Privacy Policy for Dewora
We value every user and carefully protect the information you entrust to us in the Dewora app. This Policy explains what data we collect, how we process, store and use it, and what rights you have regarding your data.
The following definitions are used in this document:
- Privacy Policy (also "Policy") — the document you are reading;
- Dewora Application (also "app") — an iOS mobile application offering facial exercises and a weekly AI-based photo analysis, available on the App Store;
- SUNRISE, LLC, a limited liability company incorporated under the laws of the Republic of Armenia, TIN 08325795, state registration number 999.110.1588694 (hereinafter the "Company", "we"), registered address: 22A N. Zaryan St., Arabkir, Yerevan 0051, Republic of Armenia;
- Contact email: support@dewora.pro;
- Account — the user's personal account in the app;
- Personal Data — any information relating to a directly or indirectly identified or identifiable individual;
- Processing — any operation performed on personal data, with or without automation, including collection, recording, organisation, storage, updating, retrieval, use, transfer, depersonalisation, blocking, deletion and destruction.
The current version is available at: dewora.pro/en/privacy
1. Scope
This Policy applies to information we receive when you use the Dewora app and the website https://dewora.pro, and when the Company performs agreements with users.
It applies to users who are not citizens of the Russian Federation or other CIS countries and who use the app outside those countries. For users in Russia and the CIS, the Russian-language policy applies. By using the app you accept this Policy; if you disagree, please do not use the app.
The app is intended for people aged 18 and over only.
2. What Data We Process
Account
- email address — to sign in with a one-time code; or, with Sign in with Apple, your Apple user identifier and email address (which may be an Apple private relay address);
- name — optional, used only to greet you in the app;
- country — determines the available payment method.
Onboarding answers and daily check-ins
- onboarding: age range, gender, face zones of interest (puffiness, jawline, eyes, forehead), a contraindications checklist (used to exclude unsuitable exercises), preferred practice time and duration;
- daily check-ins: hours of sleep, glasses of water, salty food, alcohol, menstrual cycle phase (optional).
This data is stored on your device and synced to our server as your course state, so your course is preserved if you change phones.
Face photos
Daily photos are stored only on your phone and are not sent to our server.
Only with your separate consent are photos sent for analysis: the first scan during onboarding and the weekly analysis (days 7, 14, 21 and 28 of the course). Before sending, your phone aligns and crops the image to the face and removes all metadata (EXIF, GPS). No name or email is attached.
On our server, a photo exists only in memory for the duration of the request: it is forwarded through a proxy server in Germany to OpenAI (USA) for analysis and deleted immediately after the response is received. Photos are never written to disk, a database or logs.
OpenAI processes this data under its API data policy: API data is not used to train models and may be retained by OpenAI for up to 30 days for abuse monitoring.
Photos are not used to identify you or for face recognition.
We store only the analysis result in words (for each zone: less / no change / more) and the model's numeric scores per zone — without photos or text — to improve analysis quality.
You can withdraw your consent to photo analysis at any time in the app: Profile → Photos and data. After withdrawal, no photos are sent for analysis.
Payments
- Outside Russia, subscriptions are purchased through the App Store. Apple processes the payment; we never receive your card details. We receive the purchase status via RevenueCat.
- We keep a log of consents given for photo analysis and for payments.
Data collected automatically
- push notification token — for practice reminders and upcoming-charge reminders;
- app usage events (such as onboarding steps) and an install identifier — for product analytics;
- crash diagnostics;
- technical server logs (without photos).
We do not use advertising trackers and we do not sell user data.
The Company does not verify the accuracy of the data you provide and assumes that you provide accurate information and keep it up to date.
3. Purposes of Processing
The main purpose is to let you use the Dewora app and to improve its quality. Within this purpose, we process data to:
- create and maintain your account and enable sign-in;
- tailor your exercise course to your answers and contraindications;
- preserve your course state when you change devices;
- perform photo analysis where you have consented;
- manage your subscription and send reminders about upcoming charges;
- send notifications related to your use of the app;
- respond to requests and provide technical support;
- improve the app and analysis quality using depersonalised statistics;
- comply with legal obligations.
4. Not a Medical Service
The photo analysis and exercises in the app are not a medical service and do not replace a doctor's advice. The app does not provide any diagnosis and does not guarantee results; results vary from person to person.
5. Storage and Transfers to Third Parties
Our server is located in the Russian Federation (Timeweb, Novosibirsk). Encrypted backups are stored with a separate provider in the Russian Federation (Selectel) for no longer than 14 days; after account deletion, data disappears from backups when that period ends. By using the app, your account and course data are therefore stored in Russia.
Login-code and service emails are sent via the email services Unisender Go and SMTP.bz (Russian Federation); they receive only your email address and the message text. Crash diagnostics are collected with built-in iOS tools (MetricKit) and sent only to our server, with no third-party services.
Service providers we use
We share data with third parties only to the extent necessary for the app to work. We use the following service providers, each of which processes user data solely on our behalf and in accordance with our instructions, for the limited purposes described below. We do not sell user data and we do not transfer it to third parties for their own independent purposes, including advertising.
