At Cosme Check, we take the confidentiality of your data very seriously. This page explains transparently what we collect, why, where it is stored and what your rights are, in compliance with the General Data Protection Regulation (GDPR).
1. Data Controller
The data controller is Brian-Clarky BIENDOU, publisher of Cosme Check. For any questions about your personal data, you can contact us at : contact@cosme-check.com.
2. Data Collected
2.1 Data Provided Directly by You
- Account Creation : first name, email address and password (encrypted, never stored in plain text).
- Google Sign-In : first name, email address and profile photo transmitted by Google. No other access to your Google account is requested.
- Analyzed INCI Lists : the ingredient lists you type or paste in the analyzer, or those linked to a product identified by barcode or searched in our catalog, are processed to produce your analysis.
- Analysis History : if you are logged in, your analyses are saved so you can find them later.
- Report Photos : if you send a photo to report or correct a product listing, that image is retained for the time needed for moderation (see section 6).
2.2 Data Collected Automatically
- Technical Data : device type, browser, IP address (anonymized), pages visited. Used only to measure audience and improve the site, via an anonymous audience-measurement tool (PostHog, hosted in the European Union). No advertising profile is built and no personally identifying data (email, name) is associated with these statistics.
- Strictly Necessary Cookies : an encrypted session cookie to keep you logged in. The PostHog audience-measurement tool uses no cookie : it stores an anonymous identifier in your browser's local storage (localStorage). No advertising or third-party tracking cookies.
2.3 Artificial Intelligence
Some features (INCI list analysis, beauty assistant, personalized summaries) rely on artificial-intelligence models provided by OpenAI and Mistral AI. To produce these results, only the strictly necessary data is sent to them : the ingredient (INCI) lists and, where applicable, your skin profile. This data is not used to train their models. Mistral AI is a French company hosting its processing mainly within the European Union ; processing by OpenAI involves a transfer outside the EU, governed by the European Commission's Standard Contractual Clauses.
3. Processing Purposes
- Allow you to create an account and log in.
- Analyze the INCI lists you submit to us.
- Save your analysis history and routine.
- Improve the site (anonymous audience measurement).
- Respond to your email requests.
4. Legal Basis
- Contract Performance : account creation, history saving, analyses (GDPR Art. 6.1.b).
- Legitimate Interest : anonymous audience measurement and site security (Art. 6.1.f).
- Consent : when you choose to sign in with Google (Art. 6.1.a).
5. Processors and Recipients
Your data is never sold or transferred to third parties for commercial purposes. It is only processed by the following technical processors, chosen for their GDPR compliance :
- Supabase Inc. - Hébergement de la base de données et gestion des comptes utilisateurs. Location : États-Unis / Union européenne (Francfort). Privacy Policy.
- Vercel Inc. - Hébergement du site et analytics anonymes. Location : États-Unis. Privacy Policy.
- Google LLC - Authentification optionnelle « Se connecter avec Google ». Location : États-Unis / Irlande. Privacy Policy.
- OpenAI, L.L.C. - Analyses INCI, assistant beauté et génération de résumés (transfert hors UE encadré par les Clauses Contractuelles Types). Location : États-Unis. Privacy Policy.
- Mistral AI SAS - Traitement par intelligence artificielle des analyses INCI et de l'assistant (société française, hébergement principalement dans l'Union européenne). Location : Union européenne (France). Privacy Policy.
- Stripe, Inc. - Gestion des paiements et abonnements (aucune donnée bancaire complète ne transite ni n'est stockée par nos serveurs ; transfert hors UE encadré par les Clauses Contractuelles Types). Location : États-Unis. Privacy Policy.
- PostHog Inc. - Mesure d'audience anonyme (statistiques de fréquentation sans cookie publicitaire ni identifiant nominatif), hébergée dans l'Union européenne (eu.i.posthog.com). Location : Union européenne. Privacy Policy.
- Brevo (Sendinblue SAS) - Gestion des contacts inscrits pour les communications de service liées au compte, et envoi de newsletters / emails marketing uniquement aux utilisateurs ayant donné leur consentement explicite (opt-in). Location : Union européenne (France). Privacy Policy.
Some of these processors are located outside the European Union (particularly in the United States). In such cases, appropriate safeguards (Standard Contractual Clauses from the European Commission) are in place.
6. Data Retention Period
- User Account : as long as your account is active, then deleted on request or after 3 years of inactivity.
- Report Photos : images sent to report or correct a product listing are retained for the time needed for moderation, then deleted.
- Technical Logs : maximum 30 days.
7. Your Rights
Under GDPR, you have the following rights :
- Right of Access : obtain a copy of your data.
- Right to Rectification : correct inaccurate data.
- Right to Erasure : request deletion of your account and all your data.
- Right to Data Portability : retrieve your analyses in a reusable format.
- Right to Object : object to processing for legitimate reasons.
- Right to Withdraw Consent : at any time, without retroactive effect.
To exercise these rights, write to us at contact@cosme-check.com. You can also file a complaint with your supervisory authority (EDPB).
8. Security
Passwords are encrypted (bcrypt hash on Supabase Auth side), exchanges between your browser and our servers are encrypted via HTTPS (TLS 1.2 minimum), and database access is restricted via Row Level Security policies.
9. Cookies and Audience Measurement
Cosme Check uses only strictly necessary cookies for site operation (login session). No advertising or third-party tracking cookies are placed on your device.
To measure its traffic, the site uses an anonymous audience-measurement tool (PostHog) : no session replay, no cross-site behavioral tracking, no advertising profile, and an anonymous technical identifier stored in your browser's local storage (localStorage) rather than in a cookie. This processing relies on our legitimate interest (GDPR Art. 6.1.f) in measuring audience anonymously. Configured this way, this tool qualifies as consent-exempt audience measurement : no consent banner is required in this configuration.
10. Minors
Cosme Check is not intended for children under 15 years of age. If you are a minor, ask your parents for permission before creating an account.
11. Changes
This policy may be updated to reflect technical or legal changes. The date of last update is indicated at the top of the page. If we make significant changes, we will notify you by email if you have an account.