Languages: English · Čeština · Deutsch · Español · Français · Italiano · Nederlands · Polski · Português · Română
This document exists in ten languages. The English version is the reference one.
cosmetiFULL Privacy Policy
Last updated: 31 October 2026 · Applies to: the cosmetiFULL platform and all services provided within it
The English version is the reference version and prevails in case of divergence between the versions. For consumers, the version in the language in which you concluded the contract prevails in your favour where the two differ, and where a term is unclear the interpretation most favourable to you prevails.
1. Who we are, and in what capacity
cosmetiFULL is a platform of digital services for the cosmetics industry, operated by:
Nicodemo & Signa Company Srl
Strada Lucian Blaga nr. 21, ap. 16, 310023 Arad, Romania
VAT number / unique registration code: RO15617609
Trade Register number: J02/809/2003
Email: info@cosmetifull.com
In this policy "we", "us" and "our" mean Nicodemo & Signa Company Srl.
We do not have the same role for all the data on the platform, and the difference matters to you.
- We are the controller for account, authentication and access data, for prepaid credit and purchase data, for invoicing and accounting data, for platform security and technical logs, and for our communications with you.
- We are a processor for the content a customer uploads and for the personal data that content contains. There the customer is the controller and we act on its documented instructions, under a data processing agreement concluded with it under Art. 28 GDPR. Article 4 of this policy explains what that means in practice and who you should address. On the customer's instruction (Data Processing Agreement, clause 17) we also derive aggregated, de-identified knowledge from that content: see Article 19.
We hold the same role for every service of the platform, present and future. Today the platform includes LabelCheck (review of cosmetic labels against EU rules, currently in beta), ExpertDesk (professional guidance produced by an artificial intelligence system) and PIFBuilder (preparation and review of the product information file required by Regulation (EC) No 1223/2009, currently in a trial phase, by invitation only). ExpertDesk has its own privacy policy, reachable inside the application, and that one applies instead of this for the content of its conversations. PIFBuilder also has its own privacy policy, reachable inside the application, and that one applies instead of this for what happens inside it. FormulaArchive is under construction and not yet sold. When it becomes available, it is covered by this same policy, unless we publish a specific notice for it.
2. Privacy contact and Data Protection Officer
We have not designated a Data Protection Officer, because our processing does not fall within the cases listed in Art. 37(1) GDPR: we are not a public authority, our core activities do not consist of large scale regular and systematic monitoring of individuals, and we do not process special categories of data on a large scale.
For any question about this policy or about your data, write to info@cosmetifull.com. That is our single public contact point for privacy matters.
3. Who this policy applies to
This policy applies to everyone whose personal data we process, and in particular to:
- business customers: companies, professionals and their authorised users;
- consumers: individuals who buy for purposes outside their trade, business or profession;
- people named inside the documents a customer uploads, for whom Article 4 explains the position;
- cosmetiLEARN authors, for whom Article 7.12 explains what we process about their public page;
- people who report a cosmetiLEARN page, for whom Article 7.13 explains what we do with the report.
Where a rule applies only to consumers, we say so. Article 22 collects the points that concern consumers specifically.
4. Where we are a processor, and not a controller
A large part of what passes through the platform is not our data and is not processed for our purposes. When a manufacturer, a consultant or a safety assessor uploads a label artwork, a formulation or a dossier, that material may name people: a Responsible Person printed on a pack, a technical contact, a safety assessor who signs a document.
For those data:
- the customer who uploads them is the controller. It decides why they are processed and what happens to them.
- we are the processor. We process them only to run the functions the customer asks for, on its documented instructions, and, beyond those, only to derive the aggregated knowledge the customer authorises in clause 17 of the Data Processing Agreement (Article 19).
- The relationship is governed by the Data Processing Agreement annexed to our Terms of Service, which contains what Art. 28(3) GDPR requires, including the list of sub processors and the notice you receive before one of them changes.
The people involved are the customer organisation and the members it authorises in its company account, according to the roles available on the platform (Terms of Service, Article 6). The organisation decides who joins and with which role inside the platform.
If you are named in a document that one of our customers uploaded, the duty to inform you under Art. 13 and Art. 14 GDPR lies with that organisation, not with us, because it is the organisation that holds the relationship with you and decides what to do with your data. If you write to us to exercise a right over those data, we do not decide on the request: we pass it on to the organisation without undue delay and we help the organisation answer you, as Art. 28(3)(e) GDPR requires. Tell us which company the document belongs to and we will route it.
The rest of this policy describes the data for which we are the controller, except where it says otherwise.
5. What data we process
5.1 Account data
Name, email address, company name where applicable, password stored as a hash, role within a company account, language and interface preferences, your choice on derived knowledge (Article 19), date of registration.
If the holder of a company account adds you to its team, we receive your name and email address from that holder, not from you. We use them to send you the invitation (Article 7.11) and, once you choose a password, as the account data described above.