- OpenAI, L.L.C. (USA) — analysis of the face photos you send for the first scan and the weekly analysis, only with your separate consent, as described in section 2. The aligned and cropped photo, without metadata, name or email, is transmitted for this purpose through a proxy server in Germany. Data submitted through the OpenAI application programming interface is not used to train its models;
- RevenueCat, Inc. — management of subscriptions and verification of purchases made through the App Store. An application-generated user identifier and the status and history of your subscription are transmitted for this purpose. Payment card details are never transmitted to us or to RevenueCat;
- Unisender Go and SMTP.bz — delivery of transactional email messages, such as one-time login codes and service emails. Your email address and the message text are transmitted for this purpose;
- Apple Inc. — processing of payments for a subscription purchased through the App Store, and delivery of push notifications. Payment details are collected by the App Store directly from you and are governed by the terms of that store; we never receive or store them.
We also use a hosting provider to operate our servers (Timeweb, Russian Federation) and a separate provider for encrypted backups (Selectel S3, Russian Federation). These providers store data on our behalf and do not access its content for their own purposes. Face photos are never stored on our servers or in backups.
Transfers to other countries
We guarantee that in order to ensure the confidentiality of your personal data and the security of their processing, such transfer will be carried out exclusively in compliance with all requirements of applicable legislation.
We may transfer your personal data to third parties (including partners, service providers, Dewora affiliates, etc.) located in other countries, including the Russian Federation (storage of account and course data) and the USA (photo analysis by OpenAI), subject to compliance with the necessary requirements of the Law of the Republic of Armenia of 13 June 2015 No. 49-ZR on the Protection of Personal Data.
At the same time, before such transfer, we always obtain confirmation that such countries provide adequate protection of your personal data, and thus your personal data will be protected no less reliably than is ensured in the Republic of Armenia.
In addition to the above conditions, if such processing is carried out in whole or in part in countries that do not provide an adequate level of personal data protection in accordance with applicable legislation, such processing will be carried out exclusively in compliance with all legal requirements and with the necessary legal grounds.
In the event of transfer of your personal data outside of the Republic of Armenia, Dewora ensures its legality, including but not limited to the existence of legal grounds for such transfer as provided by law and compliance with other requirements of the Law of the Republic of Armenia of 13 June 2015 No. 49-ZR on the Protection of Personal Data.
Cross-border transfer. Sending photos for analysis is a cross-border transfer of personal data to the USA (through a proxy server in Germany). It happens only with your separate consent and in compliance with the Law of the Republic of Armenia of 13 June 2015 No. 49-ZR on the Protection of Personal Data and other applicable law. Without your consent, photos never leave your device.
We may partially share data with third parties if:
- the user has consented to such actions;
- the transfer is necessary for the user to use the application or to fulfill a specific agreement or contract with the user;
- the transfer is required by the applicable legislation of the Republic of Armenia or other applicable legislation within the framework of legally established procedures;
- for the purpose of protecting the rights and legitimate interests of the Company or third parties, for example, in cases where the user violates the Terms of Use, this Policy, or other assumed obligations.
The Company stores users' personal information in accordance with applicable legislation of the Republic of Armenia, this Policy, and the Company's internal regulations.
The user's personal data is processed by the Company throughout the entire period of the user's use of the application and/or the validity of agreements and contracts with the user, taking into account the requirements of applicable legislation of the Republic of Armenia.
6. Your Rights; Changing and Deleting Data
You have the right to access your data, request its correction or deletion, and withdraw your consent to photo analysis in Profile → Photos and data.
You can delete your account in the app: Profile → Delete account. This deletes your course data, analysis results, consents and analysis records from our server. You can also send a deletion request to support@dewora.pro from the email address linked to your account; such requests are fulfilled within 10 business days.
Before you delete your account: active subscriptions
Deleting your Dewora account does not cancel a paid subscription and does not by itself result in a refund. Subscriptions are billed by the app store you purchased them from, and only you can cancel them: open Settings on your device, tap your name, go to Subscriptions, select the Dewora subscription and cancel it.
Please cancel your subscription before requesting deletion of your account. If you have already deleted your account and are unsure whether your subscription is still active, write to support@dewora.pro and we will help you check its status and direct your refund request to the appropriate app store.
What is retained and for how long
We retain the following data after the deletion of your account, in the minimum volume necessary:
- records of payments and subscription transactions — retained for the period required by the accounting and tax legislation applicable to the Company, which is 5 years from the end of the reporting year in which the transaction took place. These records are stored separately and are not used to restore your profile;
- data whose retention is required by law — retained for the period established by the applicable legislation, and transferred to a government authority only in accordance with a legally established procedure.
Your rights may be limited by law, including the Company's obligation to retain certain information for a legally required period.
7. Data Protection
The Company takes necessary and sufficient organisational and technical measures to protect personal data against unauthorised or accidental access, destruction, alteration, blocking, copying and disclosure. Data is transmitted over secure connections, and backups are encrypted.
8. Minors
You must be at least 18 years old to use Dewora. If you suspect that a minor is using the app, please let us know: we will verify the user's age and, if necessary, delete the account and associated data.
9. Changes to this Policy
The Company may amend this Policy and will inform users in the app. A new version takes effect when published unless it states otherwise. Continued use of the app after changes means you accept them.
10. Applicable Law
This Policy and the relations between the user and the Company arising from it are governed by the laws of the Republic of Armenia.
11. Contact
Send all requests regarding personal data to support@dewora.pro.