Refina Privacy Policy & Terms

Last Updated: August 25, 2026

Who We Are

"Refina", "EnhanceMe", "we", "our", or "us" means Trilogy Labs LLC, United States.

Age Requirement

Refina is intended only for adults aged 18 or older. By creating an account or using the app you confirm that you are at least 18. The app is not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, email team@trilogy-labs.com and we will delete it.

Medical Disclaimer

Refina is a cosmetic visualization and educational tool. It is not medical advice, not a diagnosis, and not a medical device, and using it does not create a doctor-patient relationship.

AI previews are illustrative renderings, not predictions. They are not a simulation of surgery and do not forecast the result of any procedure.
The Facial Dossier is a descriptive, automated analysis of your photographs. Its observations, measurements and comparisons are generated by AI, are approximate, and may be inaccurate. It is not a clinical assessment and must not be used to diagnose or treat any condition.
The AI Advisor and dossier chat are automated assistants, not clinicians. They can make mistakes and can produce incorrect information.
Results are not guaranteed. Nothing in Refina is a licensed medical opinion, and Refina is not operated or supervised by physicians.

Always consult a qualified, licensed professional before making any decision about a cosmetic procedure, medication or treatment. If you have a medical concern, seek care from a licensed provider; in an emergency, contact your local emergency services.

What We Collect & Why

Category	Examples	Purpose	Legal Basis*	Retention
Account Info	Name (optional), email, password hash, OAuth tokens (Google / Apple)	Sign-up, authentication, support	Contract	Until account deletion + 180 days backups
Photos / Videos	Reference photos you capture or upload, AI-generated preview images, AI-generated short motion clips ("Bring to Life"), and Facial Dossier report files (which contain copies of your photos), plus metadata (angle, timestamp)	Generate AI previews, motion clips and Facial Dossier reports; keep your results available across sessions and devices	Consent; Contract	Stored in your account until you delete them or delete your account — not deleted automatically
Facial Measurements	Landmark points and derived proportions, ratios and descriptive observations computed from your photos for the Facial Dossier	Produce your Facial Dossier report and answer questions about it	Consent	Until account deletion
Chat Transcripts	Your messages to the AI Advisor and the dossier chat, and the assistant's replies	Maintain conversation continuity and let you reopen past conversations	Consent; Contract	Until account deletion
Profile Details	Age, gender, ethnicity (optional), appearance goals and the procedures you tell us you are interested in (all user-provided)	Personalize AI previews and Facial Dossier reports	Consent	Until account deletion
Purchase & Trial	App-Store receipt IDs, subscription status, Superwall customer ID	Unlock premium features, verify payments, enforce trials	Contract; Legal obligation (tax)	10 years (accounting)
Device / Log	Device model, OS version, IP (country only), unique device ID	Security, fraud prevention, paywall gating	Legitimate interest	90 days
Advertising Measurement	Device advertising identifier; app events (install, trial start, subscription)	Measure how our own ads perform	Consent (iOS ATT) / Legitimate interest	Per Meta's retention policy
Crash Data	Crash & performance reports collected by the app stores; app-usage events via Firebase Analytics	Diagnose and fix app crashes	Legitimate interest	90 days

*GDPR art. 6 legal bases; CCPA = "business purpose", not selling/sharing.

How We Use Data

Provide core functions (login, photo upload, AI previews and Facial Dossiers).
Validate trials and subscriptions via Superwall.
Prevent trial abuse or fraud (device & IP checks).
Improve stability through crash and performance reports.
Send essential emails or in-app messages (e.g., password reset, receipt).

We do not show third-party ads inside Refina, and we never sell your personal data. We do measure how our own ads perform: the Meta (Facebook) SDK shares your device advertising identifier and basic app events, such as install and subscription, with Meta Platforms, Inc. On iOS this happens only if you allow tracking when the system prompt appears. On Android you can limit it at any time in Settings → Privacy → Ads, by deleting or resetting your advertising ID. We never send your photos, your Facial Dossier, or your advisor conversations to Meta or to any advertising partner.

