Controller and scope
Nael Al Khalaf · Sole trader — French micro-entrepreneur (EI) · 30 rue Mathieu, 93400 Saint-Ouen-sur-Seine · France · SIRET: 819 537 002 00035 · EU VAT number: FR 33 819 537 002 · Telephone: +33 6 77 15 93 63
Nael Al Khalaf is the controller for the processing described here. For data questions or rights requests, email support@getenamel.app.
This policy covers the Enamel iPhone app, the getenamel.app website and messages sent to Enamel support. Sections starting with “App” concern the app only; sections starting with “Website” concern the website only. The website does not request photographs of your teeth or perform scans.
The Enamel app
Enamel helps you follow a cosmetic whitening and smile-care routine and places the appearance of your tooth shade on a scale from 1 to 16. It is not a medical service: the app does not assess the health of your teeth.
The photos of your smile are analyzed on your iPhone and are never uploaded. Your answers, plan, shade readings and log stay on your iPhone too: Enamel operates no server that receives this data. The app creates no account and asks for no name, email address or password. It contains no advertising, does not track you across apps and websites owned by other companies, and therefore never shows Apple’s tracking permission prompt. We do not sell your data.
Apart from the App Store, the app relies on only two services: RevenueCat for the subscription and PostHog for anonymous usage statistics you can turn off. Each is described below.
App: photos and shade measurement
The guided scan photographs your smile with the front camera while the screen lights your face. Apple’s Vision framework, running on the iPhone, locates your face, your mouth and the whites of your eyes, which serve as the color reference. On iPhones with a TrueDepth camera, depth information helps check your distance and position. The shade index is computed on the iPhone, and a scan rejected for its conditions is not saved.
The scan photos and mouth crops are stored in the app’s private storage on your iPhone. They are protected while the iPhone is locked and excluded from iPhone backups, both in iCloud and on a computer. No photo, crop, face measurement or depth information is sent to Enamel or to any other service, and none of it is used to recognize you, for advertising or to build a profile.
There is no automatic expiry: photos stay on your iPhone until you delete them in the app, for example with Retake scan or Delete all my data, or delete the app. The app’s other data (answers, plan, readings, habit log and a summary of your capture position) follows your own iPhone backup settings: it is included in an iCloud backup, which Apple manages, or in a computer backup if you make one. After restoring a backup or moving to a new iPhone, your plan comes back without the photos, and the first scan on that iPhone starts a new series.
App: answers, plan and readings
Your quiz answers (your focus, an optional event date, your whitening method, whether you need breaks and the drinks you usually have), your plan, your readings (for each scan, its date, its 1–16 index, color values and technical capture settings) and your daily log (habits, sessions, drinks noted) are stored only on your iPhone. They are not copied to any server, whether Enamel’s or a provider’s.
They are used on your iPhone to build your plan, show your history and compare scans taken in comparable conditions. The basis is the performance of the contract: providing the app you choose to use.
Some of this information describes your smile and your routine, such as whether you need breaks between sessions or your shade readings. None of it leaves your iPhone: neither Enamel nor its providers can access it. The usage statistics described below contain no shade, no quiz answer and no detail of your habits.
This data stays on your iPhone until you use Delete all my data or delete the app. Because it is kept nowhere else, Enamel cannot view or restore it for you; only a backup of your iPhone can contain it.
App: subscription
Enamel Pro is sold through the App Store. Apple processes the purchase and payment as an independent controller, under its own privacy policy; Enamel never receives your payment card details.
RevenueCat, Inc., based in the United States, manages subscriptions on our behalf. It processes an anonymous app user ID generated on your iPhone, App Store transactions (products, purchase, trial and renewal dates, transaction identifiers), your subscription status and technical information about the device and the app, to provide and restore your subscription. Enamel does not know your name or your Apple Account email address. The basis is the performance of the contract.
This information is kept for as long as needed to provide the subscription and handle refunds, then under RevenueCat’s data processing terms. Delete all my data does not cancel your subscription and does not erase this information.
To ask for its deletion, email support@getenamel.app with the order ID shown on the receipt Apple emails you. Because the user ID is anonymous, this order ID is how we find the record, which we then delete in RevenueCat. Apple keeps its own purchase history under its policy.
