Privacy Policy – Empose

This policy supplements the general privacy policy at https://optiflowtech.eu/privacy/ with the specific processing activities within the iOS app Empose ("the App"). In the event of a conflict, this app-specific policy prevails for use of the App.

1. Controller

The controller responsible for data processing within the meaning of Art. 4 (7) GDPR is:

2. Overview of Processing Activities

Empose is a photography app with two parts: pose guides shown over the live camera (processed entirely on your device — camera frames never leave your iPhone) and an AI Studio that restyles a photo you select using generative AI — as a whole-photo Look, or as Styling that changes single features such as the hair color or lips (Section 3.8). You can also put a photo of your choice over the camera as a photo guide (it never leaves your iPhone), or turn it into your own pose with My Poses — a mannequin drawn by generative AI (Section 3.5). In doing so, we process the following data:

We collect no real names, no email addresses, no location data, no contacts and no cross-app advertising IDs. Sign-in to Firebase is fully anonymous (no account, no passwords). There is no free-text prompt input in the App — the AI applies only predefined, curated style templates. The one exception is an optional short note when you ask for a mannequin to be drawn again (e.g. "the head should turn toward the camera"); our backend turns it into a description of the pose for the image model.

3. Processing of Photos and Generated Images

3.1 Process

1. You select a photo from your library or capture a new one. The pose-guide camera itself runs entirely on your device; nothing is uploaded from it.
2. Only when you actively confirm and tap Generate — and only if you hold an active Premium subscription — is the photo transmitted encrypted (HTTPS/TLS) to our backend (Cloudflare Worker) and stored in Cloudflare R2 under a random key bound to your app user ID (users/{your-ID}/sources/{random-ID}.jpg). Without an active subscription, nothing is uploaded.
3. For generation, the Worker sends the photo together with the predefined style instruction of the Look you chose to the OpenAI Images API (model gpt-image-2.5-flare). The result is stored in Cloudflare R2 under users/{your-ID}/results/{generation-id}.jpg.
4. A metadata record is created in Google Firestore (collection generations): your IDs (Section 2), the Look/template ID, image dimensions, timestamps and status. The photos themselves are never stored in Firestore.
5. The App displays the result and, only if you tap Save, additionally saves it to your iOS photo library.

3.2 Retention Periods

• Cloudflare R2 (original + result): stored for a maximum of 90 days, then deleted server-side via an automatic lifecycle rule. If you delete a creation in the App beforehand, the associated R2 objects are removed immediately as well. The same applies to mannequin poses (Section 3.5).
• Google Firestore (metadata): until you delete the creation in the App or request deletion pursuant to Section 10.
• iOS photo library: managed by you.
• At OpenAI (Images API): see Section 4.

3.3 Deletion by You

• In the App: every creation can be deleted individually, and Settings → "Delete all AI creations" removes all metadata plus all source and result images from Cloudflare R2 in one step — including the photos and renders of your mannequin poses. Poses already saved on your iPhone stay there until you delete them. Deleting a mannequin pose in the App also deletes its photo and renders from Cloudflare R2.
• On request: to have all data stored under your IDs deleted in a single operation, write to [email protected] stating your app user ID (shown at the bottom of the App's Settings screen).

3.4 Face Data

Empose does not collect or process face data in the sense of biometric identifiers. The App does not perform facial recognition, does not identify or authenticate you, and does not create faceprints or any other biometric templates. Photos you select may contain faces; they are processed exclusively as image files in accordance with Sections 3.1–3.3 (storage for a maximum of 90 days in Cloudflare R2, transmission to OpenAI solely for image generation, deletion by you at any time) and are never used to identify individuals. The predefined style templates additionally instruct the AI model to preserve each person's identity and appearance unchanged; Styling changes only the features you choose and keeps the identity (Section 3.8). A mannequin pose contains no face at all: the person is replaced by a featureless figure.

