Privacy Policy
Lixora AI: AI Photo & Beauty
Privacy Policy
Lixora AI: AI Photo & Beauty
Lixora AI: AI Photo & Beauty
Privacy Policy
Last updated: 6 October 2026
This policy explains what information the Lixora AI mobile application (“Lixora”, “the app”, “we”, “us”) handles, why, with whom it is shared, how long it is kept, and the choices you have. It describes how the app actually works. Where something is not yet known — such as our legal name and contact details — it is marked as a placeholder and will be completed before the app is published.
Lixora is provided by SOULAIMAN EL HADDAD SOLE MBR (“the developer”), which is responsible for the personal information described in this policy.
Contact for privacy questions and requests: Cantact@devnexalabs.com
• Postal address (where required by law):
• 30 N Gould St Ste R
• Sheridan, WY 82801
• USA
To create an account you provide an email address and a password. The password is stored by our authentication provider (Supabase) only as a cryptographic hash; we cannot read it. Your account is identified internally by a random user identifier. You can browse the app without an account; an account is required to purchase a subscription and to run AI features. We do not require email verification to use the service.
When you run an AI feature you choose one or more photos (from your device through the system photo picker, or by taking a photo with your device’s camera) and, for some features, options or a short text description (a “prompt”). See section 4 for exactly how photos are handled.
• Purchases are made through Google Play Billing or the Apple App Store. The store processes payment; we receive confirmation that a purchase or renewal happened, the product purchased, and its status (active, renewed, expired, refunded). We do not receive your payment card details.
• RevenueCat, our subscription-management provider, receives your purchase history and your random user identifier so that purchases can be verified and restored. We do not send RevenueCat your email address.
• Credit and usage records: your credit balance (plan credits and purchased credits), a record of each credit grant and deduction, your subscription period, daily-reward claims, and a record of each AI operation (the feature used, its status, the credits charged, the platform, timestamps and a technical reference number). These records contain no photos.
If you report an AI result as offensive, we record the reason you chose and which feature or operation it concerns. The image itself is not sent. Reports are kept for up to 5 days and then deleted automatically.
Like any internet service, our servers process technical data needed to deliver the service and keep it secure, such as your
IP address, the time of a request and a technical reference number for troubleshooting. Our hosting provider keeps such logs for a limited period. For abuse protection (rate limiting) we store only a one-way hash of an IP address, never the address itself. Our logs are designed not to contain photos, prompts, passwords or access tokens.
The app stores on your device: results you choose to keep (the in-app “Local Gallery”), your language choice, a copy of the app’s feature catalogue and prices, your last known credit balance (so it can be shown when you are offline), and cached example images. This information stays on your device; we cannot access it. It is removed when you uninstall the app, and you can delete your saved results at any time in Settings.
We do not collect your precise or approximate location, contacts, messages, browsing history, advertising identifier, or health information. We do not use analytics, advertising or crash-reporting tools, and we do not build advertising profiles.
1. On your device. You choose the photo yourself. Before the photo is stored by the app or sent anywhere, the app removes embedded metadata such as GPS location and camera details. The app reads only the photos you select; it does not scan your photo library.
2. In transit. The photo is sent over an encrypted connection (HTTPS) to our backend, hosted by Supabase in the European Union (Paris, France region).
3. AI processing. Our backend sends the photo to Perfect Corp., the third-party AI provider that performs the edit or analysis you requested, solely for that purpose. Some features analyse facial, hair or body characteristics visible in the photo in order to apply the effect you asked for. We do not use your photos to identify you, and we do not create or keep facial-recognition templates.
Temporary storage of the result. So that a result you paid for is not lost if the app closes or the connection drops, the result is kept in private, access-controlled storage for up to
1. 24 hours. It is deleted as soon as you keep it or choose to leave it, and in any case when the 24-hour window ends.
2. The provider’s copies. When an operation ends we ask Perfect Corp to delete its copy of the task’s inputs and outputs. According to Perfect Corp’s documentation, files it receives are deleted automatically after a short period (uploaded files after one day, results after 30 days) even if such a request does not reach it.
3. On your device. Results you keep are saved in the app’s private storage on your device, and in your phone’s photo library only if you choose “Save to device gallery”.
We do not use your photos, prompts or results to train AI models. We do not sell them, publish them, or show them to other users — the app has no social or sharing feed.
5. Why we use information (and legal bases)
Create and secure your account; let you sign in and reset your password:
Information: Email, password hash, user identifier.
Legal basis (where EU/UK law applies): Performance of our contract with you.
Perform the AI features you request:
Information: Photos, options, prompts.
Legal basis (where EU/UK law applies): Performance of contract.