If you enter a code when you request access (for example a code printed in a book, or one already filled in by the link you followed), the code you entered. If you hold a code, the code itself, whose text may be your name.
If you request access from our website, the page of our website from which you started your request; and if the link you followed carries campaign details, for example from one of our ads, those details: the source, the medium, the campaign and the ad.
5.2 Content you submit (we are a processor for this, see Article 4)
The label artwork, texts, formulations and product documentation you submit, the analyses and documents saved in your account, and your messages in the clarification chat.
The images you upload for an analysis are processed to produce the result and are not stored: what remains in your account is the analysis, its summary, the versions and your messages. Documents you attach to a declaration are also processed to produce the result and are not stored today: they will be kept only from the moment the attachment function is active in the service, and from then until you delete them or the account is deleted. Files you attach to a feedback message are stored.
We do not ask for special categories of personal data and you should not upload them.
5.3 Purchase and billing data
This category exists because the platform is sold. We process:
- for business customers: company name, billing address, country, VAT registration number or tax identification code;
- for consumers: name and billing address;
- the result of the VAT number check described in Article 15, including the case where the system could not answer;
- the evidence used to determine your country for VAT purposes, that is the billing address you give us and the IP address of the purchase, as Article 24b of Implementing Regulation (EU) No 282/2011 requires;
- purchase data: date, quantity of credits bought, amount, currency, VAT treatment applied;
- credit balance and consumption history across the services of the platform;
- invoice number, invoice date and a copy of the invoice;
- transaction identifier and, where applicable, refund identifier received from Stripe;
- for consumers: the record of the express request for immediate performance and of the acknowledgement given under Article 34 of the Terms of Service, and the record of any withdrawal statement you send us.
The billing elements are not optional. They are what tax law requires an invoice to contain (Art. 319 of Law no. 227/2015, the Romanian Fiscal Code).
5.4 Payment card data
We do not process payment card data. See Article 6.
5.5 Usage and technical data
Logs needed to run and secure the platform: timestamps, IP address, user agent, request metadata, error logs, per account usage records, security events.
If you accepted Meta's pixel on our website, the steps described in Article 7.14 go from your browser to Meta when you use our sign-up page. We receive none of them.
5.6 Communications
Messages you send us through the in app feedback channel and by email, including the files you attach to them, and our replies.
This category also covers the details you give us when you ask us to contact you about the Enterprise plan: your name, your email address, your company name, your telephone number and, if you add one, your message.
6. What happens to your card details
Payment is made on a payment page hosted by Stripe. Your card number, expiry date and security code are collected by Stripe directly on Stripe's own systems. They never pass through our systems, we never see them and we never store them.
For each payment we receive only the outcome (successful, failed, refunded), the transaction identifier and the elements we need in order to issue the invoice.
7. Why we process your data, and on what legal basis
7.1 To provide the platform and perform our contract with you
Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
Creating and managing your account and your company account; running the services you request; saving analyses and documents in your account; operating the chat and the translations you ask for; selling and crediting prepaid credits; charging the price; deducting credits as you use the services; handling refunds of unconsumed credits; service messages connected to your purchase, such as the confirmation of the contract.
7.2 To issue invoices, keep our accounts and report to the tax authority
Legal basis: Art. 6(1)(c) GDPR (compliance with a legal obligation), with the obligation identified by name:
- issuing the invoice and its mandatory content: Art. 319 of Law no. 227/2015 (Romanian Fiscal Code);
- keeping accounting records and supporting documents: Art. 23 and Art. 25 of Accounting Law no. 82/1991;
- keeping copies of invoices issued and received: Art. 319 (31) to (35) of Law no. 227/2015;
- transmitting the invoice through the RO e-Factura national system for operations with place of supply in Romania: GEO no. 120/2021, as extended to B2B by Law no. 296/2023 and to B2C by GEO no. 69/2024;
- keeping the evidence that the pre contractual information was given and that a consumer expressly requested immediate performance, which is the evidence we must be able to produce under consumer law.
This processing continues even if you close your account. See Article 17.
7.3 To determine your VAT treatment and check your VAT number
Legal basis: Art. 6(1)(c) GDPR (compliance with a legal obligation).
The obligation is to determine the place of supply and the VAT treatment of the transaction and to hold evidence of your status as a taxable person and of your country: Articles 44 and 59c of Directive 2006/112/EC and Article 24b of Implementing Regulation (EU) No 282/2011, transposed in Law no. 227/2015 (Romanian Fiscal Code). See Article 15 for how the check works.
7.4 To prevent payment fraud and abuse of prepaid credits
Legal basis: Art. 6(1)(f) GDPR (legitimate interest).
Our legitimate interest, stated explicitly as Art. 13(1)(d) GDPR requires, is to prevent fraudulent payments, the unauthorised use of somebody else's card and the abuse of prepaid credits, in our own protection and in the protection of our customers. This includes the automated control on a purchase described in Article 9. Fraud checks on the payment transaction itself are carried out by Stripe with its own tools and under its own rules, as explained in Article 12.
