Privacy Policy
Applies to Lucevio — a colour, makeup, hair and styling report generated from your photos.
1. Data controller
The data controller is Altum Borys Nowicki, ul. Sucharskiego 5/22, 10-693 Olsztyn, Poland, NIP (tax ID) 5782989788, operator of the Lucevio service. Contact for data matters: hello@lucevio.com.
2. What data we process
The face and body photos you upload constitute biometric data (special-category data, Art. 9 GDPR). Optionally: age, height, weight (improve proportion matching). At payment: billing data handled by Stripe (we do not store card data).
3. Purpose and legal basis
We process data solely to generate your report, based on your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR), given before uploading photos. You may withdraw consent at any time (this does not affect processing before withdrawal).
4. Recipients / processors
To generate the report, photos are sent to Google (Gemini API) as a processor (generating the analysis and images). We also use: Supabase (database and file hosting), Vercel (app hosting), Stripe (payments), Resend (sending the e-mail with your report link). We do not sell your data.
5. Retention and deletion
Uploaded photos are deleted automatically right after the report is generated.
Unfinished sessions — interrupted, cancelled at checkout or abandoned — are deleted automatically within 48 hours at the latest of the upload. We do not wait for a request.
A finished report (generated images and the text analysis) is kept for up to 180 days from the session start. After that we delete it automatically together with its link — the link stops working.
You can delete everything sooner, yourself: the report panel has a “Delete my data” button. It removes the photos, the generated images and the whole session; the operation cannot be undone. Alternatively write to hello@lucevio.com.
Your API key (your own Gemini key) is never written to our database or our logs. It stays in your browser and reaches our server only for the duration of the call we make to Google on your behalf.
Technical logs of our hosting providers (Vercel, Supabase) may contain an IP address, browser type and error information. They contain no photos and no API keys, and follow those providers’ retention periods.
6. Your rights
You have the right to access, rectification, erasure, restriction, portability and to withdraw consent. You may lodge a complaint with your supervisory authority. For data matters write to: hello@lucevio.com.
7. Transfers outside the EEA
Some processors (e.g. Google, Stripe, Vercel) may process data outside the EEA under Standard Contractual Clauses (SCC).
Design and build: Studio Solertio · Build and Transform