Optional face scan during onboarding. On iPhones with a TrueDepth camera, onboarding offers an optional face scan that you can skip at any time. For this scan, the App uses Apple's ARKit face tracking, which relies on the TrueDepth camera. While the scan screen is open, the App uses this data for only two things:

• to draw a live wireframe of your face over the camera preview as visual feedback; and
• to read whether a face is detected and how your head is turned (left/right and up/down angles), so it can check that you have turned your head as instructed.

This data is processed exclusively on your device, and only in memory while the scan screen is open. It is discarded as soon as you leave the screen. The App does not save, upload, log or share any face tracking data, face geometry, depth data or camera images from the scan, and does not send them to us or to any third party, including analytics providers. It is not used for advertising, analytics, identification or any purpose other than guiding you through the scan in real time. Since nothing is retained, there is no face data to access, export or delete.

On devices without a TrueDepth camera, the face scan is skipped.

Face check for Styling. Before a Styling is created, the App checks on your device whether the selected photo shows a face (Section 3.8). The check only detects whether and where a face appears in the picture; it does not identify anyone, and nothing from it is uploaded or kept.

Camera preview. Apart from the face scan, the App uses the front or rear camera as a regular camera to show a live preview with your chosen pose guide over it. These camera frames are processed on your device and are never uploaded, stored or shared with third parties.

3.5 Photo Guide and My Poses (Your Own Pose Guides)

• Photo guides never leave your iPhone. In the camera you can pick a photo that is then shown over the live camera instead of a pose. It is kept only temporarily in the App's own storage on your device — until you choose a pose or close the App — and never uploaded: not to us, not to OpenAI, not to analytics. It is never part of a photo you take.
• Mannequins are drawn by generative AI. Only when you confirm — and only with an active Premium subscription — is the photo transmitted encrypted to our backend and stored in Cloudflare R2 under users/{your-ID}/custom-poses/{random-ID}/. The Worker sends it to the OpenAI Images API (model gpt-image-2), which repaints the person as a featureless Empose mannequin in the same pose; if you indicate that a long dress or coat hides the legs, the photo is first redrawn in plain sportswear so the legs can be traced. A text model (OpenAI gpt-4.1-mini) receives the photo once to write the pose's name, three steps and a camera tip in your app language, and rewrites an optional re-render note into a pose description. The photo, the renders and the job record are stored for a maximum of 90 days (same lifecycle rule as Section 3.2); the mannequin you keep is also saved on your iPhone, and poses you kept are restored from your account after a reinstall while they are within that period. Only kinds and counts of these actions (never the photo, its file name or location) are recorded in usage analytics.

3.6 Pose for Here (Scene Scan)

When you tap "Pose for here" in the camera on an iPhone, the App takes one small frame from the live camera and analyses it entirely on your device with Apple's built-in image recognition, to suggest where you are (for example a bench, stairs or a beach) and whether a person is in view full-length or from the waist up. Nothing is uploaded — not to us, not to OpenAI, not to anyone — and no one is identified. The frame is deleted as soon as it has been analysed, is never saved to your photo library and is never part of a photo you take. Usage analytics record only the App's own spot categories (such as "bench"), the framing and how long the scan took — never the image, Apple's recognition labels or their confidence values.

3.7 Monthly Recap

To show you a recap of last month (how many photos you saved, which poses you used most, and a few of your photos), the App keeps a small count of the photos you save each month on your device, with references to the six most recent ones. It is not uploaded and is kept for three months. The recap image is created on your device and only shared if you choose to share it. Usage analytics record only that the recap was opened or shared, the month and the number of photos.

