Photelle
← Back to website

Photelle Privacy Policy

Version 2.0 Published and effective: September 27, 2026

AI CORTEX NEXUS LIMITED ("we", "us", or the "Company") operates Photelle. This policy explains how the Photelle iOS app, websites, APIs, customer support, and related services collect, use, store, disclose, transfer, protect, and delete personal data.

Photelle is displayed as “出片” in the Simplified Chinese and Traditional Chinese localizations. Both names refer to the same app and service operated by the Company.

Please read this policy before using Photelle. We provide a prominent notice and request explicit consent before a photo is first sent for AI processing. If cross-app tracking or an advertising identifier is involved, we separately request permission through Apple's App Tracking Transparency (ATT) framework. Refusing ATT does not affect login, retouching, saving, or purchases.

1. Scope

This policy applies to the Photelle app and the services directly required to operate it. A service provider acting on our instructions may process only the data necessary for its assigned service. If a third party independently determines a different purpose or method, its own terms and legal obligations apply.

2. Data we process

2.1 Account and identity data

After you accept the applicable terms and choose Start Now, the new version creates a device account. We process a random device identifier, your Photelle user ID, account status, session version, and authentication tokens to provide that account and single-device sign-in. Credentials are kept in system secure storage; we do not infer your original account from a device fingerprint if you change devices or lose credentials.

You may independently sign in or register with email, or link email and a password to your current account. We process the email address, a salted non-reversible password hash, and six-digit codes with their purpose and device or account context for registration, linking, password recovery, and security verification. Codes are valid for ten minutes by default; we never store or email a plaintext password. A new email account is created only after code verification. An existing email opens its original account after password verification; an incorrect password never creates another account. Linking preserves the current account.

For Apple sign-in or linking, we verify Apple's identity token and process its stable user identifier and any email or relay address you authorize Apple to share, never your Apple password. An existing Apple identity opens its original account; a newly verified identity may create an account. Linking adds the identity to the current account. We do not merge accounts or expose another account's private photos based only on an email returned by Apple. Linking email or Apple is not required for editing or purchasing. Previously released versions may continue to process phone numbers and SMS codes during a compatibility period; the new version has no phone sign-up or sign-in option. Successful sign-in on a new device invalidates the previous device session. Support recovery requires ownership verification; a user ID or purchase receipt alone does not grant access to an original account's private photos.

2.2 Photos that may contain faces, editing instructions, and results

When you choose and submit a photo, we process the original photo and optional reference images; marks, normalized coordinates, quick prompts, text instructions, brush paths, removal masks, output ratio and size; task status and processing stage; generated result, thumbnail, and original/result relationship; and the history and continuation relationship for that task.

Photos may contain a person's face, body, surroundings, text, location clues, or camera metadata. In this policy, photos containing a face and their related editing information are called face-containing photos and related data.

Photelle does not access Face ID or TrueDepth data. We do not create face templates, biometric identifiers, facial feature vectors, face meshes, or identity profiles. We do not use a face to identify, authenticate, track, profile, or advertise to a person. Face-containing photos and related data are used only to perform the retouching or removal requested by the user, return and display the result, maintain the user's history, permit continued editing, recover a task, and investigate a service failure. We do not sell this data or use it to train general-purpose AI models.

Do not upload identification documents, bank cards, medical records, intimate images, sensitive images of minors, or any material you are not authorized to process.

2.3 Purchases and entitlements

We process Apple product and transaction identifiers, original transaction identifier, purchase and expiry times, subscription status, refund or revocation status, credit balance, expiry, and usage records. We do not receive your full card number or Apple payment password.

When you explicitly confirm cross-account purchase recovery, we verify signed transaction evidence and ownership and record the source and destination account identifiers, subscription and transaction, current period, remaining credits moved, signature date, and recovery time. These minimal audit records prevent duplicate claims and support renewals, refunds, and disputes; they follow the payment, security, and legal retention rules below and are not used for advertising. Subscription recovery does not move or expose the original account's photos or editing history. Claims that cannot be verified automatically require support verification.

