Privacy policy

The controller of your personal data is:

• Aymane Hilmi (Sole proprietor (micro-enterprise)), trading under the name Sevéa
• Registered office: 2 place Martin Luther King, 34170 Castelnau-le-Lez, France
• SIRET: 89459301100030
• Contact (any GDPR request): contact@sevea.app

Given the size of the business, Sevéa is not required to appoint a data protection officer (DPO). Any request concerning your data is handled by the publisher at the address above.

a. Account data

Email address, first name (optional), account creation date, subscription status (free or Sevéa+). If you sign in with Apple or Google, we receive your account identifier and your email address from that service. For Apple, we also keep, in encrypted form, a token that allows us to revoke Sevéa's access to your Apple account when you delete your account.

b. Declared profile

Information you provide during onboarding or from your profile: perceived skin type, concerns, sensitivity, experience with active ingredients, current treatments, pregnancy or breastfeeding, known allergies. This data feeds the personalisation of your routine and the safety alerts.

Among this information, pregnancy or breastfeeding, current treatments and declared allergies are data concerning health within the meaning of Article 9 of the GDPR. Their processing is based on your explicit consent, which you can withdraw at any time by deleting this information from the “My information” screen. This data is used to adapt your routine and to alert you to ingredients to avoid.

c. Photo of your face

During an assessment, you take a photo of your face. This photo is:

• sent to our analysis provider (AILabTools), which processes it and deletes it within 24 hours;
• kept only if you turn on the “Keep my photos” option (off by default), to compare your skin over time. It is then stored in a private space with our hosting provider Supabase (Ireland), accessible only to you through your account, and encrypted at rest and in transit. Turning the option off deletes the photos already kept;
• without this option, not kept after the analysis: only the results of the assessment are kept.

The photo of your face is potentially sensitive data. Its processing is based on your explicit consent (Article 9 of the GDPR), obtained when you take your first photo. You can withdraw this consent at any time.

d. Assessment results and history

Overall skin index, analysed dimensions, assessment dates. These results belong to you and are stored for as long as you keep your account active.

e. Routine and journal

Steps of your morning and evening routine, selected products, reminders turned on, any daily check-offs.

f. Personalisation by artificial intelligence

The texts of your assessment, your routine advice and the verdicts on products are written by an OpenAI model. We send it your results (indicators, skin tone), your declared profile (including pregnancy, treatments and allergies), the categories of your routine steps and, for a product, its ingredient list. The photo of your face is never sent to it. According to the policy applicable to its API, OpenAI does not use this data to train its models. This transmission is based on your explicit consent, which you can withdraw from the “Privacy” screen of the app.

g. Product scanning

When you scan a product, its barcode is sent to our servers, which query product databases (Go-UPC, Open Food Facts) to find its composition. These services only receive the barcode, never your personal data.

h. Subscription data

The Sevéa+ subscription is managed by the App Store (Apple) and RevenueCat. We never store your bank details. We only receive the status of your subscription (active, renewed, cancelled, expired) in order to unlock the premium features.

i. Technical data and audience measurement

Device model, iOS version, language, error logs. The app also sends anonymous usage statistics (screens viewed, steps completed) and crash reports to PostHog (European Union). They are never linked to your account or to your answers, and your IP address is not kept. You can refuse them at any time from the “Privacy” screen of the app (“Anonymous usage statistics” switch).

j. Website waitlist

If you leave your email address on the "waitlist" page of sevea.app, we store it with the page language and the date of your agreement, only to send you one email when the app launches. This relies on your consent (the box is unticked by default). Your address is deleted after that email, and at the latest six months after you signed up. It is hosted by Supabase (European Union), the email is sent by Resend, and we keep only a hashed fingerprint of your IP address to limit abuse. To be removed from the list earlier, write to the contact address above.

• Running the service: producing your skin assessment, feeding your tracking curve, generating your personalised routine and writing its texts.
• Ensuring your safety: detecting conflicts between active ingredients, contraindications related to pregnancy or a current treatment, and the allergens you have declared.
• Managing your account and your Sevéa+ subscription.
• Improving the service: fixing bugs, securing the platform, preventing abuse (in particular via Apple DeviceCheck for the free quota), measuring the app's audience anonymously.
• Complying with our legal obligations: keeping accounting records, responding to judicial requests where applicable.

