Privacy Policy

Data controller

The data controller is Saisona (Quai du Parc, 94100 Saint-Maur-des-Fossés, France). For any privacy request, contact [E-mail].

Data we collect

• Your selfie: sent once for the analysis, processed in memory, then discarded. It is never stored on our servers, never sold and never used to train an AI. A copy stays in your browser, which you can delete anytime.
• Your result: your season, the colors measured on your photo (skin, hair, eyes) and where your face sits in the photo, linked to an anonymous identifier, and to your payment email if you buy the guide. No name.
• Your answers to the questionnaire (age range, hair, eyes, preferences, how you found us).
• Payment: processed by Stripe, which collects your email for the receipt. We keep that email with your result so you can get your guide back on another device, with a code sent to that address. We never see card numbers.
• Technical data: an encrypted fingerprint of your IP address (never the address itself), kept for 30 days at most to limit abuse, and technical logs.

Why we use it & legal bases

• Provide the service (analysis, results, guide): performance of the contract.
• Process payments and meet accounting obligations: legal obligation.
• Secure the service, limit abuse and improve the product: legitimate interest.

AI analysis

The colors of your selfie are read by Google’s Gemini API, on its paid tier, which does not use the data it receives to train its models. A fixed calculation then picks your season.

Payments (Stripe)

Payments are handled by Stripe, a secure payment provider. The data needed to process a transaction may be shared with Stripe to complete payment, prevent fraud and meet legal obligations. Saisona never stores card numbers.

Cookies & local storage

Saisona only uses what the service needs to work, which requires no consent:

• your anonymous session (Supabase) and your results, kept in your browser’s local storage;
• a “lang” cookie that remembers your language;
• Stripe’s cookies on its checkout page.

No analytics or advertising cookies. We count visits with Vercel Web Analytics, which works without cookies: it does not store your IP address, recognizes a visit through a temporary fingerprint erased after 24 hours, and keeps only totals (page views, country, device type, steps of the journey).

Retention

Your results and answers are kept until you delete them (My account → Delete all my data). Billing data is kept for the legal retention period. The IP fingerprint is erased after 30 days.

Sharing

Data may be shared with our technical providers (site hosting: Vercel; database: Supabase, in the European Union; analysis: Google; payment: Stripe), or with authorities where the law requires it. Some providers may process data outside the EU, in which case appropriate safeguards are applied under the GDPR.

Your rights

You may request access, rectification, erasure, restriction, objection, portability, and withdraw consent at any time: contact [E-mail]. You can also delete everything yourself from My account. You may lodge a complaint with the French data protection authority (CNIL, cnil.fr).

Security

We apply reasonable measures to protect your data: encrypted connections (HTTPS), restricted access, vetted providers and technical monitoring.