Trust, Security & Privacy

Partner and admin areas require an authenticated account. Role-based access separates partner dashboards from administrative tools, and database row-level security restricts each partner to their own clients, scans, and catalog selections.

Public scan links use unguessable identifiers and only return the fields needed to render the report.

Client photos are stored in a private object storage bucket and are never served from a public URL. When a photo needs to be displayed or sent to the AI provider for analysis, the server issues a short-lived signed URL.

Database access uses row-level security policies; service-role access is restricted to server-side code and is never exposed to the browser.

To produce a wellness report we collect: client name and contact details supplied by the partner or the client, the photos uploaded for the scan, the selected report language, and the AI-generated report. Partners may also store their own catalog and branding assets.

We use minimal product analytics to count scans, leads, and recommendation clicks for partner reporting.

AuraScan runs on Lovable Cloud (hosting, database, authentication, and object storage) and uses the Lovable AI Gateway for image analysis and report generation. Photos sent to the AI provider are transmitted over signed, short-lived URLs.

Partners are responsible for ensuring they have the appropriate consent from their clients before uploading photos or personal data.

Partners can delete test clients and individual scans from their dashboard. Deleting a scan also removes the associated photo files from storage. For full account deletion or data export requests, contact us using the address below.

To report a security issue or make a privacy request, email security@ai-scaner.lovable.app. We aim to acknowledge reports within a few business days.