted, if the tool uses one;
• the edit instruction (text prompt) for the selected tool.

We do not send your name, email address, contacts, location, device identifiers or analytics data together with the photo. The upload request carries your app user ID (an anonymous ID before you sign in, your account ID after) so that the correct credits can be deducted; this ID is not forwarded to fal.ai.

Who receives it. The photo and instructions are transmitted over an encrypted connection (HTTPS) to our own server (ephora.codereltech.com, operated by Codereltech LLC). Our server does not write the photo to disk or to a database; it forwards it in memory to fal - Features & Labels Inc. ("fal.ai"), a company based in the United States, which hosts and runs the AI models that perform the edit. For the features Change Background, Text Eraser, Ephora It, CV / Headshot Photo and Product Mockup, fal.ai runs image models provided by Google LLC (Gemini image models), so Google processes the photo as fal.ai's sub-processor for those features. For Remove Background and Erase Object, fal.ai runs models hosted by fal.ai itself. No other third party receives the photo.

Protection by our providers. fal.ai processes the data only on our documented instructions as our data processor under its Data Processing Addendum (fal.ai/legal/data-processing-addendum), which includes Standard Contractual Clauses for international transfers; fal.ai is audited under SOC 2 Type II and ISO 27001. Under that agreement fal.ai may not use your personal data to train models outside our instructions. Google's terms for the Gemini API used for paid services state that Google does not use prompts or images to improve its products and logs them only for a limited period for abuse detection. fal.ai's privacy policy is available at fal.ai/privacy.

Your permission. The first time you use an AI editing feature, the app shows a notice that explains exactly this — what is sent, to whom, and for how long it is kept — and asks for your permission before any photo is uploaded. Nothing leaves your device until you agree. You can review and withdraw this permission at any time in the app under Profile → Legal → AI processing consent; withdrawing it disables AI editing but not the rest of the app.

Purpose limitation. Your photo, mask, prompt and the generated result are used solely to produce the edit you requested. Neither Codereltech LLC nor, under our agreement, fal.ai uses them to train or improve AI models.

Storage and retention at fal.ai. The uploaded photo, the mask and the generated result are stored temporarily on fal.ai's storage in the United States so that the model can read them and the app can download the result. We request an explicit expiry for every file and every request: these files are automatically deleted within 24 hours, and fal.ai does not keep a copy of the request itself (input links and prompt) beyond that. fal.ai does not receive any information that identifies you.

Storage on our server. Our server forwards the photo in memory and does not store your photos, masks, prompts or results. It keeps a record that an edit took place (feature used, credits spent, timestamp, your app user ID) for billing; this record never contains the image itself. Standard server request logs (request path, timestamp, IP address) are retained for a limited period for security and troubleshooting and are then deleted; they do not contain image content.

Storage on your device. The edited result is returned to the app and shown to you; it is saved to your photo library only if you choose to save it. Your project history is stored locally on your device and is not uploaded to our server. Deleting the app deletes this history.

5. Face Data

Some Ephora features (for example CV / Headshot Photo, Ephora It, Change Background, Remove Background and Erase Object) are typically used on photos that contain a human face. This section explains how such photos are handled.

• What we collect. We receive the photo you select, which may include a face. We do not perform facial recognition, face detection, face matching or identity verification, and we do not extract facial geometry, generate a face template, faceprint, biometric identifier or any other data that could identify a person by their face. The photo is processed as a whole image by a generative model; no facial features are extracted or analysed separately. The app contains no face-detection or biometric framework.
• How it is used. The photo is used only to generate the edit you requested (for example replacing the background behind you, or producing a headshot-style rendition of you). It is not used for any other purpose, including advertising, profiling, identity verification, or training AI models.
• Who it is shared with. With your permission (Section 4), the photo is transmitted through our server to fal - Features & Labels Inc. (United States), which performs the edit on our behalf as our data processor, and, for the Gemini-based features listed in Section 4, to Google LLC as fal.ai's sub-processor. It is not shared with anyone else. Photos are never uploaded to our crash-reporting providers or, as files, to our analytics providers; if you have allowed analytics, the screen you are viewing may appear in Microsoft Clarity session recordings (Section 7).
• Where it is stored and for how long. Our server does not store the photo. The photo and the generated result are stored temporarily on fal.ai's storage in the United States and are automatically deleted within 24 hours. The result is stored on your device only, and in your photo library only if you save it.
• Deletion. Because we do not keep a copy, the photo is gone from our side and from fal.ai within 24 hours without any action on your part. You can delete the result from your device at any time. If you believe a copy is still held, contact us (Section 14) and we will confirm deletion, including with our processor.
• Consent. Before the first upload, the app asks for your permission and tells you that photos may contain faces and will be processed by fal.ai (and, for some features, Google). You may withdraw this permission in the app under Profile → Legal → AI processing consent.