2.4 Device, network, interaction, and diagnostic data

We may process device model, OS and app version, language and region, a random app/device identifier, IDFV, IP address, network type, request time and path, task status, error code, crash or performance information, and security events. Minimal interaction events can include login method and new-user status, image source type, editing mode, number of quick prompts or marks, whether a custom request was entered, success/failure category, duration band, save action, membership-page view, product identifier, price, currency, and a hashed transaction identifier.

IDFA is accessed only after ATT permission. We do not send Google or Meta any photo pixels, face data, reference images, marks, masks, prompt text, phone number, email address, Photelle user ID, task ID, or image/result URL.

2.5 Support data and permissions

If you contact support, we process the issue, contact details, relevant task ID, screenshots or attachments, and communications. Photo read access is used only when you choose an image; photo add access is used only when you save a result. We do not scan your entire photo library.

3. Purposes

We use data to create and secure accounts; process and deliver AI edits; calculate, deduct, refund, and display credits; validate Apple purchases; provide history and continued editing; respond to support; prevent fraud and abuse; monitor reliability; analyze product use and conversion; measure our own Google and Meta advertising after the required consent; comply with accounting, legal, audit, and dispute obligations; and protect users and the service.

We do not sell personal data, use face-containing photos for advertising or profiling, or make a solely automated decision that has a significant legal or similarly serious effect on a user.

4. AI processing and explicit consent

Before the first AI task, Photelle explains that the original photo, optional reference images, marks, masks, text instructions, and output settings required for the task will be transmitted over an encrypted connection to necessary third-party AI image-processing providers, and asks for explicit consent. Without consent, no AI task is submitted. Consent can be withdrawn for future tasks; withdrawal does not undo processing already lawfully completed.

Providers are authorized only to process the data necessary to complete the requested task, maintain security, and meet legal obligations. We do not authorize identity recognition, advertising, data brokerage, unrelated profiling, or general-purpose AI training. Providers and routes may change for quality, availability, and regional operation, but we require equivalent purpose limitation and data protection. We update this policy and obtain any required new consent before a material change.

5. Disclosure and service providers

We disclose only the minimum necessary data to:

  1. Apple and its affiliates for app distribution, Sign in with Apple, in-app purchases, subscriptions, permissions, and privacy-preserving attribution;
  2. Resend for email-registration, linking, password-recovery, and security-verification email delivery; it may process the email address, verification email content, delivery status, IP address, and necessary logs, but not your password or photos;
  3. NetEase Yunxin for SMS verification only for previously released app versions during the compatibility period;
  4. Alibaba Cloud OSS or another configured infrastructure provider for object storage, delivery, databases, queues, logs, backup, and recovery;
  5. necessary third-party AI image-processing providers for the retouching, removal, or generation task you submit;
  6. Google Firebase Analytics for product analytics and Google campaign attribution; and Meta App Events for Meta campaign attribution and optimization;
  7. professional advisers, transaction participants, or competent authorities when legally necessary.

Photos and face data are not disclosed to Google or Meta for analytics or advertising. We use contractual terms, published processing rules, encryption, access control, minimization, and audit measures appropriate to each provider.

6. International transfers and storage location

Photelle is offered in the countries and regions where its Apple App Store listing is available; mainland China and the 27 European Union member states are not currently included. Account data, task records, balances, and history records are primarily stored on application servers and databases in Hong Kong SAR. Original and reference photos, masks, results, and task files use Alibaba Cloud Object Storage in the Beijing region of mainland China. Depending on your location, these transfers may be cross-border transfers.

Necessary task data may also be transmitted to the infrastructure used by the selected AI provider. Google and Meta may process minimal device, interaction, and purchase events on their global infrastructure, but they do not receive face-containing photos or related editing data.

We plan to migrate some or all services and data to a Japan region when operationally ready. Until migration is completed, Japan remains a plan rather than the current primary application-server or object-storage location. Before a material change to the actual location or transfer path, we will update this policy and provide any legally required notice or consent.

