Privacy Policy

Effective date: September 3, 2026

Bald AI is an iOS wellness app operated by PCTR INFORMACIJSKE STORITVE d.o.o. (“PCTR”, “we”). It estimates visible hair-pattern appearance from photos you take and optional questionnaire answers. Bald AI is not a medical device and does not diagnose hair loss or any health condition.

Data controller

The controller of personal data for Bald AI is:

PCTR INFORMACIJSKE STORITVE d.o.o.
Lokev 173, 6219 Lokev, Slovenia
Registration no. (MŠ): 9966935000
VAT no. (DŠ): SI78302765
Email: info@probors.com

Company listing: CompanyWall — PCTR d.o.o.

Information we collect

• Scan photos. Four guided photos showing your front hairline, left temple, right temple, and crown. Bald AI stores these privately on your device. If you explicitly allow AI processing and request an analysis, the four photos are sent over HTTPS through Supabase to OpenAI so the requested visual estimate can be returned.
• Hair Coach content. If you use Hair Coach after allowing AI processing, Bald AI sends your question, up to eight recent conversation turns, and relevant result context such as your score, visible pattern estimate, and risk tier through Supabase to OpenAI to generate an answer.
• Optional future-image content. If you separately press Generate scenario, Bald AI may send your front photo and scenario instructions, including the selected time period, visible pattern estimate, and risk tier, through Supabase to OpenAI to create the image.
• Questionnaire answers and results. Age, noticed changes, family-history context, treatment-tracking choices, safety answers, and generated scores are stored on your device. Relevant result context may be included in Hair Coach or an optional future-image request as described above.
• Service and account identifiers. Supabase supplies an authentication identifier used to secure requests and may process standard network and request metadata such as IP address, timestamps, and error information to operate and protect the service.
• Account data. If you use Sign in with Apple, we store an Apple user identifier (and, if Apple provides them, your name and email) so we can connect your account and process deletion requests.
• Purchases. Apple processes subscriptions. We receive an entitlement that you are subscribed, not your full payment card details.
• Optional first name. Stored on device if you enter it in Settings.
• Support messages. If you email us at info@probors.com, we receive whatever you send.

Legal bases (GDPR)

We ask for your explicit permission before sending photos, Hair Coach content, or result context to Supabase and OpenAI. You may withdraw that permission in the app at any time. We also process data as necessary to provide features you request (performance of a contract), operate Bald AI Pro entitlements, comply with law (for example accounting and consumer requests), and secure the service. Withdrawing AI permission prevents new AI transmissions but does not affect on-device features or your ability to cancel a subscription.

How we use information

We use this information only to authenticate requests, generate the analysis or optional image you request, provide Hair Coach answers, maintain your on-device baseline and progress history, operate subscriptions, prevent misuse, troubleshoot service errors, and fulfill support or deletion requests. We do not sell personal information. We do not use photos, health-related answers, or Hair Coach messages for advertising, tracking, or analytics.

Service providers and AI sharing

• Supabase, Inc. provides authentication and the hosted functions that securely relay AI requests.
• OpenAI, L.L.C. provides the third-party vision, language, and image models used for scan analysis, Hair Coach, and the optional future-image feature.
• Apple. processes App Store purchases and Sign in with Apple under Apple’s own privacy terms.

We require service providers that process data on our behalf to use appropriate security and confidentiality protections and to provide the same or equivalent protection described in this policy and required by applicable law. PCTR does not opt in to sharing Bald AI API content with OpenAI for model training. OpenAI states that API data is not used to train its models unless the customer explicitly opts in.

Retention

Photos, results, and routine history stored by Bald AI remain on your device until you use the in-app deletion controls or remove the app. Our Supabase functions relay AI request content and are not designed to save the submitted photos or Hair Coach conversations in a remote content database. OpenAI may retain API content in abuse-monitoring logs for up to 30 days, unless longer retention is required by law or necessary to protect its services or others from harm. Requests use non-persistent API settings where supported. Support emails are retained only as long as needed to handle the request and meet legal obligations.

Your rights

If GDPR applies, you may request access, correction, deletion, restriction, objection, or portability of your personal data, and you may withdraw consent where processing is based on consent. Email info@probors.com. You may also lodge a complaint with the Slovenian Information Commissioner (Informacijski pooblaščenec) or your local EU supervisory authority.

Your choices

• Decline AI data sharing on the disclosure screen. Bald AI will not send your photos, messages, or result context to OpenAI.
• Withdraw AI permission at any time in Settings → Privacy & data → Review or change AI permission. This stops future AI transmissions. You can grant permission again later.
• Decline camera access in iOS Settings. Scanning will not work without the camera.
• Decline notifications. Reminders will not be sent.
• Delete photos or account data in the app.
• Cancel a subscription in your Apple ID subscription settings.

Children

Bald AI is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has used the app, email info@probors.com and we will delete the data.

International transfers

Supabase and OpenAI may process data outside Slovenia or the EEA. Where required, transfers rely on appropriate safeguards such as standard contractual clauses or another lawful transfer mechanism.

Contact

All privacy, support, and deletion requests: info@probors.com

Postal: PCTR INFORMACIJSKE STORITVE d.o.o., Lokev 173, 6219 Lokev, Slovenia