LEGAL

Privacy Policy

Data Controller

DISINDEX S.R.L.
Via Renzo e Lucia 9, 20142 Milano (Italy)
P. IVA: 11611310969 · RI/REA: MI-2614128
Email: privacy@divamea.com

1. Categories of Data Processed

1. Account data — Email, name, organization name, role (collected at registration).
2. Knowledge base content — Documents uploaded by the tenant (PDF, DOCX, media, etc.), stored securely and processed for AI retrieval.
3. Product catalog data — Product information imported or synced from e-commerce platforms.
4. Conversation data — Chat messages between end-users and AI assistants.
5. Cosmetic skin analysis photos — Facial images uploaded by users solely for non-medical cosmetic skin parameter assessment (hydration, pore visibility, fine lines) pursuant to EU AI Act (Reg. (EU) 2024/1689) transparency standards. Processed exclusively upon explicit consent (GDPR Art. 6(1)(a) and Art. 9(2)(a)), never used for biometric identification, facial recognition, or foundational model training, and automatically purged from storage within a 30-minute retention window (TTL).
6. Lead data — Name, email, phone, custom fields collected via widget lead capture forms.
7. Technical data — IP addresses, browser info, language preferences (for widget localization).
8. Billing data — Payment information processed by Stripe (Divamea does not store card details).

2. Legal Bases for Processing (GDPR Art. 6)

• Consent — Skin analysis photos, lead capture forms.
• Contractual necessity — Account management, service delivery.
• Legitimate interest — Analytics, platform improvement, security.

3. Data Storage and Isolation

• All tenant data is isolated using PostgreSQL Row-Level Security (RLS).
• Documents stored in Google Cloud Storage with signed, time-limited access URLs.
• Database hosted on Supabase infrastructure (EU region).
• Application services run on Google Cloud Run (EU).

4. Third-Party Sub-Processors

5. Data Retention

• Account data: Retained while account is active, deleted upon request.
• Conversation data: Soft-deleted on request; hard-deletion via GDPR erasure function.
• Original skincare photos: 30-minute automatic TTL — auto-deleted via scheduled automated cleanup and queued physical storage purging. Transient memory buffers are wiped immediately upon analysis completion.
• Anonymized skincare metrics: Retained for historical routine comparison (contains zero biometric identifiers, only numeric skin parameter scores).
• Photo access audit log: Retained indefinitely for compliance (never deleted, even during GDPR erasure).
• Audit logs: Retained indefinitely for compliance purposes.

6. EU AI Act Compliance & AI Transparency (Regulation (EU) 2024/1689)

In full compliance with Regulation (EU) 2024/1689 of the European Parliament and of the Council (“EU AI Act”), we maintain transparent and responsible AI operational standards:

• Art. 50(1) Notice of AI Interaction: Whenever you interact with our conversational chat assistants or automated skincare modules, you are clearly informed that you are interacting with an Artificial Intelligence system powered by large language models and computer vision algorithms.
• Art. 50(2) & 50(4) AI-Generated & Simulated Media: Visual before/after skincare simulations and condition projections are synthetic media generated via generative machine learning algorithms. Such outputs are visibly marked with permanent ✨ AI SIMULATION badges and watermarks to ensure complete distinction from real photographic outcomes.
• Non-Medical Classification (MDR (EU) 2017/745): The Platform and its AI modules are designed and operated strictly for non-medical, cosmetic and informational purposes. The Platform is neither classified nor certified as a Software as a Medical Device (SaMD). It does not provide medical diagnoses, clinical assessments, or therapeutic treatment recommendations. Users suspecting dermatological conditions are advised to consult a licensed medical professional.
• Prohibition of Biometric Identification (Art. 5 EU AI Act): The Platform does not perform facial recognition, identity verification, emotion recognition in educational/workplace settings, social scoring, or biometric categorization of protected personal characteristics. Photographic inputs are processed transiently solely to compute visual cosmetic parameters.
• Human Oversight & Right to Explanation (Art. 86): End-users and business tenants maintain the right to understand the parameters leading to cosmetic skincare recommendations and may request human intervention or review at any time.

7. GDPR Data Deletion (Right to Erasure)

Our platform provides atomic data deletion capabilities:

1. Soft-deletes the conversation record (tombstone preserved for audit).
2. Hard-deletes all conversation messages (personal text content permanently removed).
3. Hard-deletes retrieval events.
4. Scrubs skincare session personal fields (analysis data, names, emails, allergy info, photo paths set to NULL).
5. Enqueues and executes physical file purging from cloud object storage.

Three deletion reasons are supported: tenant request, GDPR erasure, and admin action.

The photo access audit log is preserved even after deletion as an immutable compliance record.

8. Data Subject Rights (GDPR Art. 15–22)

You have the right to:

• Access your personal data
• Rectify inaccurate data
• Request erasure of your data
• Restrict processing
• Data portability
• Object to processing

Contact: privacy@divamea.com

9. Security Measures

• Row-Level Security (RLS) on all tenant-scoped database tables (25+ tables)
• HTTPS/TLS for all data in transit
• Encrypted at rest (infrastructure-level encryption via Supabase/GCS)
• Signed URLs with expiration for file access
• Role-based access control (Owner, Admin, Member)
• AI Shield Guardrails auto-prepended to prevent data leakage and clinical claims
• Full audit logging of critical actions (insert-only, no edit/delete)
• Photo anonymization for cosmetic skin analysis
• Photo 30-minute automatic TTL with scheduled automated cleanup and physical storage purging
• Immutable photo access audit log
• Storage-level access control (private buckets)
• Service role separation for admin operations

10. Cookies

• Technical session cookies (Supabase Auth, active tenant state) — Strictly necessary for authentication and multi-tenant security (httpOnly, secure, sameSite: lax). These do not require user consent.
• Statistical analytics cookies (Google Analytics 4) — Used solely for aggregated website telemetry. In compliance with European ePrivacy and Garante Privacy guidelines, Google Consent Mode v2 enforces prior blocking: all analytics storage is set to denied by default and is activated only if you explicitly accept statistical cookies via our cookie banner.
• Consent management — Managed via Iubenda CMP. You can review, modify, or revoke your cookie choices at any time through the cookie settings link.
• No third-party advertising or profiling cookies
• No cross-site behavioral tracking or browser fingerprinting

11. Contact

For any privacy-related inquiries, please contact us at: privacy@divamea.com