3.8 Styling

Styling changes single features of the person in your photo at your request — for example the hair color or hairstyle, lips, makeup, brows, lashes, a beard, glasses, or temporary blemishes. Before anything is uploaded, the App checks on your device, with Apple's built-in image recognition, whether the photo shows a face at all, so a photo without one does not use a generation. This check only finds whether and where faces appear in the picture; it does not identify anyone, creates no facial geometry or template, and nothing from it is uploaded or kept. When you tap Create, the photo is processed exactly like a Look (Sections 3.1–3.3 and 4.1): it is sent with the predefined instructions of the options you chose, which tell the AI model to change only those features and to keep the person's identity — face shape and features, skin tone, expression and age — unchanged. Usage analytics record only that a Styling was created and which categories were chosen (for example "hair color, lips"), never the photo.

4. Disclosure to OpenAI (Image Generation) and Google (Firebase)

4.1 OpenAI (Images API)

The actual image generation is performed by the OpenAI Images API (model gpt-image-2.5-flare for Looks and Styling, gpt-image-2 for mannequin poses), and the texts of mannequin poses by an OpenAI text model (gpt-4.1-mini). Provider: OpenAI Ireland Ltd (contracting party for the EEA) or OpenAI, L.L.C. (USA). The photo and the predefined instruction are transmitted — exclusively from our backend, never directly from the App.

• Retention at OpenAI: OpenAI states that it does not use API inputs and outputs for training its models and only retains them temporarily for abuse monitoring (typically up to 30 days). Current details: https://openai.com/enterprise-privacy/.
• Third-country transfer: Data may be transferred to the USA; the EU Standard Contractual Clauses apply (part of the OpenAI Data Processing Addendum).
• Contractual data protection: OpenAI is contractually bound by its Data Processing Addendum (including the EU Standard Contractual Clauses) to provide the same or an equal level of data protection as described in this Privacy Policy and processes the data solely to provide the image generation service.
• OpenAI privacy policy: https://openai.com/policies/privacy-policy/

4.2 Google (Firebase Authentication, Cloud Firestore, Analytics, Crashlytics)

We use services provided by Google Ireland Ltd. and Google LLC:

• Firebase Authentication — assigns an anonymous UID per app installation. No personal login data is transmitted.
• Cloud Firestore — stores the generation metadata described in Section 3.1 (never the photos themselves).
• Firebase Analytics & Crashlytics — pseudonymous usage events (e.g. "a generation was started") and crash reports for stability. Not used for advertising or cross-app tracking.
• Third-country transfer: Data may be transferred to the USA. Google is certified under the EU-U.S. Data Privacy Framework; in addition, the EU Standard Contractual Clauses apply.
• Google privacy policy: https://policies.google.com/privacy
• Firebase privacy policy: https://firebase.google.com/support/privacy

5. Backend Hosting and Image Storage (Cloudflare)

Our backend runs as a Cloudflare Worker and stores images in Cloudflare R2. Provider: Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA.

• Cloudflare necessarily processes IP addresses, timestamps and request metadata for delivery and protection against attacks.
• R2 stores your uploaded and generated images encrypted.
• Legal basis: Art. 6 (1)(b) and (f) GDPR.
• A data processing agreement including the EU Standard Contractual Clauses is in place.
• Cloudflare is certified under the EU-U.S. Data Privacy Framework.
• Privacy policy: https://www.cloudflare.com/privacypolicy/

6. Subscriptions & Purchases (Apple / RevenueCat)

Purchases within the App — subscriptions and AI credit packs — are processed via the Apple App Store. For purchase validation, restoration and AI-credit assignment we use RevenueCat (RevenueCat, Inc., USA).

• We transmit to RevenueCat a pseudonymous app user ID, the purchase transaction provided by the App Store (original transaction ID, product ID, purchase date, expiration date) and technical metadata (app version, iOS version, device class).
• Purpose: proof of an active subscription, unlocking the Premium AI credits (25 per week, 15 during a free trial; a Look or Styling uses 1, a mannequin pose 2), granting purchased credit packs, restoration after reinstallation. Your credit balance (weekly use and purchased credits) is stored on our backend (Cloudflare) under your pseudonymous app user ID; purchased credits do not expire.
• Legal basis: Art. 6 (1)(b) GDPR.
• Privacy policy: https://www.revenuecat.com/privacy
• The actual payment process takes place exclusively between you and Apple. We receive neither your payment data nor your real name.

