Privacy Policy

Last updated: July 29, 2026

1. Joint Data Controllers

The joint controllers of personal data processed within the INCI Preferences service (hereinafter: "Service"), available at incipreferences.app, are:

  • Łucja Leśna
  • Oliwia Natzke

The joint controllers jointly determine the purposes and means of processing personal data and share responsibility for ensuring compliance with the General Data Protection Regulation (GDPR).

Contact regarding privacy matters:
Email: kontakt@incipreferences.app

2. Scope of Processed Data

The Service processes the following personal data:

  • Username - provided during registration
  • Password - stored in encrypted form (PBKDF2 + SHA256 algorithm)
  • Cosmetic preferences - list of ingredients marked as safe, moderate, or unsafe
  • Favorite cosmetics list
  • Technical session data - session cookies enabling login functionality

3. Purpose of Data Processing

Personal data is processed exclusively for the following purposes:

  • Providing the cosmetic ingredient analysis service
  • Ensuring the functionality of personalized recommendations
  • Enabling login and account management
  • Ensuring the security of the Service

4. Legal Basis for Processing

Data is processed based on Article 6(1)(b) of the GDPR (performance of a contract for the provision of electronic services) and Article 6(1)(a) of the GDPR (user consent expressed during registration).

5. Data Retention Period

Personal data is stored for the duration of Service account usage. Upon account deletion, all personal data is permanently removed from the database.

6. User Rights

In relation to the processing of personal data, you have the right to:

  • Access your personal data
  • Rectify (correct) your personal data
  • Erase your data (by deleting your account in your profile)
  • Restrict the processing of your data
  • Data portability
  • Object to processing
  • Withdraw consent to data processing
  • Lodge a complaint with the President of the Personal Data Protection Office (or your local supervisory authority)

To exercise the above rights, please contact us at: kontakt@incipreferences.app

7. Cookies and Tracking Technologies

The Service uses only essential technical cookies:

  • sessionid - identifier for the logged-in user session (Django)
  • csrftoken - CSRF attack protection token

The Service does not use marketing, analytical, or advertising cookies. We do not employ Google Analytics or any other tracking tools.

8. Data Recipients

Personal data is not shared with third parties, except for:

  • Hosting provider (Railway.app) - technical data necessary for Service operation
  • Database provider (Supabase) - storage of application data
  • Cloudflare - CDN and DDoS attack protection

The listed entities are obliged to maintain confidentiality and process data solely for the purpose of providing services to the Service.

9. Data Transfer Outside the EEA

Personal data is stored on servers located within the European Union. In case of potential data transfer outside the EEA, it is carried out in accordance with GDPR requirements (standard contractual clauses).

10. Data Security

To protect personal data, we implement the following measures:

  • Encrypted connections (HTTPS/TLS)
  • Password hashing with PBKDF2 and SHA256 algorithm
  • Protection against CSRF and XSS attacks
  • Content Security Policy (CSP)
  • Regular security updates
  • Data minimization principle

11. Data Entered by Users

Users may add information about cosmetics to the Service (name, brand, ingredients). This data is not considered personal data and is publicly available in the Service. We kindly ask users not to include any personal information in these fields.

12. Limitation of Liability

The Service is informational and educational in nature. Cosmetic ingredient analyses and recommendations do not constitute medical or dermatological advice. In case of skin problems or allergies, please consult a dermatologist.

13. Changes to the Privacy Policy

We reserve the right to make changes to this Privacy Policy. Users will be informed of significant changes through announcements on the Service.

14. Contact

For matters concerning personal data protection and this Privacy Policy, please contact us: