Privacy Policy

The independent data controller is Althevia Srl, Via Quarello 15/A, 10136 Torino (TO), Italy — P.IVA 13338180014, REA TO-1356275. For any privacy-related enquiry, contact us at info@althevia.net.

Depending on how you use Althevia Cosmic, we may collect the following categories of personal data:

• Account data: email address and username (required to access the service); first and last name (optional).
• Hair profile: type, porosity, damage level, scalp sensitivity — provided voluntarily and used exclusively to generate personalised recommendations.
• Preferences: hair goals, product filters (e.g. sulfate-free, paraben-free, etc.), liked and disliked products.
• Usage and interaction data: products you view, save, like, or dislike; the product pages and screens you open and how long you spend on them; searches you run (including the search terms) and filters you apply; and the retailer links you click ("where to buy"). We use this to understand engagement and to improve recommendations, rankings, search, and our catalogue.
• Technical data: IP address, browser type and version, operating system, session tokens, cookies.
• Support communications: messages and files you share with our support team.
• Analytics identifiers: a randomly generated device identifier and a session identifier stored in your browser. These are pseudonymous — not derived from your name or email — and let us measure how the service is used without identifying you directly.
• Payment and billing data: when you subscribe to the Premium plan, your payment is processed by our provider Stripe. We do not receive or store your full card number; we receive limited billing information such as your name, billing country, card type and last four digits, and your subscription and payment status.

Providing your email address and username is necessary to create an account and use the platform. All other data is voluntary; however, omitting your hair profile and preferences will significantly limit the quality of personalised recommendations you receive.

We do not collect or process special categories of personal data as defined in Art. 9 GDPR (such as health, genetic, biometric, racial, or religious data). Hair-profile data collected by Althevia Cosmic is cosmetic and aesthetic in nature and does not constitute health data under Art. 9.

We collect personal data through the following methods:

• Directly from you: when you register, complete your profile, configure preferences, or contact support.
• Automatically: through strictly necessary session cookies and server-side logs; and, where you have given analytics consent, through first-party usage events (such as pages opened, time spent on a product, searches, and clicks) sent to our own servers.
• Via third-party sign-in: if you choose to authenticate with Google, we receive only your email address and basic profile information from Google.

We process your personal data only for specific, explicit, and legitimate purposes. The table below sets out each purpose and its legal basis.

The platform uses automated algorithms to generate personalised product recommendations based on your hair profile and preferences. This constitutes profiling under Art. 4(4) GDPR, but does not produce legally binding decisions or decisions that significantly affect you in a comparable manner (Art. 22 GDPR). You may object to profiling-based processing at any time by contacting info@althevia.net.

Processing is carried out using automated and electronic tools designed to store, manage, and transmit data in a manner that ensures security and confidentiality.

We share your data only with processors who assist us in operating the platform, under written Data Processing Agreements:

• Amazon Web Services (AWS): cloud hosting and infrastructure services covering authentication, file storage, and content delivery. Servers are located in the EU and the United States.
• Google LLC: optional sign-in via Google. Only email and basic profile data are exchanged.
• Google Ireland Limited (Google AdSense): displays advertising to users on the free plan. Advertising cookies and identifiers are set only after you give consent through our cookie banner. For these purposes, Google and its advertising partners act as independent data controllers; see Google's Privacy Policy and its list of advertising partners.
• Stripe Payments Europe, Limited (with Stripe, Inc. as its sub-processor): payment processing for the Premium subscription. Stripe processes your payment data both as our processor, to carry out the transaction, and as an independent controller for fraud-prevention and to meet its own legal obligations; it is certified to the PCI-DSS standard. See Stripe's privacy policy for details.

We do not sell or rent your personal data, and we do not share it with data brokers. Apart from the advertising cookies you expressly consent to (see Section 9), we do not share your personal data with third parties for their own marketing purposes.

Your personal data will not be disclosed, made available, or shared in any form with parties other than those identified above, or with indeterminate third parties.

Our primary cloud infrastructure provider may process data in the United States. Such transfers are governed by Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR, which provide adequate safeguards for your data. Our third-party sign-in provider participates in the EU–US Data Privacy Framework, established by European Commission Implementing Decision (EU) 2023/1795 of 10 July 2023. Our payment provider, Stripe, may also process limited personal data in the United States; such transfers are protected by Standard Contractual Clauses and/or the EU–US Data Privacy Framework. No other international transfers take place.