App: usage statistics
To measure how the app is used, for example how many people finish the quiz or a scan, and to improve its flow, the app sends usage statistics to PostHog. Statistics are on by default. You can turn them off at any time in the app’s Settings, under Your data, with the Usage statistics switch: the app then stops sending them and removes their identifier and unsent events from your iPhone. If you turn them back on, a new identifier is created, unrelated to the previous one. Turning them off stays in effect after Delete all my data.
They form a closed list of events: onboarding started, quiz completed, first result viewed, scan started, completed or failed, check-in completed, subscription screen viewed, trial started, purchase completed, reference scan set or postponed, habit completed, brushing guide opened or finished, drink noted and share image created. Their only details are the scan mode, a predefined failure code, where the subscription screen was shown, the product purchased or how the reference scan was chosen. They never include a photo, your shade index or color values, your quiz answers, which habit was checked or which drink was noted (only the use of the brushing guide is counted), or any text you type. Screen recording, surveys and automatic capture of screens and taps are off.
PostHog’s library adds technical context, such as the app version, iPhone model, iOS version and language, and a random identifier created on your iPhone and renewed at least every 13 months. This identifier links events from the same iPhone so that steps can be counted; it is not linked to your identity or your subscription. The app never sends your name, email address or subscription identifier to PostHog, no person profile is created and these events are not combined with any other data. We use them only to produce anonymous statistics.
The basis is our legitimate interest in measuring the app’s audience, within the conditions of the CNIL’s consent exemption for audience measurement: anonymous statistics only, no person profiles, no combination with other data, no advertising and no tracking across other apps or websites, an anonymous on-device identifier renewed at least every 13 months, and the option to object at any time with the Usage statistics switch, which is on by default. Turning it off stops sending and deletes the identifier on your iPhone.
PostHog, Inc. processes these events on our behalf, as a processor, on its European Union hosting (Frankfurt, Germany). The Enamel project is configured to discard the device’s IP address before storage. We use these events for at most 12 months, the period during which they remain available on PostHog’s current plan.
These events carry no identifier linked to a person, so we cannot single out one person’s events, for example to erase them on request. To stop sending them, turn statistics off: the identifier is deleted from your iPhone and collection stops. Delete all my data also deletes this identifier and unsent events; if statistics stay on, the app then starts again with a new identifier, unrelated to the previous one.
App: permissions and reminders
Camera: needed for the scan; the photos are analyzed on the iPhone. Add to Photos: only to save an image you choose to export; Enamel does not read your photo library.
Notifications are optional. If you allow them, the app schedules reminders on your iPhone for your routine and check-in scans and, during a free trial, a reminder before the trial ends. The whitening session timer can appear on the Lock Screen as a Live Activity. Enamel does not use a push notification server.
Enamel does not request access to your microphone, location, contacts or Health data. You can change these permissions at any time in the iPhone’s Settings app.
App: sharing and exports
You can create a share image showing your index on the scale. It includes the photo of your smile only if you turn on Include my photo. An image you save or share goes to the destination you choose, such as Photos or another app: these copies are under your control and that of the services you use, and Enamel cannot delete them.
App: deleting your data
Delete all my data, in the app’s Settings, is available with or without a subscription. It erases from your iPhone the photos, answers, readings, plan, habit log, preferences, reminders and usage statistics identifier. Because this data is not kept on any Enamel server, no copy remains with us.
It does not cancel your App Store subscription (cancel it in the App Store) and does not erase subscription records kept by Apple and RevenueCat (see App: subscription to request their deletion) or statistics already received by PostHog. Nor does it delete copies you exported, or backups of your iPhone made earlier, which you manage in iCloud or on your computer.
In short: data on your iPhone is kept until you delete it or delete the app; subscription records at RevenueCat, for as long as needed to provide the subscription and handle refunds, then under its data processing terms; usage statistics, used for at most 12 months.
Website: browsing and security
Cloudflare hosts and protects the website. During a visit, its infrastructure processes technical information needed for page delivery and security, including IP address, browser characteristics, requested URL, date, method and response information. The purposes are to display the website, prevent abuse and investigate errors. The basis is the legitimate interest in providing a functional, secure website.
This technical information is necessary to receive pages. You do not need an account or an email address to browse. Images and fonts used on the pages are served with the website.