7.5 To keep the platform secure and working correctly
Legal basis: Art. 6(1)(f) GDPR (legitimate interest).
Our legitimate interest is to keep the service available, secure and working correctly: security logs, abuse prevention, error diagnosis and capacity planning.
7.6 To derive aggregated knowledge from the use of the platform
Legal basis: Art. 6(1)(f) GDPR (legitimate interest).
Our legitimate interest is making the checks more accurate, growing our knowledge base and, in the future, publishing sector level reporting. What we derive, from which data and within which limits is described in Article 19. You can opt out with one click in your account preferences, and you can also object under Article 21.
7.7 To classify the feedback you send us
Legal basis: Art. 6(1)(f) GDPR (legitimate interest).
Our legitimate interest is to make sure that a real regulatory correction reported by a user is not lost among the messages. How this works, and the role of our AI provider in it, is described in Article 8.
7.8 To build our library of complete cases
Legal basis: Art. 6(1)(f) GDPR (legitimate interest).
An extract of a product information file enters the library only when a safety assessor approves that specific extract for it, after names, contact details and anything that allows the product to be recognised have been removed, and after review by an independent expert. Our legitimate interest is a library of real, verified cases that makes the services more reliable for everyone. If a residual personal data item is still present in an approved extract, we remove it as soon as we notice it. Content reused before 3 October 2026 rests on the separate written consents given during the beta, which can still be withdrawn by writing to info@cosmetifull.com.
7.9 To answer you
Legal basis: Art. 6(1)(b) and Art. 6(1)(f) GDPR.
Replies to your messages and to your feedback, and operational communications about the service.
When you ask us to contact you about the Enterprise plan, we use those details only to call you or write back to you about that request. The legal basis is Art. 6(1)(b) GDPR, steps taken at your request before entering into a contract, and, when you act on behalf of a company, Art. 6(1)(f) GDPR, our legitimate interest in answering a business enquiry, which you can object to as described in Article 21. We do not use those details for marketing.
We do not use consent as a legal basis, except for the written consents given during the beta for content reused before 3 October 2026 (Article 7.8) and for Meta's pixel on our sign-up page, which runs only if you accepted it on our website (Article 7.14). In particular we do not use it for invoicing, accounting or fraud prevention, because that processing cannot stop on request: it is imposed on us by law or needed to protect the service.
7.10 To apply the codes you enter and to know which channels bring us customers
Legal basis: Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract, and performance of the contract) for applying the promotion attached to a code you chose to enter (Article 23 of the Terms of Service); Art. 6(1)(f) GDPR (legitimate interest) for the rest of the processing described here.
Our legitimate interest is knowing which authors, partners and campaigns bring us customers, following our relationship with each customer company, and crediting the holder of a code as agreed with them. We record which code your company entered with, per company and not per person, and whether that company later used or bought credits. We also record which campaign and ad brought your company to us, and the page of our website from which you started your request, as named in the link you followed. We look at the code or campaign company by company to follow each customer relationship, and in total to measure what each code and campaign is worth. We also look at how each company uses the platform (when it signed up, the type of business we note for it, its first analysis, how much it uses the services, what it paid) to follow each customer relationship and to understand which channels bring customers who find value. When a request made with a code is approved, the holder of that code may receive credits. We do not tell the holder your name, your company, your email address or anything you do on the platform, but the holder can see when those credits arrive. If you hold a code, its text may be your name: we withdraw the code and remove its text when your company account is closed, or earlier if you ask us. You can object to the processing based on our legitimate interest as described in Article 21, independently of the switch described in Article 19.
7.11 To send you the invitation of a company that adds you to its team
Legal basis: Art. 6(1)(f) GDPR (legitimate interest).
Our legitimate interest, which is also the company's, is to let a customer give the people who work with it access to the service it uses. Only the holder of the company account can add someone, and gives us that person's name and email address. We use them only to send the invitation, which names the company and the person who added you. If you do not choose a password within 30 days of the last invitation, we delete your name and address. Once you choose a password, your account is handled like any other account described in this policy. You can ignore the invitation, since without your password no account is activated, and you can object as described in Article 21.