Verify purchases, grant subscription credits and purchased credits, apply refunds:
Information: Purchase, subscription and credit records.
Legal basis (where EU/UK law applies): Performance of contract; legal obligations (accounting).
Charge credits only for successful results and keep an auditable record:
Information: Operation and credit records.
Legal basis (where EU/UK law applies): Performance of contract; legitimate interests (preventing fraud and billing errors).
Keep the service secure and prevent abuse:
Information: Technical data, hashed IP addresses, reports.
Legal basis (where EU/UK law applies): Legitimate interests (security, abuse prevention).
Review reports of offensive AI output:
Information: Report reason and the feature or operation concerned.
Legal basis (where EU/UK law applies): Legitimate interests; compliance with app-store policies.
Respond to your requests and support questions:
Information: Your messages and contact details.
Legal basis (where EU/UK law applies): Legitimate interests; legal obligations.
We do not use your information for automated decisions that produce legal or similarly significant effects on you.
6. Who we share information with
We share personal information only with the service providers that run the app on our behalf, under contracts that limit their use of it.
Supabase:
Role: Backend hosting, database, authentication, temporary result storage (EU — Paris, France region).
Information: Account, credit, purchase-status and operation records; photos and results in transit and temporarily.
Perfect Corp.:
Role: AI photo processing.
Information: The photos, options and prompts for the operation you request.
RevenueCat:
Role: Subscription and purchase management.
Information: Purchase history and your random user identifier.
Google (Google Play) / Apple (App Store):
Role: Payment processing and app distribution.
Information: Information you provide to them under their own terms and privacy policies.
We may also disclose information if required by law, to protect the rights, safety or property of users or others, or as part of a merger or acquisition, in which case this policy would continue to apply. We do not sell personal information and we do not share it for cross-context behavioural advertising.
Our backend and database are hosted in the European Union. Our AI provider and subscription provider may process information in other countries. Where information is transferred out of the European Economic Area or the United Kingdom, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an adequacy decision.
In the app: Settings → Account → Delete account. This permanently deletes your account, your credit balance, subscription and billing-period records, daily-reward records, operation records and reports. Before your account is removed, any result still held in temporary storage is deleted and we ask our AI provider to delete its remaining copies.
Without the app: you can request deletion by contacting Cantact@devnexalabs.com
from the email address of your account.
What is kept: the record of credit transactions, for accounting, linked only to an identifier that no longer maps to you; and records that Google, Apple or RevenueCat keep about purchases under their own policies. Deleting your account does not cancel a subscription — cancel it in Google Play or the App Store (see section 11). Results saved on your device are not affected by account deletion; you can delete them in Settings → Delete local results, or by uninstalling the app.
Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent where processing is based on consent. You can exercise most of these rights directly in the app; for anything else, contact us at Cantact@devnexalabs.com
. We will respond within the time required by applicable law. If you are in the EU or UK you also have the right to lodge a complaint with your local data protection authority. We do not discriminate against you for exercising your rights.
Subscriptions and credit packs are sold through Google Play or the Apple App Store, and their prices are shown by the store. Payment, renewal and cancellation are handled by the store: you can manage or cancel a subscription in your Google Play account (Subscriptions) or in your Apple ID settings. Refunds are governed by the store’s refund policies. The store’s own privacy policy applies to the information you give it.
• Camera — only when you choose to take a photo; the photo is captured by your device’s camera app.
• Photos — the system photo picker gives the app only the photos you select. On iOS, saving a result uses “add only” access where available. On older Android versions (10 and below) the app may ask for storage permission when you save a result to your device gallery.
• Internet and network state — to run AI features and to detect when you are offline.
• Billing — to make purchases through the store.
Permissions are requested only when you use the related function. If you decline, the rest of the app keeps working.
We protect information with measures appropriate to its sensitivity, including encryption in transit (HTTPS), access controls that prevent users from reading or changing anyone else’s data, server-side verification of all purchases and credit changes, and keeping service credentials out of the app. No method of transmission or storage is completely secure, but we work to protect your information and to limit what we keep.
Lixora is not directed to children under 13, and we do not knowingly collect personal information from children under 13 (or under the minimum age required by the law of your country). If you believe a child has provided us with personal information, contact us and we will delete it.
We may update this policy from time to time. We will change the “Last updated” date above and, where the changes are significant, tell you in the app or by other appropriate means before they take effect.
DEVNEXA LLC
SOULAIMAN EL HADDAD SOLE MBR
Email: admin@devnexalabs.com
Support: Cantact@devnexalabs.com
Address:
30 N Gould St Ste R
Sheridan, WY 82801
USA
Lixora AI: AI Photo & Beauty — Privacy Policy — Last updated 6 October 2026