7. Retention and deletion

  1. Account data is kept while the account exists. After an account-deletion request, and absent a legal hold or dispute, we normally delete or anonymize the account and files under our control within 15 business days.
  2. Email verification codes are valid for ten minutes by default. SMS codes remain only for legacy compatibility and use the period shown in the old app. Codes cannot be reused after expiry or successful verification. Delivery and security logs are retained only as needed for fraud prevention, audit, and law.
  3. Original photos, reference images, masks, results, thumbnails, and task history for a successful task are retained while required to provide history, continued editing, and re-download, up to account deletion or a verified image-deletion request.
  4. Not tapping “Save to Photos” only means no extra copy was written to the device. If the task remains in Photelle history, its images may remain on our server.
  5. Deleting a history item removes it from the history interface. To request deletion of associated server files, email us. We normally complete a verified request within 15 business days. Account deletion triggers deletion of account-associated images.
  6. A copy saved to Apple Photos is independently controlled by your device and any iCloud Photos settings. Removing a Photelle record does not remove that local copy.
  7. Purchase and accounting records are kept as necessary for tax, fraud, refund, and dispute obligations. Operational and security logs are kept for the shortest necessary period and normally contain task identifiers and error data, not the original face photo.
  8. Firebase user-level event retention is configured to two months with reset-on-new-activity disabled. Aggregated or de-identified reports and data required by a provider for security or law follow the applicable provider rules. We do not separately store IDFA in our business database.

8. Security

We use HTTPS, authentication, role-based access, database isolation, protected credentials, encryption where appropriate, rate limiting, monitoring, audit logs, backups, and confidentiality obligations. No internet service can guarantee absolute security. If an incident may materially affect users, we will investigate, mitigate, notify affected users and authorities when required, and provide practical protective steps.

9. Your choices and rights

Subject to applicable law, you may request access, a copy, correction, deletion, restriction, or an explanation; withdraw a revocable consent; object to unnecessary processing; delete an individual record; delete your account in Profile — Account & Security — Delete Account; or make a complaint. We may verify identity and normally respond within 15 business days.

Photo and tracking permissions can be changed in iOS Settings. Withdrawing ATT permission does not affect core functionality. Deleting a Photelle account does not cancel an Apple subscription; manage or cancel it in your Apple account subscriptions.

10. Children

Photelle is not directed to children. Users under 18 should use it with a guardian's guidance, and processing of a child's personal data requires the consent required by applicable law. A guardian may contact us to request access, correction, or deletion.

11. Analytics and advertising attribution

Photelle does not display third-party ads. Firebase Analytics and Meta App Events help us understand product performance and measure our Google and Meta advertising. Apple AdServices is used to determine whether an install or redownload came from Apple Ads and may return campaign, ad group, keyword, country or region, and conversion details. Our server sends Apple's short-lived opaque token directly to Apple, stores only a non-reversible digest for deduplication, and does not send photos, edit instructions, email addresses, or phone numbers to Apple Ads. This Apple Ads attribution does not require access to IDFA. Without ATT permission, the app does not access IDFA or perform IDFA-based cross-app tracking, although privacy-preserving attribution and non-photo basic analytics may still operate. After ATT permission, permitted identifiers, product interactions, and purchase events may be used for Google and Meta attribution and optimization. You can withdraw ATT permission at any time.

When you visit the Photelle website, the web server records the access time, requested path, referrer, browser information, and IP address for security and aggregate traffic measurement. Clicking an App Store button also sends a first-party request that records the page language, campaign market, button placement, and campaign code; it contains no photos, editing content, or account contact details. Only if you allow ad measurement on the website do we load Meta Pixel to send page-view and App Store button-click events to Meta; related cookies may be used. You can stop future sharing through “Ad measurement settings” in the website footer. Declining or withdrawing does not affect browsing or downloading. Your website choice is separate from the app's ATT permission.

12. Policy updates

We may update this policy for legal, operational, technical, provider, or product changes. Before a material change to purposes, data categories, sharing, location, or rights takes effect, we provide a prominent notice and obtain renewed consent where required. The online page shows the current version.

13. Contact

Controller and operator: AI CORTEX NEXUS LIMITED

Product: Photelle Privacy email: aotemanai2023@163.com

We normally respond to a complete request within 15 business days, subject to any mandatory local deadline.