7.12 cosmetiLEARN, if you are an author
Legal basis: Art. 6(1)(b) GDPR (performance of a contract, that is the agreement with you as an author, and, until we approve your confirmation, steps taken at your request before entering into a contract) for publishing your page, for presenting you in other parts of cosmetiLEARN and on our channels, for the changes you make by hand or with the assistant, for requests for a new book, for the versions in the other languages and for recording your confirmation of the agreement; Art. 6(1)(f) GDPR (legitimate interest) for the first version of your page and the preview before you accept, the automatic checks, the version history, the daily summary, the posts that stay online after the agreement ends, the fingerprint of a deleted page, the record of your confirmation after the agreement ends or after we reject it, the count of clicks on the purchase links of your page, and the invitation to confirm it.
cosmetiLEARN presents authors of cosmetic science books on our website, in ten languages. If we have invited you as an author, we process the data of your page: name, role, biography, your channels, your photo, the data of your books (descriptions, ISBN, publisher, pages, date, purchase links, covers and captions), the changes you make and their history, and your requests for a new book. We prepare the first version of your page ourselves, with what you give us and with what we collect from your public pages and other sources available online, and we show it to you in a preview with the invitation to confirm the agreement; the first message we send you and the preview both carry the link to this policy. Until you accept the agreement, we prepare and show you the page for our legitimate interest in offering it to you. The sources are, for example, your website, your publishers' pages and the public pages of your books; if you ask, we tell you where each item comes from. If you tell us you are not interested, or the page does not go online, we delete it from our website's files, with the images and texts we collected, within one month of your answer or of the preview link expiring; if your confirmation is still waiting for our decision at that point, within one month of our decision or, if we never decide, of the expiry of its record. A copy remains in the history of the private repository of our website's code on GitHub, and we delete it within one month of your request. Your account is a normal platform account (Article 5.1); we are the ones who switch access to your page on and off.
- Confirming the agreement. You accept the cosmetiLEARN Author Agreement, and the Terms of Service it refers to, with the button you use to confirm your page, on the page where you sign in to your account or create one, as we tell you next to the button. The invitation may already contain your name and email address, to pre-fill the form: they stay in the invitation only while it is open, and we delete them earlier if you ask us to erase your data or your account. When you accept, we record who confirmed (name, email address, account and page identifier), when, which version of each of the three texts and, when you come from the button in the preview, the fingerprint (hash) of the page you saw, images included: this record is the proof of our agreement. If you create a new account, we email you a link that is valid for 72 hours: one click confirms it is you, and that is when we record your acceptance; until then we keep your name, your email address, your country, your company if you entered one and what is needed to record the confirmation. You choose your password when your page is online, from the link in the email that tells you so, which works for 72 hours; after that, "Forgotten your password?" on the sign-in page. We alert our administrators with a fixed-text alert (Article 11.2) and with an email, sent through Amazon SES to our mailbox, which contains your name, your email address, your page identifier and the status of your account and stays in the mailbox until we delete it by hand, including at your request; one of the administrators then approves or rejects the publication of the page. After the agreement ends, or if we reject the confirmation, we keep the record for our legitimate interest in the establishment, exercise or defence of legal claims, for the periods set out in Article 17 of this policy. If you ask us to erase your data or your account, your name, email address, the link to your account and the page identifier are deleted from the record, and until those same deadlines only the fingerprints (hashes) of your email address, of the page identifier and of the page you saw remain in it, as Art. 17(3)(e) GDPR allows: a fingerprint does not contain the data itself, but someone who could read our database and already knew the data could recognise it. If we reject the confirmation, we also note the reason in the record: the reason is kept until the same deadlines and is deleted together with your name if you ask us to erase your data or your account.
- The account created from the form. The account you create from the form cannot be used until we approve your confirmation. If it has no other use (a cosmetiFULL service requested separately, a company that added you to its team or another confirmation), we delete it together with its request for access, if still open: at the rejection, straight away; 13 months after your acceptance, if the confirmation is never decided; within 7 days of the last confirmation link we sent you (when you sent the form or asked for a new link), if you do not confirm your email address with that link or if the confirmation cannot be recorded (for example because the invitation has closed or expired in the meantime); in that case we record no confirmation and, within the same 7 days, also delete the details you entered in the form (name, country, company), even if the account stays. At the rejection we delete the request for access created with the confirmation even if the account stays. The sending log of our email service keeps the address we wrote to for 12 months from the date of sending, as for every email we send (Article 17). The record of your confirmation stays for the periods in Article 17.
- Where we present you. Besides your page, we use your name, your photo, your biography and your books to present you in other parts of cosmetiLEARN on our website, for example on the home page, and on our channels: posts, newsletters and events, always to talk about cosmetiLEARN. The platforms where we publish the posts process what we publish there as independent controllers, under their own rules.
- Your changes, by hand or with the assistant. You edit your page by hand, field by field, or by writing to an assistant, which is an artificial intelligence system and not a person. If you use the assistant, your messages and the values of your page go to our AI provider (Anthropic) on the terms of Article 8; your email address and your account data do not. We do not keep the conversation: it stays in your browser while you keep the page open. For every change, by hand or with the assistant, we keep the proposed change, that is the value before and after, where it came from, the outcome of the checks and the time. For each one we also keep who proposed it (your account identifier, not your name or email) and whether it came from the assistant or from the pencil, that is, by hand. Proposals that are not confirmed are deleted after 24 hours; confirmed ones stay in the page's history for as long as the page exists, and are deleted with it.
