Privacy Policy

Data controllers

The joint controllers of personal data processed within the INCI Preferences service (the “Service”), available at incipreferences.app, are Łucja Leśna and Oliwia Natzke.

The joint controllers together determine the purposes and means of processing personal data and share responsibility for compliance with the General Data Protection Regulation (GDPR).

Privacy contact

contact@incipreferences.app

Scope of processed data

The Service processes the following data:

• Username – provided during registration
• Password – stored only as an irreversible cryptographic hash (PBKDF2 with SHA256). We do not store passwords in plain text or in any reversibly encrypted form, and we cannot read them
• Ingredient preferences – ingredients marked as safe, moderate, or unsafe
• List of favourite cosmetics
• Edit proposals – a proposed change to a cosmetic or ingredient is stored together with the identity of the person who submitted it, so that an administrator can review it
• IP address – recorded temporarily in the application cache on failed login attempts, to protect against brute-force attacks. The counter expires automatically after 5 minutes and is never written to the database
• Email address – optional, given during registration or later in the profile panel. We use it solely to send a password reset link. There is no newsletter and we send nothing else to that address
• Technical session data – cookies described in the “Cookies” section

The Service does not require an email address or a name. A username and a password are enough to create an account. An account without an email address works fully, but a forgotten password cannot then be recovered.

Purpose of processing

Personal data is processed exclusively in order to:

• provide the cosmetic ingredient analysis service,
• deliver personalised recommendations,
• enable login and account management,
• let users reset a forgotten password, if they provided an email address,
• keep the Service secure, including protecting accounts against unauthorised access.

Legal basis for processing

• Article 6(1)(b) GDPR – processing necessary for the performance of a contract for the provision of electronic services: maintaining the account, storing preferences and favourites, generating recommendations.
• Article 6(1)(f) GDPR – the controllers’ legitimate interest in keeping the Service secure: limiting failed login attempts and moderating user-submitted content.

Data retention period

Data is retained for as long as the account is in use. Deleting your account from the profile panel permanently removes from the database: the user account, the preference profile, ingredient markings, the favourites list, and any submitted edit proposals.

This operation is irreversible – we keep no copies of that data after deletion. The failed-login counter tied to an IP address expires on its own after 5 minutes.

Your rights

In relation to the processing of your personal data, you have the right to:

• access your personal data,
• rectify (correct) your personal data,
• erase your data – directly, by deleting your account in the profile panel,
• restrict processing,
• data portability,
• object to processing based on legitimate interest,
• lodge a complaint with the President of the Personal Data Protection Office (UODO) or your local supervisory authority.

To exercise these rights, contact us at contact@incipreferences.app. We respond without undue delay and no later than one month from receiving a request.

Cookies

The Service uses only cookies that are strictly necessary for it to function. We do not use marketing, analytics, or advertising cookies – there is no Google Analytics or any other tracking tool in the Service.

Because all of the above are strictly necessary to provide the service, storing them does not require consent. You can delete or block cookies in your browser settings – blocking them will, however, make it impossible to log in.

Data recipients

Personal data is never sold, nor shared with third parties for their own purposes. We entrust it only to the infrastructure providers required to run the Service:

• Railway – application hosting (region: Amsterdam, Netherlands),
• Supabase – managed PostgreSQL database (region: Stockholm, Sweden),
• Cloudflare – DNS, CDN, DDoS protection, and forwarding of mail sent to our contact address,
• Google – the mailbox that receives correspondence sent to the Service’s contact address.

These entities process data solely on our instructions, to the extent necessary to provide services to the Service, and are bound by confidentiality obligations.

Transfers outside the EEA

The Service application and database run on servers located in the European Union – in Amsterdam and Stockholm respectively. Account, preference, and favourites data does not leave the EEA.

Cloudflare and Google, which handle the network layer and correspondence sent to our contact address respectively, operate globally, so technical data and the content of email messages may also be processed outside the European Economic Area.

Any such transfer takes place under standard contractual clauses approved by the European Commission, which constitute appropriate safeguards within the meaning of Article 46 GDPR.

Data security

We apply the following technical measures to protect personal data:

• HTTPS/TLS encryption enforced across the whole Service,
• passwords stored as PBKDF2 with SHA256 hashes,
• CSRF protection on forms and output escaping against XSS,
• Content Security Policy,
• a limit on failed login attempts,
• API rate limiting,
• data minimisation – we collect only what the Service needs to work.

Automated decisions and profiling

Cosmetic recommendations and safety colour markings are computed automatically, based solely on the preferences a user has entered themselves. We do not build profiles from behaviour, location, or data from other services.

This processing produces no legal effects concerning the user and does not similarly significantly affect them within the meaning of Article 22 GDPR.

Data entered by users

Users may add information about cosmetics to the Service: name, brand, and ingredient list. This content is publicly visible to all visitors and is not attributed to a publicly displayed author.

Please do not enter any personal data into these fields – neither your own nor anyone else’s.

Limitation of liability

Changes to this policy

We reserve the right to change this Privacy Policy. Users will be informed of significant changes through an announcement in the Service. The date of the last update is shown at the top of this document.

Contact

For matters concerning personal data protection and this Privacy Policy, please contact us:

Email

contact@incipreferences.app

Service address

incipreferences.app