Privacy
notice

1Data controller#

The data controller is GLOUP, which may be contacted at privacy@gloup.beauty. GLOUP is developed and operated by Riccardo Sasso, a natural person, who is the controller of the processing within the meaning of Article 4 GDPR.

No Data Protection Officer has been designated, since none of the conditions laid down in Article 37 of Regulation (EU) 2016/679 (“GDPR”) applies.

2Scope#

This notice is provided pursuant to Articles 13 and 14 GDPR and applies to anyone who uses the GLOUP application, wherever it is used. The controller applies the GDPR standard to all users; any rights conferred by other national legislation remain unaffected and are in addition to those listed here.

3Data processed on the device#

The data listed in the table below are generated and stored solely in the memory of the user’s device. The controller has no access to them and does not hold them in any form.

Photos are processed entirely on the device. The application does not perform facial recognition and does not generate biometric templates capable of uniquely identifying a natural person: images are used solely to measure optical parameters of the skin surface. Those parameters describe the appearance of a surface, not the user’s state of health: they are not used to detect or monitor any medical condition and do not constitute data concerning health within the meaning of Article 4(15) GDPR. The controller nevertheless handles them with the care owed to sensitive data: every scan is initiated by the user after authorising access to the camera, and consent may be withdrawn at any time by ceasing to carry out scans and deleting photos and scores from the Profile section of the application, or by revoking camera access in the system settings. No data capable of revealing a person’s state of health is disclosed to third parties.

The application does not process email addresses, telephone numbers, contacts, geolocation data, the device’s advertising identifier or browsing history. No third-party analytics, crash-reporting or advertising measurement tools are integrated into the application.

Face data

This section gives a complete description of the face-related data processed by the application.

• Face photo. When the user starts a scan, the application takes three quick photos with the front camera. The first is saved in the application’s private storage area on the device, so that the user can compare their own photos over time; the other two are used only to make the reading steadier and are deleted immediately afterwards.
• Framing frames. While the user frames their face, the application reads low-resolution frames approximately every 0.7 seconds for the sole purpose of determining the position and size of the face and guiding the framing. Each frame is deleted immediately after it has been read and is not retained.
• Face landmarks. To locate the areas to be observed (forehead, cheeks, nose, chin, eye area), Apple’s Vision framework computes on the device the bounding box of the face and two-dimensional landmark points (eyes, eyebrows, nose, mouth, contour). These points are used only during the analysis and are not retained.
• Data retained with each scan. Optical measurements by area (colour, lightness, shine, texture, pores and spots per unit of area) and values about the appearance of each area (blemishes, marks, redness, fine lines, eye area), read on the device by an image-analysis model; photo quality, the proportion of the photo taken up by the face, the distance in pixels between the eyes and the head tilt angles. The latter serve solely to make measurements taken at different distances and angles comparable. None of these data allows a person to be identified.
• What the application does not do. It does not use the TrueDepth camera, ARKit or depth data. It does not perform facial recognition or facial authentication and does not create faceprints or biometric templates. It does not transmit face data to any server, to the controller or to third parties (including Apple and RevenueCat), and does not use them for advertising, marketing, profiling, sale or model training.
• Retention and deletion. Face data remain on the device until the user deletes them. The “Delete all my data” command in the Profile section immediately deletes the saved photos and measurements; temporary copies created by the camera when the photo is taken remain in the application’s cache, which the system clears automatically. Uninstalling the application deletes everything. Face photos are excluded from device backups (iCloud or computer). Like all app data, the measurements may be included in the backup if the user has enabled it, which is managed by Apple under the user’s control: the controller has no access to it. The file the user can export with “Download my data” contains the measurements but not the photos, and is shared only where the user chooses.

Deletion

The user may delete the data from the Profile section of the application or by uninstalling the application: in either case the data are removed from the device and no copy remains with the controller, which has never had them at its disposal. Deletion from the device does not affect the invite programme data held on the server, for which see Article 9.

4Data disclosed to third parties#

The only disclosures of data to third parties are those set out below, which are strictly necessary for the operation of the respective features.

RevenueCat, Inc. acts as a processor within the meaning of Article 28 GDPR. The identifier it generates is a random code, not linked to the user’s name, email address or any other identifying data, and does not allow the data stored on the device to be traced.

GLOUP servers

Two features of the application communicate with servers of the controller hosted by Cloudflare, Inc., which acts as a processor within the meaning of Article 28 GDPR. No photos, scores, skin observations, diary answers, name, age or email address are sent to either server. As with any internet service, Cloudflare necessarily processes the device’s IP address in order to respond to requests; the controller does not log or store it. For processing that Cloudflare carries out on its own account, please refer to its privacy policy (cloudflare.com/privacypolicy).

