Privacy policy

1. Data controller

The data controller is BeBranded SAS, 34 avenue Chanzy, 93250 Villemomble, France — SIREN 984 530 212 (RCS Bobigny). Contact: privacy@swatchee.com.

2. Data we collect

• Account data: username, phone number, e-mail address, login identifiers, profile picture where applicable.
• Skin profile: depth (Monk scale), undertone, skin type. This data may reveal a physical characteristic and is processed with reinforced safeguards (see section 4).
• Published content: reviews, ratings, comments, photos attached to reviews, lists and collections ("bag", wishlist).
• Usage data: products scanned and viewed, scan history, preferences (language, region).
• Phone contacts (optional invitation feature): numbers are normalised and matched against existing members on an ephemeral basis; the address book is not stored. The "a contact joined Swatchee" alert relies on hashed phone numbers and is enabled only with consent.
• Technical data: connection logs, IP address, error and stability diagnostics.

3. Purposes and legal bases

• Providing the service, creating and managing the account — performance of the contract (Art. 6(1)(b));
• Filtering reviews by skin profile, the core of the service — consent (Art. 6(1)(a) and, for the skin profile, Art. 9(2)(a));
• Sending verification codes (SMS/WhatsApp) and transactional e-mails — performance of the contract (Art. 6(1)(b));
• Security, fraud prevention, abuse limitation, error diagnostics — legitimate interest (Art. 6(1)(f));
• Compliance with legal obligations — Art. 6(1)(c);
• Non-essential communications, where applicable — consent (Art. 6(1)(a)).

4. Skin profile: specific safeguards

The skin profile is provided voluntarily by the user, on the basis of their explicit consent, for the sole purpose of personalising reviews and recommendations. It can be changed or deleted at any time in the app; withdrawing consent does not prevent use of the rest of the service. It is never used for advertising purposes nor shared with third parties for commercial purposes.

5. Recipients and processors

Data is accessible to the publisher's authorised staff. Technical processors are involved strictly for the operation of the service: Cloudflare (hosting of the website and application services), Supabase (database, European Union), Twilio (sending verification codes via SMS/WhatsApp), Resend (e-mail delivery), Sentry (error diagnostics). No data is sold to third parties. Published reviews (username, summarised skin profile, content) are visible to other users — that is the point of the service.

6. Transfers outside the European Union

Application data is stored within the European Union. Where a processor may handle data outside the EU (notably the US providers listed above), appropriate safeguards are in place: the European Commission's standard contractual clauses and, where applicable, certification under the EU–US Data Privacy Framework.

7. Retention periods

Account and profile data is kept for as long as the account is active, then deleted when it is closed ("delete my account" in the app), subject to statutory retention periods. Technical logs are kept for a short, proportionate period. Published content is deleted or anonymised when the account is deleted.

8. Minimum age

The service is reserved for people aged 15 or over, the age of digital consent in France. No data is knowingly collected from children under 15.

9. Your rights

Under the GDPR, you have the right to access, rectify, erase, restrict, object, port your data, and withdraw your consent at any time. You can exercise these rights directly in the app (profile editing, account deletion) or by writing to privacy@swatchee.com. You also have the right to lodge a complaint with the CNIL, the French supervisory authority (www.cnil.fr).

10. Security

The publisher implements appropriate technical and organisational measures: encryption in transit (TLS), secure credential storage, row-level access control on data, rate limiting, logging. No password is ever stored in plain text.

11. Cookies

Details of cookies and local storage are provided in the cookie policy.

12. Contact and updates

For any question: privacy@swatchee.com. This policy may be updated; substantial changes are notified to users.