Privacy Policy
1. Who we are
Visage is developed and operated by Bias Labs FZ, a company located in Meydan, Dubai, United Arab Emirates.
| Trade licence number | [to be completed] |
|---|---|
| Registered address (full) | [to be completed] |
| Contact email (privacy) | [to be completed] |
| Data Protection Officer | [to be completed] |
We refer to Bias Labs FZ as "we", "us", or "our" in this policy, and to a person using Visage as "you".
2. What Visage does
Visage lets you upload photos of your own face and generates simulated "after" images that illustrate what certain aesthetic or cosmetic procedures might look like on you. The images are produced by artificial intelligence models and are illustrative simulations only — see Section 9 and our Terms of Use for the full disclaimer.
3. Information we collect
| Category | What it includes | Source |
|---|---|---|
| Account & identity | Email address; name (from your sign-in provider, or entered by you); date of birth (email sign-up only — see Section 6); gender (optional, if you choose to provide it) | You, or Apple / Google when you sign in with them |
| Face photos | Up to five photos of your face (front, left, right, left-oblique, right-oblique angles), captured through the in-app guided camera | You, via the App's camera |
| Generated images | AI-simulated "after" images produced from your uploaded photos, and associated metadata (procedure selected, model used, status) | Generated by our service on your request |
| Consent records | Whether and when you accepted this Privacy Policy and our Terms of Use | Recorded automatically when you tap accept |
| Purchase data | In-app purchases of credits, processed through Apple and RevenueCat. This feature is not yet live at the time of this policy's last update | Apple / RevenueCat, when purchases are enabled |
| Device & technical data | Basic technical information needed to operate the service (e.g. request logs, device type, app version). We do not currently use third-party advertising SDKs | Generated automatically by use of the App |
4. How we use your information
- To create and manage your account and authenticate you.
- To generate the AI simulations you request.
- To operate, maintain, and secure the App and its backend.
- To evaluate and improve the quality of the AI models we use — this may include retaining a rejected or failed generation attempt so our team or our processors can review why it did not meet quality checks. We do this honestly and only where necessary; the retention period for this purpose is [to be completed].
- To process in-app purchases, once that feature is enabled.
- To comply with legal obligations and enforce our Terms of Use.
5. Legal basis for processing
We process your personal data on the basis of your consent, which you give on the in-app consent screen before your first photo upload, generation, or analysis request. Where relevant (for example, users in the European Economic Area), we may also rely on the performance of a contract with you (to provide the service you requested) or our legitimate interests in operating and improving Visage, balanced against your rights.
6. Age requirements
Visage is not directed at children and you must be at least 13 years old to use it.
If you sign up with email, we ask for your date of birth and check that you are at least 13. If you sign in with Apple or Google, those providers do not share a verified date of birth with us, so no automated age check runs for that sign-in method. We state this plainly rather than implying a check we cannot perform: an App Store age rating describes content suitability, it does not verify an individual user's age.
7. Where your data is stored
Your photos and generated images are stored in private cloud storage (provided by Supabase) and are never publicly listed. The App accesses them only through short-lived, cryptographically signed links that expire after a limited time. Our application programming interface runs on servers hosted by Hetzner in Ashburn, Virginia, USA. Our database and authentication provider (Supabase) may store data in the region configured for our project: [to be completed — Supabase project region].
8. Who we share data with
We use the following categories of processors to operate Visage. We do not sell your personal data.
| Processor | Purpose |
|---|---|
| Supabase | Authentication, database, and private file storage |
| fal.ai | Runs the AI image-generation models used to create your simulated "after" images |
| OpenRouter (routing to model providers including OpenAI and Google) | Provides access to the AI image models used for certain procedures (for example, OpenAI's image model and Google's image model) |
| Apple / RevenueCat | Processes in-app purchases of credits, once this feature is enabled |
| Hetzner | Hosts our backend servers (Ashburn, Virginia, USA) |
Each of these processors only receives the data necessary for the function it performs. Your face photos are sent to the AI image-generation processors above solely to produce the simulation you requested.
9. AI-generated content and accuracy
The images Visage produces are computer-generated simulations for illustrative purposes. They are not medical advice, not a diagnosis, and not a guarantee of any real-world surgical or cosmetic outcome. See our Terms of Use for the full medical disclaimer.
10. International data transfers
Bias Labs FZ is based in the United Arab Emirates. Our backend servers are hosted by Hetzner in Ashburn, Virginia, USA, and other processors we use may be located in the United States or elsewhere. This means your data is transferred from the UAE to the United States, and potentially to other countries, in the course of providing the App. Where we transfer personal data across borders, we rely on the safeguards required by applicable law, including the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, for users in the European Economic Area, mechanisms such as standard contractual clauses. Additional detail on specific transfer mechanisms: [to be completed].
11. Data retention
- Your account data and photos are retained for as long as your account is active.
- If you delete your account, we erase your profile, photos, and derived data from our active systems, other than what we are required to retain by law.
- You can remove your photos, generated images, and face records without deleting your whole account: go to Settings → Delete my face data in the App. This erases your uploaded photos, your generated results, and your stored face records, and keeps the rest of your account (your sign-in and credit balance) intact.
- As noted in Section 4, a failed or rejected generation attempt may be retained temporarily for model-quality evaluation. Exact retention windows: [to be completed].
12. Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict, or object to our processing of your personal data, and the right to data portability. UAE PDPL and, for EEA users, the General Data Protection Regulation (GDPR) both give you these rights.
- Access & correction — most of your profile information can be viewed and corrected inside the App.
- Deletion — you can delete your account from within the App, or contact us using the details in Section 14.
- Withdraw consent — you may withdraw your consent at any time, which will stop new photo uploads, generations, and analyses; withdrawing consent does not affect processing already carried out.
- Complaints — you may lodge a complaint with your local data protection authority, or with the UAE Data Office.
13. Children
Visage is not intended for children under 13. If we learn that we have collected personal data from a child under 13 without appropriate consent, we will delete it.
14. Contact us
If you have questions about this Privacy Policy or want to exercise your rights, contact us at:
[to be completed — privacy contact email]
Bias Labs FZ
Meydan, Dubai, United Arab Emirates
[to be completed — full registered address line]
15. Changes to this policy
We may update this Privacy Policy from time to time. We will update the "Last updated" date above when we do. Material changes will be highlighted in the App.
16. Governing law
This Privacy Policy is governed by the laws of the United Arab Emirates. Any dispute arising from it is subject to the exclusive jurisdiction of the courts of Dubai [to be completed — DIFC Courts opt-in, if elected].