Subscription Details (Transparency Notice for the Paywall)

• Product names: Empose Pro Weekly (empose_pro_weekly) and Empose Pro Annual (empose_pro_annual)
• Duration: 1 week / 1 year; each renews automatically unless canceled at least 24 hours before the end of the current period.
• Cancellation: at any time in the Apple ID settings on your device.
• Price / trial period (if any): see the information shown directly on the paywall.
• Any unused portion of a free trial period is forfeited when a subscription is purchased.

AI Credit Packs (One-Time Purchases)

• Product names: 10 Credits (empose_credits_10), 30 Credits (empose_credits_30) and 60 Credits (empose_credits_60).
• One-time purchases (consumables), not subscriptions. Purchased credits do not expire; your weekly credits are used first. Credits can be used with an active Empose Premium subscription.
• Price: see the information shown in the App before purchase.
• Further terms for credits: Terms of Use – Empose.

7. Push Notifications

If you consent to push notifications, the App sends you a notification as soon as your AI generation or mannequin pose is finished. For this we use the Expo push service (Expo, Inc., USA) together with the Apple Push Notification Service (APNs). A pseudonymous push token linked to the progress status of your generation is transmitted; it is stored on our backend only temporarily. The contents of your photo are not transmitted to Expo or APNs.

• Legal basis: Art. 6 (1)(a) GDPR (consent via the iOS system dialog).
• Withdrawal: at any time in the iOS settings under "Notifications → Empose" or via the switch in the App's Settings.

8. App Permissions

All permissions are optional. If a permission is not granted, only the corresponding feature is unavailable. The App requests no microphone, location, or tracking permissions.

9. Retention Periods at a Glance

• Uploaded and generated images in Cloudflare R2 (Looks, Styling and mannequin poses): maximum of 90 days (automatic deletion via lifecycle rule); earlier as soon as you remove the creation or pose in the App.
• Photo guides on your iPhone: until you choose a pose or close the App.
• Poses saved on your iPhone: until you delete them in the App or delete the App.
• Generation metadata in Firestore: until deleted by you or by us on request.
• Push token on our backend: temporary, expires automatically.
• Error logs at Cloudflare: per Cloudflare's standard retention (typically a few days).
• Subscription/purchase status at RevenueCat: for the duration of the contractual relationship plus statutory retention periods.
• Temporary retention at OpenAI: see Section 4.

10. Your Rights

Under the GDPR you have the following rights:

• Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20).
• Objection to processing based on legitimate interests (Art. 21).
• Withdrawal of consent with effect for the future (Art. 7 (3)), e.g. by disabling the push permission in iOS.
• Right to lodge a complaint with a supervisory authority (Art. 77), e.g. the Luxembourg Commission nationale pour la protection des données (CNPD), 15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg, https://cnpd.public.lu.

Please direct any requests to: [email protected]

Since we store neither real names nor email addresses, we need your anonymous app user ID to identify your data. You can find it at the bottom of the App's Settings screen (tap to copy). Without this ID we are technically unable to identify you as a data subject.

11. Children

Empose is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13.

12. Security

All data transfers between the App, the backend, Cloudflare R2, OpenAI and Google are exclusively encrypted (TLS 1.2+). The OpenAI API key and all other credentials (Firebase service account, RevenueCat secret, signing secret) are stored exclusively as Cloudflare Worker secrets and never leave the backend. Direct access to stored images is only possible via signed, time-limited backend URLs bound to your user ID.

13. Changes to This Policy

We update this privacy policy whenever processing activities, legal bases or the services we use change. The current version is always available via the link in the App (paywall / settings). We will announce material changes in the App.