Privacy Policy

Last updated: November 2026

⚠️ OPERATOR TO COMPLETE BEFORE RELYING ON THIS DOCUMENT. One fact is missing and only the site operator can supply it: the SIRET number, marked [TO COMPLETE] below.

Who is responsible for your data

Oluwabukola Popoola, a sole trader (French micro-entreprise) trading as COLYA, 494 rue Léon Blum, 34000 Montpellier, France, SIRET [TO COMPLETE: SIRET number], is the data controller for the personal data described here.

Privacy requests: hello@colya.agency

What we actually collect

This section lists what the application stores. It does not list categories we do not use.

When you create an account

• Email address — required, and used to send you a verification code.
• First name — optional.
• Password — stored only as a bcrypt hash. We never store it in readable form and cannot recover it.
• The version of the Terms of Use and Privacy Policy you accepted, and when.
• Whether your email address has been verified.

When you fill in your skin profile (optional — the site works without it)

• Age, skin type, concerns, product sensitivities, budget, vegan preference.
• Allergies and whether you are pregnant or breastfeeding.

These last two are health data. Under Article 9 GDPR they are a special category, and we process them only on the basis of your explicit consent, given when you enter them. They exist for one purpose: excluding products that would be unsuitable — for example, no retinoid is ever recommended to a profile marked as pregnant. You can leave these fields empty, and you can clear them at any time from your account.

When you use the site

• Saved routines, favourites, and your feedback on products (tried / rejected, with your own notes).
• Price alerts you create, and the reference price at the time you created them.
• Diagnosis (quiz) sessions: your answers and the resulting profile. These carry no email, no name and no IP address.
• Affiliate clicks: which product was clicked, when, and from which page. No IP address and no browser fingerprint are recorded.
• AI usage: which feature you used, how many tokens it consumed and what it cost. The content of your questions and of the answers is not recorded here.

When you use the assistant or the comparator Your question is sent to Anthropic for processing (see below). General questions and their answers are also stored in a shared cache so the same question is not paid for twice — avoid typing personal details into the assistant, as a cached general answer may be served to another user.

What we do not collect

• No advertising or analytics cookies, and no third-party analytics tool (no Google Analytics, no Meta pixel, no session recording).
• No IP addresses in the quiz, the affiliate clicks or the AI usage log.
• No payment data: the site does not take payments.
• No data from children. The service is not intended for under-16s.

Who we share it with

Recipient	What they receive	Why
Anthropic (Claude API)	The text of your question, and — for a routine — the skin profile fields you filled in	To generate the answer
Awin, Ascend	Nothing from us directly. Clicking a merchant link sends you to their domain, where they set their own cookies	Affiliate attribution
LWS (Ligne Web Services SAS)	Hosts the database and the application	Running the service

We do not sell personal data, and we do not share it for advertising.

When you click a merchant link, you leave this site. What that merchant and the affiliate network then do is governed by their privacy policies, not this one.

How long we keep it

• Your account and its content are kept until you ask us to delete them. There is no automatic expiry.
• Email verification codes expire after 15 minutes and are consumed on use.
• Cached AI answers that mention specific products are deleted after 7 days.
• Quiz sessions are kept for funnel analysis. They contain no identifier that links them to you.

Your rights

You may ask us to access, correct, delete or export your data, to restrict or object to processing, and to withdraw a consent you have given — including the consent covering health data.

How this works today, honestly: the site does not yet offer a button to delete or export your account. These requests are handled manually, by writing to the address above. We answer within one month, as required by the GDPR. A self-service option is planned.

You can already change or clear your skin profile — including allergies and pregnancy — yourself, at any time, from your account.

You also have the right to lodge a complaint with your national data protection authority.

Security

Passwords are hashed with bcrypt. Email verification codes are hashed too, so a database leak would not yield usable codes. Access to AI features requires a verified account, and repeated failed sign-ins are progressively delayed.

No system is perfectly secure, and we do not claim otherwise.

Changes

This policy is versioned. When we change it, the version number shown at the top of the page changes, and the version you accepted at sign-up is recorded against your account.