Banimo logotype

Elano app iconPrivacy Policy

Last updated: October 10, 2026

This Privacy Policy explains how Elano handles your data when you use the app. Elano is developed by banimo.net, based in Gothenburg, Sweden. We are responsible for your data under this policy.

Looking for the app itself? Back to Elano.

The short version

  • To create your skin report, your scan photos and skin questionnaire answers are sent over an encrypted connection (HTTPS) to our server. Our server passes them to a third-party AI service, which does the analysis and sends the result back.
  • We don't keep your photos or answers after the analysis. Your reports, photos and history are stored only on your iPhone.
  • Before your first scan, the app shows a consent screen and asks for your permission to send your photos and answers for AI analysis. Nothing is sent until you agree.
  • No ads. We don't sell your data, and we don't track you across other apps or websites.

What data is collected

When you use Elano, the following data is involved:

  • Scan photos: a few photos of your face from different angles (for example front, left, right, chin up and close-ups of the nose and cheeks). They are sent for analysis and saved in the app on your iPhone so you can look back at them.
  • Skin zone outlines: simple 2D shapes that mark areas such as your forehead or cheeks on each photo. They are sent with the photos so the analysis knows which part of the photo is which zone.
  • Questionnaire answers: your age range, skin type, skin tone (picked from a colour swatch), how your skin reacts to the sun, goals, climate, current routine, sensitivities, and, if you choose to answer, pregnancy status and the types of skincare medication you use. These answers help tailor the report and keep unsuitable tips out of it. Your name, if you enter one, stays on your iPhone and is never sent.
  • Usage analytics (only if the switch is on, see below): which screens you open and steps you take in the app, plus a few profile details used to group results (age range, skin type, goals, climate, routine level, sunscreen habit and whether reminders are on).
  • Subscription data: whether you have an active subscription, and your purchase and renewal history, handled through Apple and RevenueCat.
  • Basic technical data: to protect the service from abuse, the app proves it is a genuine copy of Elano using Apple's App Attest. This creates a random key for your app install, which our server uses to count scans per day. It isn't linked to your name, photos or reports.

We basically don't store anything

Elano doesn't have accounts, and we don't keep a copy of your face. Our server receives your photos and answers, hands them to the AI service, and returns the result to your iPhone. The photos are only held in memory while the analysis runs and are never written to our database or logs.

The finished report waits on our server for up to about 15 minutes so your iPhone can pick it up, and is then deleted automatically. Photos are never part of that stored result.

Everything you see in the app, such as reports, photos, scores, your routine and streaks, is kept in the app's private storage on your iPhone with iOS file protection. Scan photos are excluded from iCloud backups.

A couple of third-party services keep a small amount of data for their own job: Amplitude stores usage analytics (if you leave it on), and RevenueCat and Apple keep subscription and payment records. More on them below.

Sharing with a third-party AI service

Your scan photos, skin zone outlines and questionnaire answers are shared with a third-party AI service so it can produce your skin analysis. This is the core of how Elano works, and the app asks for your permission on a consent screen before your first scan.

We send the data through our own server, so the AI service doesn't receive your name, your Apple ID or any account details from us. We ask the service not to store or collect your data for its own purposes, and not to use it to train AI models.

Face data and ARKit

Elano uses Apple's ARKit face tracking on your iPhone to guide the scan, for example to check your head angle and to find your skin zones. The 3D face mesh and face geometry from ARKit stay on your iPhone and are never sent to our server or anyone else.

What is sent is the scan photos themselves and the 2D zone outlines worked out on your phone. Your face data is used only to create your skin report. It is never used for advertising, marketing, identifying you, or tracking you, and it is never sold or shared for those purposes.

How your data is used

  • To create your skin report and routine.
  • To leave out tips that don't suit what you told us, for example retinoid advice during pregnancy.
  • To unlock subscription features and handle purchases.
  • To limit scans per day and keep the service safe from abuse.
  • If analytics is on, to understand how people use the app so we can improve it.