We retain personal data for no longer than necessary for the purposes for which it was collected:

• Account data: retained for the duration of the account, plus 12 months after deletion for backup and legal compliance purposes.
• Hair profile and preferences: retained while your account is active; deleted with the account.
• Product interaction logs (views, likes, saves): retained for 24 months, then permanently anonymised.
• Authentication cookies: automatically expire after a limited period and are cleared on logout.
• Waitlist email list: retained until you unsubscribe or withdraw consent.
• Support communications: retained for 3 years.
• Usage and analytics events (pages opened, time spent, searches, clicks): retained in identifiable form for up to 14 months, then automatically deleted.
• Aggregated statistics derived from usage events: anonymous, with no link to you, and may be retained indefinitely.
• Payment and billing records: retained for 10 years from the relevant transaction, as required by Italian tax and accounting law (Article 2220 of the Italian Civil Code).

In the event of out-of-court or judicial proceedings, personal data will be retained for the entire duration of the dispute and until the expiry of the applicable statutory limitation periods.

As a data subject under the GDPR, you have the following rights:

• Right of access (Art. 15): obtain a copy of the personal data we hold about you.
• Right to rectification (Art. 16): have inaccurate personal data corrected without undue delay.
• Right to erasure (Art. 17): request deletion of your personal data ("right to be forgotten").
• Right to restriction of processing (Art. 18): limit how we process your data in certain circumstances.
• Right to data portability (Art. 20): receive your data in a structured, commonly used, machine-readable format.
• Right to object (Art. 21): object to processing based on legitimate interest.
• Right to withdraw consent (Art. 7(3)): withdraw your consent at any time for consent-based processing, without affecting the lawfulness of processing before the withdrawal.

Pursuant to Art. 21 GDPR, you may object at any time to the processing of your personal data for direct marketing purposes, including profiling insofar as it relates to such marketing. Upon objection, your data will no longer be processed for those purposes.

To exercise any of these rights, email info@althevia.net. We will respond within 30 days of receipt of your request.

You may also access, modify, or delete your personal data directly from the platform: log in to your account and go to Settings. Account deletion is available via the dedicated option in the Settings page.

You also have the right to lodge a complaint with the Italian data protection authority: Garante per la Protezione dei Dati Personali — www.garanteprivacy.it.

We use cookies and similar browser storage in three categories: strictly necessary (always active), analytics and measurement (first-party, only with your consent), and advertising (only with your consent).

Strictly necessary cookies (always active):

• Session cookie: used to maintain your authenticated session while you use the platform — expires when you close your browser or log out.
• Persistent cookie: allows you to remain logged in across browser sessions for a limited period without re-entering your credentials.

Analytics and measurement (first-party, with consent)

With your consent, we store a random device identifier and a session identifier in your browser and record how you use the service (pages opened, time spent, searches, filters, clicks). This data is first-party: it is sent only to our own servers and is never shared with third parties or used for advertising. We collect this consent through the same consent banner we use for advertising, shown when you first visit. You can change or withdraw it at any time using the "Cookie preferences" link in the footer, or by clearing your browser storage; withdrawal does not affect processing carried out before it.

Advertising cookies

If you use the free plan, we show advertising provided by Google AdSense. With your consent, Google and its partners store and read cookies and similar identifiers on your device to select, deliver, and measure advertising. These cookies are not set until you accept them. Users on the premium plan are not shown advertising.

Advertising cookies are placed only with your prior, freely given consent (Art. 6(1)(a) GDPR; Art. 5(3) ePrivacy Directive), collected when you first visit through Google's certified Consent Management Platform. You can change or withdraw your choice at any time using the "Cookie preferences" link in the footer, or by clearing cookies in your browser. Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal.

Some browser storage is strictly necessary (for example, to keep you logged in and to remember your cookie choices) and stays on your device. Analytics identifiers (see above) are stored and sent to our own servers only with your consent, and are never shared with third parties.

If you disable cookies in your browser, you will not be able to log in to the platform.

We implement appropriate technical and organisational security measures, including:

• Encryption of all data in transit using industry-standard protocols.
• Security-hardened cookies configured to protect your session.
• Secure credential management following industry-standard practices.
• Access controls to ensure users can only access their own data.
• Monitoring and logging practices that exclude personal credentials.

No system is 100% secure. If you discover a security vulnerability, please disclose it responsibly to info@althevia.net.

Althevia Cosmic is intended for users aged 18 and over. We do not knowingly collect personal data from persons under 18. If we become aware that such data has been collected, we will delete it promptly. If you believe a person under 18 has provided us with their data, please contact info@althevia.net.

We may update this Privacy Policy to reflect changes in our data practices or applicable law. We will notify you by email and/or by a prominent notice on the platform at least 15 days before any material changes take effect. The date at the top of this page indicates when the policy was last revised. We encourage you to review it periodically.

For any privacy-related question, request, or complaint: