Privacy Policy

No account, no profile

Vela works the moment it opens. There is no sign-up, no login and no form. We never ask for your name, your email address, your phone number or your date of birth, so there is no profile of you for us to hold, sell or lose.

Your photos

• When you develop a photo, that one photo is sent over an encrypted connection to our develop service so the edit can be made. Nothing else in your photo library is read or sent.
• The finished photo comes straight back to your iPhone. We do not save it, we do not log it, and we keep no copy of either the photo you sent or the one you got back once the response has been returned.
• Your originals and your edits live only on your iPhone, in Vela’s own gallery. There is no cloud storage, no sync and no backup on our side. Delete the app and they are gone with it.
• We never look at your photos, and nobody at Vela can, because there is nothing kept to look at.

The legal basis is Art. 6(1)(b) GDPR: developing the photo is the service you asked for.

Who else is involved

Parts of the service are provided by specialist companies working on our instructions under data processing agreements. We keep that to the smallest set that makes the app work:

• a cloud platform that hosts our develop service, on servers in the European Union
• an image processing provider, which turns the photo you sent into the edit you get back
• subscription infrastructure, which tells our service whether a subscription is active
• a product analytics provider, on European hosting
• an email provider, for messages you send us
• a hosting provider for this website

None of them may use anything of yours for their own purposes. Your photo is used only to return your edit, and it is not used to train or improve anybody’s services. An image processing provider may hold a photo briefly to detect abuse of its service before deleting it. We may change any of these providers as the service develops. If you want to know which companies these currently are, write to admin@aventurin-international.com and we will tell you.

Some of this processing can happen outside the European Union. Where it does, the transfer is covered by the European Commission’s standard contractual clauses or by an adequacy decision for the country concerned.

Your subscription

Vela requires a subscription. You buy it from Apple, and it is managed through your Apple Account. Apple does not pass us your name, your Apple Account, your email address or your payment details, and we never see them. Our subscription infrastructure is provided by RevenueCat (RevenueCat, Inc.), which tells our service one thing: whether a subscription is currently active. See Apple’s privacy policy and RevenueCat’s privacy policy for how each of them handles data.

To keep the service affordable and to stop it being abused, we count how many photos have been developed on a subscription. That count is held against a one-way scrambled reference derived from the subscription itself. It carries no name, no email address, no device identifier and nothing from your photos, and it cannot be turned back into anything that identifies you. We also record the outcome of each develop and how long it took, so we can tell whether the service is working. The legal bases are Art. 6(1)(b) GDPR for running the subscription you bought and Art. 6(1)(f) GDPR for our legitimate interest in preventing abuse and understanding what the service costs to run. We keep these records only as long as they serve those purposes.

Analytics in the app

We measure how the app is used and collect technical reports when something goes wrong, so we can see which screens are used, where people get stuck and what is broken. It is how we find out that something needs fixing. This is done through the analytics provider named in the section above, on European hosting.

• Events are keyed to the random identifier our subscription infrastructure gives your copy of the app. It stays on your device so that purchases can be restored, and Vela saves nothing of its own there for analytics. Because it stays the same, we can see how the app is used over time and tell that two visits came from the same phone. It is never your name or your email address, because we do not have either.
• No photo, no part of a photo and no file name is ever sent.
• Your IP address is used to work out your approximate location, such as your city, and is then discarded.

The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in understanding and improving the app. You can object at any time by writing to admin@aventurin-international.com.

The Collection

The Collection is the small set of photos shown inside the app. A photo appears there only when the person who made it sent it to us themselves and agreed that we may publish it. Nothing is ever taken from the app for this. There is no submission feature, and there is no path by which one of your photos reaches The Collection without you sending it to us.

Where a photo is chosen, the before and the after can appear in The Collection in the app, on this website, in App Store material and on Vela’s own social accounts. It is credited the way we agree with the sender, normally with their social handle, city and country. It goes nowhere else. It is never sold and never passed to anyone.

The legal basis is your consent, Art. 6(1)(a) GDPR, together with Art. 9(2)(a) GDPR, since a photograph of a person can reveal characteristics that count as special category data. You can withdraw that consent at any time, with no reason and no consequence, by writing to admin@aventurin-international.com. We take the photo down from every surface we control. Withdrawing does not affect anything published before you withdrew, and an App Store screenshot or a printed copy already in circulation may take a release to catch up.

When you write to us

If you email us or use the contact form, we receive what you send: your message, your email address, and the name you give. We use it to answer you and for any follow-up on the same matter, under Art. 6(1)(b) and Art. 6(1)(f) GDPR. Messages sent through the form are delivered to our own inbox by our email provider. We keep correspondence for as long as it might reasonably matter, and longer only where German commercial or tax law requires it.

This website

This site sets no cookies, runs no analytics and embeds nothing that watches you. There is nothing here to consent to.

Our hosting provider processes the technical data any web server needs in order to answer a request, including your IP address, and keeps it briefly to deliver the site and keep it secure. The legal basis is Art. 6(1)(f) GDPR.

Your rights

Under the GDPR you have the right to:

• access the data we hold about you (Art. 15)
• have it corrected (Art. 16) or erased (Art. 17)
• have its processing restricted (Art. 18)
• receive it in a portable form (Art. 20)
• object to processing based on our legitimate interests (Art. 21)
• withdraw any consent you gave, at any time, with effect for the future (Art. 7(3))

Write to admin@aventurin-international.com and we will handle it. One honest limitation: because Vela has no accounts, we usually hold nothing that can be connected to you as a person, and we will not collect extra information just to be able to look you up (Art. 11 GDPR). If you want us to find something, tell us what would identify it.

You also have the right to complain to a supervisory authority. Ours is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany. You may also complain to the authority where you live.

Children

Vela is not intended for children under 16, and we do not knowingly process their data.

Changes to this policy

If we change how any of this works, we will change this page and the date at the top of it.

Who is responsible

The controller for the processing described here is Gabriel Salapic, trading as Aventurin International e.K., Schachenmeierstraße 66, 80636 München, Deutschland. Questions about any of this, and any of the requests above, go to admin@aventurin-international.com. Full details are on the legal notice page.

We have not appointed a data protection officer, because we are not required to have one.