Data protection

Last updated: 15 October 2026.

1. Controller

Aralel GmbH
Josefstr 66 52080 Aachen DE
Email: openeyes@aralel.com

2. The app: processing on your device

Open Eyes processes the photos you choose, and the face positions found in them, only on your device. This data is not transmitted to us or to third parties, and we have no access to it. The history of recent fixes (references to the photos, your chosen favorite and picks) is also stored only on your device and can be deleted by you at any time in the app, by clearing the app's data or by uninstalling.

Face detection locates eyes and mouths to align them. It does not identify people, and no biometric templates are created or stored.

3. Overview of processing by us or on our behalf

Purpose	Data	Legal basis	Retention
Content Credentials certificate (Android, where enabled)	Public key generated on your device, Android build identifier, app version, IP address (technically required for the connection)	Art. 6(1)(f) GDPR: our legitimate interest, and yours, in reliably labelling edited photos	The IP address is not stored by us beyond the request itself. The public key and request details are kept only as long as needed to operate and secure the service, and no longer than 12 months
Support requests	Your email address, your message and anything you choose to attach	Art. 6(1)(b) GDPR where it concerns using the app; otherwise Art. 6(1)(f)	Deleted when your request is resolved, unless legal retention periods apply
Providing this website	IP address, date and time, page requested, browser user agent, referrer (server logs)	Art. 6(1)(f) GDPR: secure and reliable operation of the website	Server logs are deleted after a short period, at most 7 days, unless needed to investigate a security incident

4. Website

This website is hosted by IONOS, which processes server logs on our behalf under a data processing agreement (Art. 28 GDPR). The website sets no cookies, uses no tracking or analytics, and loads no content from third parties (such as fonts, maps, videos or social media buttons). Nothing is stored on your device, so no consent banner is needed.

5. Third parties and their own responsibility

• Google (Android): the face detection model is provided by Google ML Kit through Google Play services. Google may collect anonymous usage and diagnostic data about the detection feature as its own controller. Google LLC / Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. See ML Kit data disclosure and Google's privacy policy.
• Apple (iPhone): face detection uses Apple's on-device Vision framework; the app sends no data to Apple.
• App stores: when you download the app, Google Play or the Apple App Store process data under their own responsibility.

6. Transfers outside the EU

We don't transfer personal data to countries outside the EU/EEA ourselves.

7. Automated decisions

There is no automated decision-making or profiling within the meaning of Art. 22 GDPR. The app's suggestions of "best" eyes and smiles are only suggestions about your photos, made on your device.

8. Your rights

You have the right to:

• access the personal data we hold about you (Art. 15),
• have it corrected (Art. 16) or deleted (Art. 17),
• restrict its processing (Art. 18),
• receive it in a portable format (Art. 20),
• object to processing based on legitimate interests (Art. 21),
• lodge a complaint with a supervisory authority (Art. 77), in particular in the EU member state where you live or work. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Postfach 20 04 44, 40102 Düsseldorf, Germany.

Because photos and history stay on your device, you can delete them yourself at any time. To exercise any right, email openeyes@aralel.com.

9. Is providing data required?

No. You can use the app without giving us any personal data. Without the certificate request on Android, photos are still labelled, just without Content Credentials.

10. Security

This website is served only over encrypted connections (HTTPS). Keys used for Content Credentials are created and kept in your phone's secure hardware where available.