NovaNails
Matching nail shape and colour from a photo of your hand
Privacy policy
Last updated: 5 September 2026
NovaNails recommends a nail shape and colours from a photo of your hand. The image is sent to our server and forwarded to the AI service Anthropic (“Claude”). The photo itself is not stored — only the text result of the recommendation is kept so you can look at it again later.
1. Data controller
- Company
- Babala Özdemir (Einzelunternehmen)
- Address
- Unterer Rainweg 22
4414 Füllinsdorf
Schweiz - info@babala.ch
- Phone
- 076 222 45 99
- Company ID
- CHE-322.105.560
- App identifier
-
iOS: ch.babala.novanails
Android: ch.babala.novanails
We have not appointed a data protection officer or an EU representative because we do not reach the relevant thresholds. Please address all requests to the contact above.
2. What data we process
| Data | Purpose | Stored where | Retention |
|---|---|---|---|
| Photo of your hand | Automated recommendation of shape and colour | In memory of our server and the AI service only — not stored | Seconds (duration of the analysis) |
| Recommendation result | Display in the history | Our server (EU data centre) | Until you delete your account |
| Anonymous access token and language code | Linking without login; correct answer language | Device and server | Until you delete your account |
| Subscription receipt | Verifying the term; statutory retention | Our server; verified with Apple or Google | 10 years (accounting obligation) |
What we explicitly do not collect
- No name, no e-mail address, no login account
- No location data, no contacts
- No advertising, no advertising ID, no analytics SDK, no tracking
3. Permissions on your device
The app requests only the following permissions. Each of them can be revoked at any time in your device settings; the app remains usable afterwards, with reduced functionality.
- Camera — Taking the photo of your hand for the analysis.
- Photos: read (selected image only) and save — Selecting an existing image and saving the finished result card to your library.
- Internet — Transmitting the image for analysis and retrieving the history.
4. Legal bases
We process personal data under the Swiss Federal Act on Data Protection (revFADP). Where the GDPR applies, we rely on:
- Performance of a contract (Art. 6(1)(b) GDPR) — everything needed for the app to deliver the function you requested.
- Legitimate interests (Art. 6(1)(f) GDPR) — secure and stable operation, abuse prevention, troubleshooting.
- Consent (Art. 6(1)(a) GDPR) — for anything you actively enable in this app: the camera, picking a photo and saving the result card to your photo library. Consent can be withdrawn at any time with effect for the future by revoking the permission in your system settings.
- Legal obligation (Art. 6(1)(c) GDPR) — in particular commercial and tax retention duties for payments.
5. Recipients and third parties
We do not sell data and do not disclose it for advertising purposes. Data is disclosed only to the following parties, and only where required for operation:
| Recipient | Location | Purpose |
|---|---|---|
| Hetzner Online GmbH | Gunzenhausen (Germany), data centre inside the EU | Operation of our servers. Hetzner processes data solely on our behalf and is contractually bound to confidentiality. |
| Anthropic PBC («Claude») | San Francisco (USA) | Automated image analysis. The picture is forwarded by our server to the Claude API, analysed there and returned to us as a text result. Under its commercial terms Anthropic does not use API content to train models. |
| Apple Inc. / Apple Distribution International Ltd. | Cupertino (USA) / Cork (Ireland) | App Store distribution, processing of in-app purchases and subscriptions, and crash reports if you have enabled them with Apple. |
| Google Ireland Ltd. / Google LLC | Dublin (Ireland) / Mountain View (USA) | Google Play distribution, purchase processing via Google Play Billing, crash reports according to your Play settings. |
Authorities and courts receive data only where we are legally obliged to provide it.
Transfers abroad
Some of the recipients listed above process data outside Switzerland and the EEA, in particular in the United States. We base such transfers on the European Commission’s Standard Contractual Clauses with the Swiss adaptations recognised by the FDPIC and, where applicable, on the EU-US Data Privacy Framework. We will provide information on the safeguards in place on request.
6. Retention and deletion
The photo is not stored. Your analysis results remain until you delete your account; they are then removed completely. Receipts for paid subscriptions are kept for 10 years (accounting duty); server logs expire after 14 days.
Step-by-step instructions are available at Delete data.
7. Children and young people
This app is not directed at children. We do not knowingly collect personal data from children under 16. If we learn that such data has been submitted without parental consent, we delete it without delay.
8. Data security
Wherever the app transmits data at all, connections are encrypted via HTTPS/TLS. On the server side we use access restrictions, tenant separation and regular backups. Nobody can, however, guarantee absolute security for data transmission over the internet.
9. Your rights
- Access to the personal data we process
- Rectification of inaccurate data
- Erasure or destruction of your data
- Restriction of and objection to processing
- Receiving or porting your data in a common format
- Withdrawal of consent with effect for the future
An informal message to info@babala.ch or a call to 076 222 45 99. We normally respond within 30 days. To verify your identity we may request suitable proof. You may also lodge a complaint with a supervisory authority (Switzerland: FDPIC; EU: your competent authority).
10. Changes to this policy
We may adapt this policy when the app or the legal framework changes. The version published on this page, with the date shown above, is the applicable one. We announce material changes inside the app.
← Back to the app overview