- Online by itself, after the checks. When you confirm a change, it goes online by itself if it passes the automatic checks: format and length, links only to permitted sites, the ISBN check digit, no wording that presents cosmetiFULL as a guarantor of you or of the book, no promise of health or results, and cosmetics topics only. The last check, on changes made by hand too, is made by a classifier of our AI provider, and if the classifier does not answer, the change does not go online. Our legitimate interest is that the public pages stay accurate, lawful and about cosmetics.
- A new book. You can ask us to add a book of yours, with title, subtitle, language, ISBN, publisher, the link to the book's page with the publisher and the purchase links. The request does not go online: it reaches our administrators, who check the book and its listing with the publisher and accept or refuse the request. When we decide, we email you at your account address with the outcome and, if we refuse it, the reason; you also see the outcome in your area, where you can correct and resend a refused request. If we accept it, we prepare the book for your page ourselves: once it is online you see it in your author area, and from there you edit it like your other books. We keep the request, with our decision, for at most 13 months from the decision (from the request, if it was never decided); earlier, if you ask us to delete your author page or your account.
- The other languages. The versions in the other nine languages are written automatically by an artificial intelligence system, and an automatic check verifies the technical and legal terms. Until a language passes that check, that language keeps the previous version.
- The version history. We keep every version of every field for as long as the page exists. Our legitimate interest is being able to go back to a previous version if something is wrong, and to explain what was published and why.
- The daily summary. Once a day the platform's administrators receive by email, through Amazon SES, the list of the changes published, with a short excerpt of the before and the after, whether each was made by hand or with the assistant, and the link to put back the previous version. It is information, not an approval. Our legitimate interest is knowing what went online without a person seeing it first. The same summary lists the pending requests for a new book, with your page's identifier, the title and the language of the book as you wrote them, when the request was sent and the link to the administration panel: they are there so that we can act on them, and they do not contain your account data, the ISBN, the links or the publisher.
- Clicks on the purchase links. On your page we count how many times each purchase link is clicked: for each day, book and shop, only the number. Nothing about the reader is recorded: no IP address, no cookies, no identifier. The counts are for our internal use and you do not see them in your area. Our legitimate interest is knowing whether the links on your page bring readers to the shops.
- Moderation, statement of reasons and how to contest it. The checks and the classifier are automated content moderation tools within the meaning of Article 14(1) of Regulation (EU) 2022/2065 (Digital Services Act), and our administrators complement them with human review: they can put back the previous version of a field in one language, or suspend a field or the whole page. A suspension freezes your changes: while it lasts, your changes to that field or to the page do not go online, and the site shows the starting version, the one we prepared for the site. A suspension does not take the page off the site: taking a page off the site is a separate decision, which takes effect when we publish the site again without that page. If a check stops a change, it tells you why straight away. If we restrict content that is already published, we send you a statement of reasons under Article 17 of the same Regulation: what we did, why, on which facts, whether we used automated means and how to contest it. To contest it, write to info@cosmetifull.com, and a person reviews the decision. Readers' reports about your page reach us first (Article 7.13), and we tell you about them without the contact details of the person who reported.
- Removing the page. You can ask us to remove your page, or everything about it, by writing to info@cosmetifull.com. We take the page down in every language by publishing the site again without it and without you in the other parts of cosmetiLEARN, delete the values, their history, the proposals, the requests for a new book, the translations waiting and the operational measurements linked to the page, and ask search engines to update their results. A copy of the page, the snapshot from which the site is built, is also kept with its history in the private repository of our website's code on GitHub: we delete it there and rewrite that history within one month. On request, we delete by hand from the administrators' mailboxes the summary emails that concern you. The record of the removal, with a pseudonym in place of your name, is deleted within 13 months. For 13 months we also keep a fingerprint (hash) of your page's identifier: it stops us from creating the page again by mistake and, until the site is republished without the page, makes the site answer, in every language, that the page has been removed. When the site asks us for that page, we note alongside the fingerprint only the date of the site's latest request. If, when the 13 months are up, the site has asked us for the page within the last 30 days, the fingerprint and the date stay for as long as the site keeps asking, and we delete them 30 days after the site's latest request. The fingerprint does not contain your name, but anyone who could read our database and guessed the identifier, which comes from your surname, would see that the page was deleted. We keep the fingerprint and the date on the basis of our legitimate interest in fully carrying out your request for erasure and in preventing the page from being published again. The emails we sent you stay in the sending log for 12 months (Article 17). Backup copies cease to exist within 30 days, and so does what our AI provider retains, except for the longer period the provider applies to cases where its usage policy has been breached (Article 8). After the removal, your name, your photo and your books no longer go into new materials. We take down the posts in which we have already presented you if you ask us to; while they stay online, our legitimate interest is not having to rewrite what we have already published. A newsletter already sent can no longer be recalled.
