Privacy Policy

Estévora ("Estévora", "we", "us") is the data controller responsible for your personal data. This Privacy Policy explains how we collect and process personal data when you use the Estévora application and services, and sets out your rights under the EU General Data Protection Regulation (GDPR) and applicable national data protection laws.

Controller contact: privacy@estevora.com

We do not sell personal data and we do not use your skin photos for advertising.

We process your personal data only where we have a lawful basis under Article 6 GDPR (and, for health data, Article 9 GDPR):

• Contract (Art. 6(1)(b)): to create your account and deliver the features you request
• Explicit consent (Art. 6(1)(a) and Art. 9(2)(a)): to analyse skin photos and other health-related data, and to access your camera and location
• Legitimate interests (Art. 6(1)(f)): to keep the app secure, prevent abuse and improve our service
• Legal obligation (Art. 6(1)(c)): to comply with applicable law and respond to lawful requests

You may withdraw your consent at any time; withdrawal does not affect the lawfulness of processing carried out before it.

Data you provide directly

• Account details: name, email address, language preference
• Skin profile: skin type, concerns, goals, lifestyle data (sleep, water intake, stress)
• Photos you capture or upload for skin analysis
• Community posts, likes and comments
• Orders and delivery details when you buy products through EstévoraCart™

Data collected automatically

• Approximate device location — only when you enable it, to fetch local weather and air quality
• Camera access — only when you start a scan
• Technical data: device type, operating system, app version, language
• Usage data: features used, session duration, errors
• Local storage on your device, used to remember your language and session

Health data: skin photos, scan results and skin concerns may reveal health information. We treat this as special category data under Article 9 GDPR and process it only on the basis of your explicit consent.

• Provide, operate and improve Estévora
• Perform AI-powered skin analysis on the photos you submit
• Generate personalised routines, tracking and predictions based on your profile, history and local weather
• Show product recommendations and process your orders
• Send service messages and respond to support requests
• Detect misuse and keep the service secure
• Comply with legal obligations

Estévora requests camera access solely to enable EstévoraScan Vision™. Photos are analysed by our AI model to produce your skin assessment. Scan images and results are stored securely and linked to your account so you can track your skin over time.

Your photos are never sold and never shared with third parties for advertising or marketing. You can delete individual scans or your full scan history at any time from your Profile settings.

With your permission we access your device location to retrieve local weather conditions (temperature, humidity, UV index) from the Open-Meteo API and to display your city. Location is used only for this purpose, is fetched on demand, and precise coordinates are not stored on your account.

Scan results, routine suggestions and forecasts are generated by automated systems. They are provided for general wellbeing and informational purposes only, do not constitute medical advice or diagnosis, and do not produce legal effects or similarly significantly affect you. You can always request human review by contacting us.

We do not sell your personal data. We share it only with processors acting on our instructions under Article 28 GDPR, and only as far as necessary:

• Base44 — application hosting, authentication and database infrastructure
• AI providers — image and text processing to generate your results
• Open-Meteo — weather and air-quality data (requests contain coordinates only)
• OpenStreetMap / Nominatim — reverse geocoding to display your city
• Brand and affiliate partners — only the order and delivery details needed to fulfil a purchase you made
• Authorities — where required by law or a binding request

Some processors may process data outside the European Economic Area. Where that happens, we rely on an adequacy decision of the European Commission or on Standard Contractual Clauses (Art. 46 GDPR) together with supplementary technical measures, so that your data keeps an equivalent level of protection.

We keep personal data only as long as necessary for the purposes above. Account and profile data are kept while your account is active. Scan images and results are kept until you delete them or close your account. Order records are kept for the period required by tax and accounting law. When data is no longer needed it is deleted or irreversibly anonymised.

We apply appropriate technical and organisational measures under Article 32 GDPR, including encryption in transit (HTTPS/TLS), encryption at rest, access controls and minimisation of the data we store. No transmission over the internet is completely secure, so we cannot guarantee absolute security. If a breach is likely to result in a high risk to your rights, we will inform you and the competent supervisory authority without undue delay.

As a data subject in the EU/EEA you have the right to:

• Access the personal data we hold about you and obtain a copy
• Rectification of inaccurate or incomplete data
• Erasure ("right to be forgotten")
• Restriction of processing
• Portability — receive your data in a structured, machine-readable format
• Objection to processing based on legitimate interests
• Withdraw consent at any time, including for camera, location and photo analysis
• Not be subject to automated decisions with legal or similarly significant effects
• Lodge a complaint with a supervisory authority in your country of residence, place of work or where the alleged infringement occurred

To exercise any of these rights, email privacy@estevora.com. We answer within one month, extendable by two months for complex requests, and we may ask for proof of identity to protect your data.

Estévora is not intended for children. In the European Union the digital age of consent is 16, or lower where a Member State has set one (never below 13). We do not knowingly collect data from children below that age. If you believe a child has provided us with personal data, contact us and we will delete it.

We use only strictly necessary storage. We write your language preference and your session token to your browser's local storage so the app works and stays signed in. We do not use advertising or cross-site tracking cookies. You can clear this storage at any time in your browser settings.

We may update this Privacy Policy to reflect legal or product changes. The "Last updated" date above always shows the current version, and we will notify you in-app of material changes before they take effect.

For any question, request or complaint about your personal data, contact our privacy team:

You also have the right to contact your national data protection authority. In Portugal this is the Comissão Nacional de Proteção de Dados (CNPD).