Workers Logs enabled for this website on Cloudflare’s Free plan have a stated three-day retention. This period does not cover all other security logs or processing carried out by Cloudflare under its own policy.
Website: launch list
Joining is optional and based on your consent to one email, when Enamel launches. It stores your email, language, date, the website page where you joined and a consent record in the website’s D1 database, configured with the European jurisdiction setting. The page is used only to learn which parts of the website bring sign-ups: it is not shared with the delivery provider and is deleted with the address.
The launch message is sent by Brevo, an email provider based in France, which receives the address and language for that sending only. No other communication is sent, and the message includes an unsubscribe link.
Addresses are deleted 30 days after the launch message is sent, and no later than 12 months after joining if the app has not launched.
The personal link supplied when joining lets you withdraw your consent at any time and remove the address from the active database.
Support correspondence
You can email support@getenamel.app. We use your email address, the name you provide, message contents, technical message information and any attachments you choose to send to reply and manage your request. Writing is optional; without contact details and relevant information, we may be unable to handle your request.
Messages pass through Cloudflare Email Routing and are received in the Gmail mailbox used by the publisher for support. Access should be limited to people handling the request. Do not send face photographs, medical data or identity documents without a need.
Answering general inquiries is based on our legitimate interest in providing support. Where you request steps before a contract or assistance needed to perform a service, processing is based on those steps or performance of the contract. Handling data-rights requests is based on our legal obligations.
Support correspondence is deleted no later than 12 months after the request is closed. If a legal obligation or dispute requires specific records to be kept, only the necessary records are retained separately for the applicable period.
The period applies to the support case and its attachments. A dispute or retention obligation may justify keeping only the necessary records separately for the applicable period, with restricted access.
Recipients and international processing
Data is processed by the publisher and the necessary providers. For the app: Apple for the App Store, RevenueCat for the subscription and PostHog for usage statistics; none of them receives your photos, answers, plan or readings. For the website and support: Cloudflare for hosting, security and email forwarding, and Google for the support mailbox, plus Brevo, an email provider based in France for the single launch message. Data is not sold or made available to advertising partners.
The website’s D1 database is configured with the European jurisdiction setting. This does not apply to every operation: Cloudflare runs a global network and messages received in Gmail may be processed outside the European Economic Area. We do not promise exclusively European hosting for all data.
For the app, RevenueCat, Inc., based in the United States, processes subscription information under its data processing agreement, which includes the EU Standard Contractual Clauses for transfers outside the European Economic Area. PostHog processes usage statistics under its data processing agreement, with data hosted in the European Union. Apple acts as an independent controller for App Store purchases.
Cloudflare’s contract incorporates a data processing agreement with safeguards for the transfers concerned, including standard contractual clauses where needed. Google describes the frameworks for its international transfers in its policy. Contact support for information about safeguards relevant to your request.
Website: deletion and backups
You can ask support to erase your data. Relevant data is removed from active systems where the legal conditions are met; some records may be retained to meet a legal obligation or defend a legal claim.
If a previous subscription is removed from the active D1 database, it may remain in recovery history until that history expires. Cloudflare’s Free plan allows recovery over the preceding seven days. This window does not describe mailbox retention or every other operation carried out by providers.
Your rights
Under the conditions of the GDPR, you may request access, correction, erasure, restriction or portability where applicable, or object to processing based on legitimate interests. You may withdraw consent without affecting earlier lawful processing. To exercise your rights, email support@getenamel.app describing your request.
The app’s data (photos, answers, plan, readings and log) stays on your iPhone: you can see it in the app, and Delete all my data erases it. We do not hold it and cannot access it. For subscription records, write to support with the order ID from your Apple receipt. Because usage statistics are not linked to any person, we cannot find those that concern you.
We only request proportionate information needed to locate your data and verify your entitlement. We respond without undue delay and within one month. Depending on the complexity or number of requests, this may be extended by up to two further months; we will explain the reasons during the first month.
You may complain to the CNIL or another competent authority, including in your country of habitual residence, work or the alleged infringement. Neither the website nor the app is used to make automated decisions producing legal or similarly significant effects about you.
Policy updates
The date at the top indicates the latest revision. New uses will be explained before implementation and consent requested where necessary. Continuing to browse the website or use the app is not consent to new optional uses.