In accordance with Article 6 of the GDPR, our processing is based on:

• The performance of the contract you enter into with us by using Sevéa (providing the service, managing your account, managing your subscription).
• Your consent, explicit and revocable, for the processing falling under Article 9 of the GDPR: (i) taking and analysing the photo of your face (potentially biometric data), (ii) collecting your declared health data (pregnancy or breastfeeding, treatments, allergies) and (iii) sending it to OpenAI to write your personalised texts. These consents can be withdrawn at any time from the app.
• Our legitimate interest in securing the service, preventing fraud and improving the app, including through anonymous audience measurement that you can refuse, while respecting your rights and freedoms.
• Our legal obligations (accounting, fraud prevention).

To run Sevéa, we use technical providers acting as processors within the meaning of Article 28 of the GDPR. Each of them is bound by contractual commitments on confidentiality and security.

Some of our processors (AILabTools in Hong Kong; OpenAI, RevenueCat, Apple, Resend and Vercel in the United States) process data from outside the European Union.

Where applicable, these transfers are governed by the standard contractual clauses adopted by the European Commission, or by the other mechanisms provided for in Articles 44 to 49 of the GDPR (adequacy decisions, certifications). Sevéa does not make any transfer outside the EU that is not legally governed.

Sevéa requires every provider that receives your data, including AILabTools and OpenAI, to give it the same or equal protection as described in this policy, and to use it only to provide its service to us.

• Account and profile data: as long as your account is active. When the account is deleted, this data is erased within 30 days.
• Face photo:at our analysis provider, deleted within 24 hours. In your private Supabase space, only if you have turned on “Keep my photos”: kept as long as the option remains on and you keep your account.
• Result of each analysis, on our servers: kept for 24 hours at most, only so it can be returned to you if the app is closed or the analysis is interrupted before you received it, including without an account. It contains only numerical indicators, never the photo, and is then deleted automatically.
• Data sent to OpenAI: according to the policy applicable to its API, kept by OpenAI for up to 30 days for abuse detection, then deleted.
• Assessments and tracking history: kept as long as your account is active (they feed your progress curve).
• Technical security logs: kept for a limited period (generally 12 months), necessary for detecting abuse.
• Accounting data related to the subscription: kept for the legal period (10 years), in accordance with accounting and tax obligations.

Sevéa implements reasonable technical and organisational measures to protect your data: TLS encryption in transit, encryption at rest at the hosting provider, strict per-account access control, access logging. Face photos are stored in a private storage space where only your authenticated session can access your own files.

No system is completely infallible. In the event of a security incident affecting your personal data, we will inform you in accordance with Articles 33 and 34 of the GDPR.

In accordance with Articles 15 to 22 of the GDPR, you have the following rights over your data:

• right of access to your data;
• right to rectification of inaccurate data;
• right to erasure (deletion of your account and your data from the app, or on request at the address below);
• right to restriction of processing;
• right to portability of your data in a structured format;
• right to object to processing based on legitimate interest;
• right to withdraw your consent at any time, in particular for the face photo;
• right to give instructions on what happens to your data after your death.

You can exercise these rights:

• directly from the app (“Privacy” screen: withdrawing your consent to the analysis, withdrawing your AI consent, refusing usage statistics, deleting your account and all its data),
• or by email at contact@sevea.app.

If you believe that your rights are not being respected, you can lodge a complaint with the CNIL (Commission nationale de l'informatique et des libertés, the French data protection authority).

The sevea.app website does not use third-party cookies for audience measurement or targeted advertising. Only cookies that are strictly necessary for the technical operation of the website may be set, in accordance with Article 82 of the French Data Protection Act (loi Informatique et Libertés). No consent is required for this category.

This policy may be updated to reflect changes to the service, to the regulations or to our processors. The date of the last update is shown at the top of this page. In the event of a substantial change (for example, adding a processor or changing a purpose), you will be informed in the app.

For any question about your personal data: contact@sevea.app.