You can object to the processing based on our legitimate interest as described in Article 21.
7.13 If you report a cosmetiLEARN page
Legal basis: Art. 6(1)(c) GDPR (compliance with a legal obligation): Article 16 of Regulation (EU) 2022/2065 (Digital Services Act) requires us to receive and act on notices about the content of the pages we host; Art. 6(1)(f) GDPR (legitimate interest) for the fingerprint against repeated sending.
Anyone can report to us, with the form linked from every cosmetiLEARN page, content they consider illegal or not in line with the rules of the page. The controller is Nicodemo & Signa Company Srl (Article 1), which you can reach at info@cosmetifull.com (Article 2).
- What we collect. The page, the language and, if you indicate it, the part of the page you are reporting; the reason, as a category and in your own words; your statement that the report is made in good faith; and, only if you choose to give them, your name and your email address. Name and email address are optional: you can report without them.
- Why. To assess the report, decide on it and, if you gave us your email address, send you a confirmation of receipt and then our decision, with the possible means of redress, as Article 16(4) and (5) of the same Regulation requires.
- Who sees it. Our team, who decide on the report. The author of the page receives the report without your name and your email address, and with any email addresses, telephone numbers and links in your text obscured. The text of your report is never sent to our AI provider. The form and the reports are hosted by Cloudflare, and the emails we send you go through Amazon SES (Article 11.1).
- How long. In cosmetiLEARN, your name and your email address are deleted when the report is closed, or as soon as our email to you proves undeliverable, and in any case 90 days after the report, even if it is still open. The sending log of our email service keeps the address we wrote to for 12 months from the date of sending, as for every email we send (Article 17). If our email proves undeliverable, or you mark it as spam, the address also stays on our list of addresses excluded from sending, for 12 months from the last of these signals, so that we respect that signal. The rest of the report is deleted 13 months after the decision, or earlier if the page it concerns is removed.
- Against repeated sending. When you report, we keep for one day a fingerprint (hash) of your IP address, computed with a secret key and tied to the page and the day (not the address itself), so that a single sender cannot fill the page's limit and block other people's reports. It is deleted the next day. Without the key the address cannot be traced back, and the fingerprint is not linked to the report. For this fingerprint alone the legal basis is our legitimate interest in keeping the form available to everyone (Art. 6(1)(f) GDPR), and you can object as set out in Article 21.
- Your rights. The rights in Article 20 apply. The right to object in Article 21 does not apply to the report, because that processing is required by law (it does apply to the fingerprint described above); for the same reason, erasure of the report can be limited while that obligation lasts (Art. 17(3)(b) GDPR).
7.14 To measure our ads, only if you accept
Legal basis: Art. 6(1)(a) GDPR (your consent), which Art. 5(3) of Directive 2002/58/EC, transposed in Romania by Art. 4(5) of Law no. 506/2004, also requires for storing and reading information on your device.
Our ads on Facebook and Instagram lead to the LabelCheck page of our website, where a box asks whether you accept Meta's pixel. The two buttons, Accept and Reject, are the same size. Your answer is kept in the `cf_consenso` cookie (Article 23) and applies to our sign-up page on app.cosmetifull.com too: one answer covers the website and that page.
Only if you accepted, the sign-up page loads Meta's pixel, and your browser tells Meta when you open the page, that the sign-up form is open and when you send it. With each step go the address of the page and of the page you came from, your IP address, your browser's details and the identifiers in Meta's cookies. We have switched off the pixel's own reading of buttons and forms, and its automatic matching of form fields is off, so what you type in the form is not sent to Meta; a check runs every night and alerts us if that setting is switched on. Meta can link these steps to your Facebook or Instagram account, if you have one, so that we can see which ads bring people who sign up and Meta can show our ads to people like them. These steps go from your browser straight to Meta: we keep nothing of them, and what we read are Meta's reports on how our ads perform.
For collecting and sending these data, Meta Platforms Ireland Limited and our company are joint controllers (Art. 26 GDPR). Meta publishes the essence of our arrangement, its Controller Addendum, at facebook.com/legal/controller_addendum, and you can exercise your rights over this part with either of us: with us at info@cosmetifull.com, or with Meta through the contacts in its Privacy Policy. When Meta measures our ads for us, it acts as our processor under its Data Processing Terms (Art. 28 GDPR); what it does with the data afterwards for its own purposes it decides as a controller in its own right, under that Privacy Policy.
If you did not answer the box, or rejected, the sign-up page loads nothing from Meta and works exactly the same. You can withdraw your consent at any time from Cookie settings at the foot of every page of our website: the pixel then stops, on the website and on the sign-up page, and Meta's cookies on our domain are deleted. Withdrawal counts from that moment on, so what was sent before it stays lawful.