Facial Data Protection

Encryption: All facial images encrypted in transit
Access Controls: Strict authentication required
Processing Limitation: Used only to generate the AI previews, motion clips and Facial Dossier reports you request
No Identification: We do not use facial recognition to identify you, and we do not match your photos against any database of identified people or share them for identification purposes
Secure Processing: AI processing via Firebase Cloud Functions
User Control: Users can delete their facial data anytime
Data Minimization: Only required photos are collected

AI Processing and Third-Party Services

Facial Enhancement & Dossier Processing:

When a user requests an AI preview, a motion clip or a Facial Dossier, their facial photos, user-provided profile details (such as age, gender, and ethnicity), and selected parameters are securely transmitted via API to our third-party AI processing providers: Replicate, Inc., OpenAI, L.L.C., Anthropic, PBC, OpenRouter, Inc., and Features & Labels, Inc. (fal.ai). OpenRouter routes requests to the model providers that serve them, currently Google LLC (Gemini), Alibaba Cloud (Qwen) and Moonshot AI (Kimi, served through specialist inference hosts). fal.ai routes motion-clip generation to MiniMax.
Not every provider receives every request. Which providers are involved depends on the feature you use and on availability at the time; the list above is the complete set that may receive facial images or profile details.
This transmission occurs only after the user voluntarily uploads photos and requests AI processing. By initiating generation, the user consents to this secure transmission.
The transmitted data may include the uploaded facial photos, user-provided profile details, and the selected cosmetic enhancement or analysis parameters required to generate the result.
Processing occurs through our secure backend acting as an intermediary.
We use these providers under API terms that do not permit them to train their models on data submitted through the API, and we enable no-retention options where a provider offers them. We rely on each provider's contractual commitments; we cannot independently audit their internal practices.
The resulting previews, clips and reports are returned to the app and stored in the user's account storage.

Data Minimization:

Only the facial photos necessary for enhancement previews and Facial Dossier reports are processed.
No facial data is used for advertising, marketing, or research purposes.
No facial data is shared with advertising networks or social media platforms.

Data Sharing (Sub-processors)

Vendor	Service	Location	Safeguard
Google Firebase	Backend hosting & storage	US/EU	EU SCCs + Data Privacy Framework
Replicate	AI facial enhancement processing	US	Transient processing only
OpenAI	AI image generation (previews & dossier reports)	US	API data not used for model training
Anthropic	Vision analysis of dossier photos (skin tone and colour analysis) and generation of dossier report text	US	API data not used for model training
OpenRouter	Routing layer for AI facial analysis, dossier report text, and advisor chat	US	API data not used for model training
Google (Gemini), Alibaba Cloud (Qwen) & Moonshot AI (Kimi)	Model providers reached through OpenRouter. Kimi is served by specialist inference hosts (currently Fireworks AI, Together AI and Baseten) acting on Moonshot's behalf	US / Singapore	API data not used for model training; EU SCCs where applicable
fal.ai (Features & Labels, Inc.) & MiniMax	Generation of short AI motion clips from a preview image ("Bring to Life"). fal.ai routes the request to the MiniMax video model	US	API data not used for model training
Meta Platforms	Advertising measurement for our own campaigns (advertising identifier and app events only — never photos or reports)	US	EU SCCs + Data Privacy Framework
Superwall	Subscription validation	US	SCCs
Apple / Google Play	Payment processing	Your region	PCI-DSS / PSD2

We use Firebase Analytics for product analytics and the Meta SDK solely to measure our own advertising, both listed above. No advertising networks serve ads inside Refina, and no other third-party analytics or CDNs are integrated.

International Transfers

We are based in the United States and most processing happens there. Depending on the feature you use and the provider serving the request, your data may also be processed in the European Union (Firebase regions) or Singapore (Alibaba Cloud, when OpenRouter routes a request to the Qwen model). Where a transfer leaves the EU or UK, we rely on Standard Contractual Clauses or an equivalent safeguard, as noted for each vendor in the table above.

Your Rights

You may access, export, or delete your data at any time from inside the app: Settings → Delete Account. If you no longer have the app installed, use our account deletion request page, or email team@trilogy-labs.com.

Security

All images encrypted in transit (TLS 1.2+) and at rest (AES-256). Strict authentication ensures users only access their own data.

Data Retention & Deletion

Your photos, generated previews, motion clips and Facial Dossier reports are kept in your account until you delete them or delete your account. They are not deleted on a timer, because the app is designed to let you reopen your results later and across devices. You can delete individual photos and results at any time in the app, and deleting your account removes all of it.

When you delete something it is removed from active storage immediately. Our cloud storage provider keeps deleted objects in a recoverable state for a short window (currently 7 days) before they are permanently destroyed, and encrypted backups are purged within 180 days. Copies sent to AI providers for processing are governed by those providers' own retention terms, listed in the sub-processor table above.

Account data is kept while the account exists. Purchase records are retained for up to 10 years where tax and accounting law requires it, separately from your profile.

Automated Processing

AI preview and Facial Dossier generation is automated but has no legal or similarly significant effect.

Changes

Updates will be posted here and users notified before major changes.

Contact

Email: team@trilogy-labs.com

END OF POLICY