Usage analytics (Amplitude)

Elano can share anonymous usage data with Amplitude, an analytics service, using its EU data region. You choose this with the “Share anonymous usage data” switch on the consent screen before your first scan. The switch starts in the on position, so turn it off there if you'd rather not share. You can change it at any time in the app's Settings. When it's off, nothing is sent to Amplitude.

Analytics never includes your name, your photos, your face data or your pregnancy, medication and sensitivity answers. A small share of sessions may be recorded as a screen replay to help us spot confusing screens. Text and images are masked, and screens that show the camera, your photos or the 3D face are never recorded.

Subscriptions (Apple and RevenueCat)

Subscriptions are bought through Apple's in-app purchase system and managed with RevenueCat. Apple handles the payment. We never see or store your card details. RevenueCat receives an anonymous app user ID and your purchase history so it can tell the app which features you have. If analytics is on, purchase events are also linked to your Amplitude analytics ID.

Third-party processors

We use a small number of service providers. They only process data on our behalf to provide their service:

  • AI analysis service: analyses your scan photos, zone outlines and questionnaire answers to produce the report.
  • Analytics (Amplitude): anonymous usage analytics, only if you leave the switch on.
  • Subscription management (RevenueCat, together with Apple's in-app purchase system): purchases, renewals and subscription status.
  • Hosting: the cloud servers that run our backend and pass data between the app and the AI service.

How long data is kept

  • Scan photos and questionnaire answers on our server: only while the analysis runs.
  • Finished report on our server: up to about 15 minutes, then deleted automatically.
  • Daily scan counts: deleted after two days. The random App Attest key for your install is kept so the app can keep working, and it contains nothing about you.
  • Data on your iPhone: until you delete a scan, tap “Delete all my data”, or uninstall the app.
  • Analytics: kept by Amplitude for as long as needed for product analytics, under our account settings with them.
  • Subscription records: kept by Apple and RevenueCat as needed for billing, tax and accounting.

Your rights

Depending on where you live, you have rights over your personal data. Under the GDPR and UK GDPR, you can ask to access, correct, delete or move your data, object to or restrict how it's used, and withdraw consent at any time. Withdrawing consent doesn't affect processing that already happened. Under the CCPA/CPRA (California), you can ask to know what personal information we collect, ask us to delete or correct it, and you won't be treated differently for using these rights. We don't sell or share personal information for cross-context behavioural advertising.

How to use your rights

  • Tap “Delete all my data” in the app's Settings. It erases your reports, photos, history and profile from your iPhone and resets your analytics ID.
  • Turn off “Share anonymous usage data” in Settings to stop analytics.
  • Manage or cancel your subscription in your Apple ID's Account Settings.
  • Email us at the address below for anything else, such as a copy or deletion of data held by our service providers. We'll reply within one month. Because Elano has no accounts, we hold very little that can be tied to you, and we may ask for details that help us find it.
  • If you're in the EU or UK, you can also complain to your local data protection authority. In Sweden that's IMY (Integritetsskyddsmyndigheten).

Legal bases (EU and UK)

  • Your consent: sending scan photos and answers for AI analysis (including any health-related answers you choose to give), and analytics.
  • Performing our contract with you: providing the app and your subscription.
  • Legitimate interests: keeping the service secure and preventing abuse.
  • Legal obligations: keeping purchase records where the law requires it.

Children

Elano is not meant for children under 13, and the app does not let anyone who selects an age under 13 continue. If you believe a child under 13 has used Elano and data about them reached us, please contact us and we will delete it.

Security

All data between the app and our server travels over HTTPS. Only genuine copies of the app, verified with Apple's App Attest, can send scans. Data on your iPhone is protected with iOS file encryption. No system is perfectly secure, but we keep the amount of data we handle as small as we can.

International transfers

We are based in Sweden. Some of our service providers, including the AI analysis service and RevenueCat, may process data in other countries, such as the United States. Where data leaves the EU/EEA or UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision.

Changes to this policy

We may update this policy when the app changes. When we do, we'll change the date at the top of this page.

Contact us

Questions about this policy or about your data in Elano? Reach us at [email protected].