Privacy Policy

Last updated 13 September 2026

1. Who we are

VeraDerm is operated by Teejay Swain, trading as Swain Labs, a sole trader based in the United Kingdom. We are the data controller for the personal data described in this policy. You can contact us about anything in it at support@veraderm.app.

2. What stays on your device

The following is stored only on your phone and is not sent to us unless a section below says so:

• your scan history (up to your last 100 scans), including the ingredient text read from each label — if you have an account, a copy of your most recent scans is also kept on our server, as described below;
• the products in your morning and evening routine, if you have not created an account;
• your skin profile answers;
• your personal list of trigger ingredients;
• your app settings.

Deleting the app deletes this information. Label photos are used to read the text and are not saved in the app.

3. What we collect, why, and our lawful basis

Your account

If you create an account we store your first and last name, your email address, your password (only as a salted scrypt hash, never the password itself), your plan and when it last changed, when you signed up, and the device identifier of the phone you signed up on. Each time you sign in we store a hashed session token, which expires after 60 days or when you log out.

Why: to run your account, sign you in and apply your plan. Lawful basis: performing our contract with you. Kept: until you delete your account.

Your routines

If you have an account, your routines are stored on our server against it: each routine's name and description, the products in it (name, brand, barcode, product type, time of day and the ingredient list read from the label), your own star rating of the routine, and any notes you write about it. They are stored so your routines follow your account between phones, and so the number of routines and products your plan includes can be applied. The notes are yours: they are not sent to any AI feature and are not read by anyone.

Why: to keep your routines with your account and apply your plan. Lawful basis: performing our contract with you. Kept: until you delete the routine or your account.

Your scan history

If you have an account, a copy of your most recent scans is stored on our server against it: for each scan, the ingredient text read from the label, the separated ingredient list, the product name, brand, barcode and type where known, when it was scanned, and a link to the product photo where one exists. How many scans are kept depends on your plan — 20 on Free, 500 on Premium — and the phone itself keeps up to 100 regardless. The copy is stored so your scans follow your account to a new phone. It is not sent to any AI feature and is not read by anyone.

Why: to keep your scan history with your account. Lawful basis: performing our contract with you. Kept: until you remove the scan or delete your account, and in any case no longer than two years after your last scan.

Device identifier

Our server gives each installation of the app a random identifier. It is used to count product confirmations fairly and to stop free allowances being abused. It is not used for advertising and is not linked to your identity unless you sign up on that device.

Lawful basis: our legitimate interest in keeping the service fair and working. Kept: while it is attached to a product submission or account.

Label photos and label text

If you are signed in and cloud reading is used, the cropped photo of the label is sent to our server and on to Google Cloud Vision, which reads the text and returns it. The text may then be sent to OpenAI to separate the ingredient list from other writing on the label. We do not store the photo or the text on our servers. When the app reads a label on your device instead, the photo does not leave your phone.

Lawful basis: performing our contract with you.

Barcode lookups

When you scan a barcode, the number is sent to our server and, directly from your phone, to Open Beauty Facts, a community product database. Open Beauty Facts receives the barcode and your IP address, and handles them under its own privacy policy.

Product submissions

If you save a product against a barcode or confirm one, we store the barcode, product name, brand, product type, ingredient list and date, along with your account or device identifier so independent confirmations can be counted. The product information is shown to other users. Your identity is not.

Lawful basis: our legitimate interest in building an accurate shared product database. Kept: as part of the shared database. If you delete your account, the identifier on your submissions no longer links to any account.

Premium AI features

When you ask for an AI routine review, ask a follow-up question, or ask Vera about a product, we send the products involved (names, brands, types, time of day and ingredient lists), your skin profile answers, your trigger ingredients and any question you type. They go to our server, which works out the findings, and then to OpenAI to write the response. We keep the review or conversation for up to 90 days, so follow-up questions work and you are not charged twice for the same routine.

OpenAI processes this under its API terms. It does not use API data to train its models by default, and may keep it for up to 30 days to monitor for abuse.

Lawful basis: performing our contract with you, and your explicit consent for your skin information (see section 4).

Usage counters

We count how many cloud scans and AI credits each account uses each month, so we can apply your plan's allowance. Kept: for about 13 months.

Subscriptions

Premium is bought through the Apple App Store or Google Play, which take your payment. We never see your card details. RevenueCat, our subscription provider, receives your account identifier and the store's purchase receipts, and tells us whether Premium is active. Lawful basis: performing our contract with you. Kept: for as long as you have an account, and as long as the law requires for financial records.

Technical data

Your IP address is used briefly in memory to limit how often requests can be made. Our hosting provider may keep server logs, which can include IP addresses, for a limited period for security and troubleshooting. Lawful basis: our legitimate interest in keeping the service secure.

Support emails

If you email us, we keep the conversation for as long as needed to help you, and then for up to 2 years in case you get back in touch.

4. Skin information

Your skin type, how sensitive your skin is, how often you break out, and the ingredients you react to can reveal information about your health. This is special category data under UK data protection law.

This information stays on your phone unless you use a Premium AI feature. Before it is sent for the first time, the app asks for your explicit consent. You can withdraw consent at any time by not using those features and by deleting your account, which removes the reviews we have kept.

5. Who we share data with

We use these service providers to run VeraDerm. They process data on our instructions:

• Railway: hosts our server, in the UK or EU.
• MongoDB Atlas: hosts our database, in the UK or EU.
• Google Cloud Vision: reads text from label photos.
• OpenAI: separates ingredient lists and writes AI responses.
• RevenueCat: confirms subscription status.
• Microsoft 365: our support email.

Apple and Google handle payments as independent controllers. Open Beauty Facts handles barcode lookups as an independent controller. We will also disclose data if the law requires it. We never sell personal data.

6. International transfers

Our server and database are in the UK or EU. Google, OpenAI and RevenueCat are based in the United States, so some data is transferred there. These transfers use safeguards approved under UK law, such as the UK Extension to the EU-US Data Privacy Framework or the International Data Transfer Addendum to the European Commission's standard contractual clauses.

7. Keeping data secure

All connections to our server are encrypted. Passwords and session tokens are stored only as hashes. Access to our systems is limited to what is needed to run the service.

8. Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to how we use it;
• receive your data in a portable format;
• withdraw consent at any time, where we rely on it.

To use any of these rights, email support@veraderm.app. We will reply within one month. You can delete your account yourself at any time; see how to delete your account.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.

9. Children

VeraDerm is not intended for anyone under 16, and we do not knowingly collect data from children under 16. If you believe a child has created an account, contact us and we will delete it.

10. Changes to this policy

If we make significant changes, we will tell you in the app before they take effect. The date at the top shows when this policy was last updated.

11. Contact

Teejay Swain, trading as Swain Labs
support@veraderm.app