8. AI processing and AI transparency
The analyses, drafts and answers produced by the platform are generated by an artificial intelligence system. When you use the chat or any assisted function, you are interacting with an artificial intelligence system and not with a human operator. We state this in the interface as well, in line with the transparency obligation of Article 50 of Regulation (EU) 2024/1689, which applies from 2 August 2026.
The content you submit is processed through the API of our AI provider (Anthropic) in order to produce your results. Under the commercial terms that govern our use of that API, the content submitted is not used to train the provider's models.
We also use the same provider to classify the feedback you send us, so that a real regulatory correction is not lost among the messages. The message, a short excerpt of the analysis it refers to and the classification are kept, the proposal that comes out of it is always reviewed by a person before anything changes, and the same contractual exclusion of training applies.
Our AI provider retains the content transmitted and the results for no longer than 30 days from receipt or generation, except for the longer period the provider applies to cases where its usage policy has been breached, for abuse monitoring, and for no other purpose. We do not authorise any further use.
Results are informational and can contain errors. They assist professional review, they do not replace the judgement of a qualified professional and they do not certify compliance. Responsibility for the compliance of a cosmetic product remains with the economic operator and with the Responsible Person under Regulation (EC) No 1223/2009.
9. Automated checks on purchases and accounts
We do not profile you ourselves. If you accept Meta's pixel, Meta can use the steps it collects on our sign-up page for its advertising services, as described in Article 7.14.
An automated control on the purchase exists and it is limited to one thing: a purchase whose data are abnormal, for example an unusually large quantity of credits or an account we cannot match, is put on hold automatically and reviewed by a person before the credits are added. The decision to suspend an account or to refuse a purchase is always taken by a person, never by the system. You can ask us to review the outcome by writing to info@cosmetifull.com.
The payment itself can also be automatically declined or blocked by Stripe's fraud systems, according to Stripe's own criteria. That assessment is made by Stripe, not by us. If a payment of yours is refused you can write to us and you can also contact Stripe directly.
10. What happens if you do not provide your data
Some data are required by law, others by the contract:
- Required by tax law: company name or name, billing address and, for taxable persons, the VAT number. Without these we cannot issue an invoice and therefore we cannot sell you credits.
- Required by the contract: email address and password, without which we cannot create or secure an account.
- Optional: everything else, for example an additional administrative contact. Not providing it has no consequence beyond the loss of that convenience.
11. Who receives your data
We keep the provider chain short. The recipients fall into four different groups, and the difference matters, because they do not have the same duties towards you.
11.1 Group A: processors acting on our instructions (Art. 28 GDPR)
| Recipient | What it does for us | What it receives |
|---|---|---|
| Cloudflare, Inc. (United States, globally distributed infrastructure) | Hosting, database, file storage, perimeter security | All service data as stored on its platform: account data, submitted content, analyses, technical and security logs |
| Anthropic | AI processing of the content you submit, to produce your results, classification of the feedback you send us and, for cosmetiLEARN, the authors' assistant, the topic check and the versions in the other languages (Article 7.12) | The content transmitted for processing and the feedback messages sent for classification, including a short excerpt of the analysis a feedback refers to; for cosmetiLEARN, the author's messages to the assistant and the values of their page. No credentials, no payment data, no security logs |
| Amazon SES (Amazon Web Services, Europe region, Frankfurt) | Sending the service emails: invitations, access notifications, password reset, confirmation of the contract, operational notices and, for cosmetiLEARN, the daily summary to the administrators, the statements of reasons to authors, the outcome of their requests for a new book, the emails about the confirmation of their Author Agreement, the alert about that confirmation to the administrators and, to the person who reported a page, the confirmation of receipt and the decision (Articles 7.12 and 7.13) | Recipient email address, name, organisation, subject and content of the transactional message |
| Proton AG (Switzerland, servers in Switzerland, Germany or Norway) | Hosting our company email mailbox, including info@cosmetifull.com | The emails you send us, including the files you attach to them, and our replies; the details you give us when you ask us to contact you about the Enterprise plan: your name, your email address, your company name, your telephone number and, if you add one, your message; the details of your request for access to the platform: your company name, your country, the service you asked for and your email address; the details of the alert about your confirmation of the cosmetiLEARN Author Agreement: your name, your email address, your page identifier and the status of your account |
| SmartBill (Intelligent IT SRL, Romania) | Issuing our invoices | Company name or name, billing address, VAT number, invoice data |
| Airtable | Our internal customer relationship records | Contact and account data, and the commercial history of our relationship with you |
| GitHub (GitHub, Inc., United States, and GitHub B.V., Netherlands) | Hosting the private repository of our website's code, which contains the snapshot of each cosmetiLEARN author page from which the site is built, and its history (Article 7.12) | The data on the author page: name, role, biography, channels and the data of the books |
We do not use a processor without a data processing agreement consistent with Art. 28 GDPR. Each of the recipients above processes data only on our documented instructions and cannot use them for its own purposes.