6. Data Sharing

We do not sell your personal information and we do not share it with advertisers or data brokers. We share data only with the following recipients, each of which is contractually bound to process it only on our instructions and to protect it to a standard equivalent to this policy:

7. Analytics, Tracking and Sign-in Providers

• Analytics is optional. On first launch the app asks whether you allow product analytics. If you decline, Mixpanel, Microsoft Clarity and Firebase Analytics are not activated and no usage events are sent. You can change this at any time in the app under Profile → Preferences → Analytics & Tracking.
• What analytics collects. Screens viewed, features used, edits started and completed, credits purchased and spent, device model, OS version, app version, language, country derived from IP address, your account ID after sign-in, and a random analytics identifier. Photos, masks, prompts and edited results are never uploaded to analytics services as files; the only exception is screen content that may appear in Microsoft Clarity session recordings, described below.
• Microsoft Clarity records how you navigate the app (screens and taps) so that we can fix usability problems. These recordings may include the screen content shown while you use the app, including a photo you are editing; text you enter is masked. Clarity runs only if you allow analytics, and you can turn it off at any time.
• Crash reporting and notifications. Firebase Crashlytics and Sentry collect crash and error reports, and OneSignal registers your device for push notifications. These start when the app launches because they are needed to operate the app; they never receive photos. Push notifications are shown only if you allow them in the system dialog.
• Facebook Login. We include the Facebook SDK to offer "Continue with Facebook". Its automatic event logging is disabled. Advertiser tracking inside the SDK is switched on only if you allow tracking in the iOS App Tracking Transparency prompt described below.
• Tracking (App Tracking Transparency). On iOS and iPadOS the app asks once, right after onboarding, whether you allow tracking. If you allow it, we may link your activity across other companies' apps and websites (through the Facebook SDK) to understand how people discover Ephora and to improve the app; this is declared as "tracking" in our App Store privacy details. If you decline, no such linking takes place and every feature still works. Ephora shows no advertising and does not sell your data. On Android no such prompt is shown and no cross-app linking is performed.

8. Data Security

We implement industry-standard security measures to protect your information: all data is transmitted over encrypted connections (HTTPS), uploads to our server are signed, photos are never written to disk on our server, and access to our systems is restricted to authorised personnel. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

9. Data Retention and Deletion

Deleting your account. Open Profile → Delete Account in the app. This deletes your sign-in account (email address and display name) immediately. Credit transaction records and the associated app user ID are not deleted automatically; to have them removed, email us (Section 14) from the address linked to your account and we will complete the deletion and confirm it in writing within 30 days.

10. Your Rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict processing of your data
• Data portability
• Withdraw consent at any time

You can exercise most of these rights directly in the app: turn analytics off under Profile → Preferences → Analytics & Tracking, withdraw AI-processing permission under Profile → Legal → AI processing consent, and delete your account in Profile → Delete Account. For anything else, contact us (Section 14); we respond within 30 days. If you are in the European Economic Area or the United Kingdom, you also have the right to lodge a complaint with your local data protection authority.

11. Children's Privacy

Our service is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will take steps to delete such information.

12. Third-Party Services

The service providers that process data on our behalf are listed in Section 6. In addition, our app and website may contain links to third-party services (for example the App Store, Google Play, or social networks). We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date. Where a change materially affects how your photos are processed, the app will ask for your permission again.

14. Contact Us

If you have questions about this Privacy Policy, or want to exercise any of your rights, please contact us through our contact page or by email.

Company: Codereltech LLC · Email: [email protected] · Website: codereltech.com