Privacy Policy

• Szymon Morawiec (Paleta Beauty Poland), Tax ID NIP (VAT): 6252495518. [Full company details to follow]
• Contact for data matters: szymon.dwakadry@gmail.com

• The photo you upload (your likeness).
• Your email address (to send the report and a reminder if an order was not completed).
• Optional form data (first name, chosen area of interest).
• Payment data processed by Stripe (we do not store card details).
• Basic technical data (e.g. server logs).

• Creating and delivering the report, including analyzing your photo and generating the visualizations, and processing your payment: based on the contract (Art. 6(1)(b) GDPR, where GDPR applies).
• Processing your photo: based on your consent (Art. 6(1)(a) GDPR), which you give before uploading.
• Ad statistics and optimization (Meta Pixel): based on our legitimate interest (Art. 6(1)(f) GDPR); you may object and limit tracking in your browser settings or your Meta account.

We analyze only color and style features (skin undertone, contrast, eye and hair color) to determine your palette and recommendations. We do not perform facial recognition or biometric identification and we do not use the photo to establish your identity. We do not analyze the health of your skin and we do not build any health profile.

The original photo is deleted automatically after 30 days. The visualizations in the report remain available at your report link.

We work with carefully selected service providers (data processors):

• Supabase (Supabase, Inc.): Hosting of the database and photos (your photo, email address, report data). Servers in the EU (Frankfurt).
• Anthropic (Anthropic, PBC): AI model performing the color analysis based on your photo. USA. Transfers outside the EEA (USA) take place on the basis of Standard Contractual Clauses.
• Replicate (Replicate, Inc.) i Google: Generation of the visualizations (color draping, hair colors, hairstyles) based on your photo. USA. Transfers outside the EEA (USA) take place on the basis of Standard Contractual Clauses.
• Stripe (Stripe Payments Europe, Ltd.): Payment processing. We do not store card details. EU / USA. Transfers outside the EEA (USA) take place on the basis of Standard Contractual Clauses.
• Resend (Resend, Inc.): Delivery of the report to your email address. USA. Transfers outside the EEA (USA) take place on the basis of Standard Contractual Clauses.
• Vercel (Vercel, Inc.): Application hosting (web server). USA. Transfers outside the EEA (USA) take place on the basis of Standard Contractual Clauses.
• Meta Platforms Ireland Ltd.: Ad performance statistics (Meta Pixel) based on our legitimate interest (you may object). EU / USA. Transfers outside the EEA (USA) take place on the basis of Standard Contractual Clauses.
• Google (Google Ireland Ltd. / Google LLC): Traffic and on-site behavior statistics (Google Analytics 4). EU / USA. Transfers outside the EEA (USA) take place on the basis of Standard Contractual Clauses.
• Microsoft (Microsoft Ireland Operations Ltd.): Usage statistics and session recordings/heatmaps (Microsoft Clarity). EU / USA. Transfers outside the EEA (USA) take place on the basis of Standard Contractual Clauses.

• Original photo: up to 30 days.
• Report, visualizations and email address: for as long as the report is accessible, and for the period required for accounting and possible complaints.
• Billing data: for the period required by tax regulations.

You have the right to access your data, rectify it, erase it, restrict processing, data portability, object, and withdraw your consent at any time (withdrawal does not affect the lawfulness of processing carried out before it). To exercise your rights, write to szymon.dwakadry@gmail.com.

If you are in the EU or the UK, you also have the right to lodge a complaint with a data protection supervisory authority, in particular in the country of your habitual residence. Depending on where you live, you may also have rights under local privacy laws (for example US state privacy laws); we honor such requests as required.

We use cookies necessary for the service to work, and the Meta Pixel to measure the effectiveness of our ads (data is transferred to Meta Platforms). You can limit or disable this in your browser settings or in the ad settings of your Meta account.

For privacy matters, write to szymon.dwakadry@gmail.com. Purchase terms are described in the Terms of Service.