• Invite server. When the application starts and each time it returns to the foreground, it asks the server for the user’s personal invite code, created the first time and linked to their random identifier, and reads how many friends have joined with that code. When the user enters a friend’s code, the application first sends only the code, to check that it is an invite code, and then, once initial setup is complete, sends the user’s own random identifier together with the code. Each user can use only one invite code. When three different friends have joined with the same code, the server asks RevenueCat to activate one month of GLOUP Premium for the user who invited them, once only. The server uses the IP address only in its temporary memory, to limit repeated requests, and does not save it in its database.
• Catalogue server. When the application starts and each time it returns to the foreground, at most once every five minutes, it checks whether a new catalogue is available and, if so, downloads it; product photos and product sheets are downloaded when needed. The server is read-only and the request names only the file required (for the catalogue, the one intended for the country of the user’s App Store). The application checks every file before using it, by means of a digital signature and a checksum.

5Transfers to third countries#

The processing carried out by RevenueCat, Inc. involves a transfer of data to the United States of America. The transfer is covered by the standard contractual clauses adopted by the European Commission by Implementing Decision (EU) 2021/914, supplemented by the additional measures provided for in the data processing agreement entered into with the provider. The data subject may request a copy of the safeguards adopted by writing to the address given in Article 1. Reports of products missing from the catalogue are received by Google Ireland Limited within the European Union; any further processing by the Google group in the United States is covered by the EU-U.S. Data Privacy Framework, in which Google LLC participates, and by the same standard contractual clauses. The invite and catalogue servers are hosted by Cloudflare, Inc., which is established in the United States: the transfer is covered by the EU-U.S. Data Privacy Framework, in which Cloudflare, Inc. participates, and by the European Commission’s standard contractual clauses included in Cloudflare’s data processing addendum.

6Email communications#

Where the user writes to the controller of their own accord, including to be notified when the application becomes available, the email address and the content of the message are processed solely in order to respond to the request and, where relevant, to send the communication requested.

The legal basis is the data subject’s consent, given by sending the message (Article 6(1)(a) GDPR). Consent may be withdrawn at any time by writing to the address given in Article 1, whereupon the address will be deleted from the controller’s lists. Addresses are not passed on to third parties or used for purposes other than those set out here.

7Legal bases for processing#

• Operation of the application (data on the device): processing is carried out locally under the user’s exclusive control, in the context of the performance of the licence agreement, Article 6(1)(b) GDPR.
• Subscription: performance of the contract and fulfilment of the resulting obligations, Article 6(1)(b) GDPR.
• “Invite your friends” programme and catalogue updates: performance of the contract, Article 6(1)(b) GDPR.
• Creator code and reports of missing products: the controller’s legitimate interest, Article 6(1)(f) GDPR, as set out in Article 4.
• Correspondence and requested communications: consent of the data subject, Article 6(1)(a) GDPR.

Providing the data needed to use the application is optional; if the data are not provided, the corresponding features cannot be used.

8Retention periods#

• Data on the device: until deleted by the user or until the application is uninstalled.
• Subscription data held by the processor: for the duration of the subscription and thereafter for the period necessary to comply with legal obligations, in particular tax and accounting obligations.
• Invite programme data on the server: for as long as the programme runs and in any event for no longer than twenty-four months from the last activity; deleted earlier on request to privacy@gloup.beauty.
• IP address processed by Cloudflare: not logged or stored by the controller; for Cloudflare, please refer to its privacy policy.
• Correspondence: until consent is withdrawn and in any event for no longer than twenty-four months from the last contact.

9Rights of the data subject#

The data subject may at any time exercise the rights provided for in Articles 15 to 22 GDPR: access, rectification, erasure, restriction of processing, data portability and objection, as well as withdrawal of consent without affecting the lawfulness of processing based on consent given before its withdrawal.

Requests should be sent to privacy@gloup.beauty and will be answered within thirty days, which may be extended by a further two months in the cases provided for in Article 12(3) GDPR, in which event the data subject will be informed.

As regards the data stored on the device, the data subject exercises these rights directly and in full through the features of the application, since the controller does not hold those data.

Invite programme data held on the server are not deleted by the features of the application: to access them or have them deleted, the data subject should write to privacy@gloup.beauty quoting their invite code, which is shown in the application, since the controller does not know users’ identities.

A data subject who considers that the processing does not comply with the law has the right to lodge a complaint with the Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Roma, garante@gpdp.it), or with the supervisory authority of the Member State of habitual residence, and to bring proceedings before the courts.

10Minors#

The application is not intended for persons under the age of 14 (16 in States that set that threshold under Article 8 GDPR) and does not encourage its use by them. The controller does not knowingly process data relating to minors below that age; should it become aware of such processing, it will delete without delay any data that may be in its possession.

11No profiling or automated decision-making#

The controller does not profile users and does not take decisions based solely on automated processing which produce legal effects concerning, or similarly significantly affect, the data subject within the meaning of Article 22 GDPR. The processing performed by the application is descriptive and informative in nature, takes place on the device and is not used to evaluate any aspect of the person other than the skin parameters observed.

12Security measures#

Data stored on the device benefit from the protection measures of the operating system, including storage encryption and the isolation of the application’s private storage area. Access to the camera is subject to the user’s express authorisation, which may be revoked at any time in the system settings. The communications referred to in Article 4 take place over a channel encrypted in transit.

13Changes#

Material changes to this notice are notified to the user within the application, before they take effect. The effective date and version number are always shown at the top of the document.