11.2 Telegram: an internal channel, stated as it is
We use a Telegram channel, strictly internal to our own team, to be alerted immediately when we receive a request for access to the platform, sent either from the presentation page of a service or from the platform sign-in page, feedback, a reply to feedback, a request to be contacted about the Enterprise plan or an author's confirmation of the cosmetiLEARN Author Agreement. From 16 September 2026, each of these alerts carries only a fixed text, the same for everyone, without your name, your email address, your company name or the text of your message. The details remain in our administration panel and, for access requests and for requests about the Enterprise plan, in our company email mailbox. The same applies to an author's confirmation of the cosmetiLEARN Author Agreement (Article 7.12). The other alerts we receive on this channel concern the operation of the platform and contain no personal data.
Telegram does not make a data processing agreement available for bots. We say this plainly rather than claim a safeguard we do not have, and it is the reason why we limit this channel to internal alerts and keep the content of your documents out of it. Telegram is established outside the European Economic Area.
11.3 Group B: recipients that decide for themselves how to process the data
These recipients decide for themselves how to process the data they receive. They act as independent controllers, each under its own privacy policy and its own legal duties:
| Recipient | What it does | What it receives |
|---|---|---|
| ANAF, the Romanian tax authority, through the RO e-Factura system (Article 14) | Receives the invoice under a legal obligation | The invoice and any credit note, with the billing data they contain |
| The European Commission (VIES) (Article 15) | Answers our query validating an EU VAT number | Only the VAT number queried, together with our own VAT number |
| Our bank | Settlement of payments and refunds | Amount, transaction reference, our own account data |
| Our external accountant or auditor | Keeps our accounts, under their own professional duties | The accounting documents, including invoices |
| Our legal advisers | Only in the event of a dispute | Only the data necessary to that specific dispute |
11.4 Stripe: a mixed role
Stripe is treated separately because its role is mixed. See Article 12.
11.5 Meta: a joint controller, only if you accept
If you accepted Meta's pixel on our website, Meta Platforms Ireland Limited (Ireland) receives from your browser the steps described in Article 7.14. For collecting and sending them, Meta and our company are joint controllers (Art. 26 GDPR); for measuring our ads, Meta acts as our processor under its Data Processing Terms (Art. 28 GDPR); for what Meta does with them afterwards for its own purposes, Meta is a controller in its own right, under its own Privacy Policy. If you did not accept, Meta receives nothing from our sign-up page.
12. Why Stripe has a mixed role
Stripe plays a mixed role, and we prefer to say so plainly rather than simplify it:
- Stripe is our processor for the part in which it collects the payment on our instructions and reports the outcome to us.
- Stripe is an independent controller for the part in which it decides, or the law decides for it, what to do with your data. Stripe is a regulated payment service provider, subject in its own right to anti money laundering, customer identification and payment services rules. Those purposes are determined by law and by Stripe, not by us. We cannot instruct Stripe on what data to collect, how long to keep them or to whom to disclose them.
Stripe receives your name, your email address, your company name, your billing address, your VAT number where applicable, and the amount and identifier of the transaction. For the controller part, sending your data to Stripe is a disclosure between two separate controllers. We are not joint controllers with Stripe.
13. Why SmartBill is a processor
SmartBill is the opposite case, and the reason is worth stating.
SmartBill is the software we use to issue our invoice. It receives your company name, address and VAT number because we pass them to it, it processes them according to our instructions, and it has no professional duty of its own regarding the content of the invoice. It is therefore a processor under Art. 28 GDPR, bound by a data processing agreement.
Our external accountant or auditor, who receives the same documents, is instead an independent controller, because that role is regulated by law and the accountant decides on their own what they need and for how long.
14. ANAF and e-Factura
For customers whose operation has its place of supply in Romania, the invoice is transmitted to the Romanian tax authority through the RO e-Factura national system.
ANAF is not our supplier and does not act on our behalf. It is an authority that receives the data under a legal obligation and processes them as a separate controller. This transmission does not require your consent and cannot be switched off. The same applies to a credit note issued after a refund.
15. VAT number check (VIES)
Before we apply or do not apply the reverse charge, we check the VAT number you give us in VIES, the European Commission system, for VAT numbers issued in the European Union. VIES is a system of an EU institution and the query does not involve a transfer outside the European Economic Area.
In reply we receive whether the number is valid, or that the system could not answer, which is recorded as a separate outcome, and, where the system provides it, the name and address associated with that number. We keep evidence of the check, including its date and its outcome, as the supporting document for the VAT treatment we applied to your purchase.
For a sole trader the VAT number is personal data, which is why we declare this check even though it looks like company information.
16. Transfers outside the European Economic Area
Some of our providers are established outside the European Economic Area, or belong to groups that are. For each of them we state the country and the safeguard actually applied:
| Provider | Country of the provider | Where the data are processed | Safeguard applied |
|---|---|---|---|
| Cloudflare, Inc. | United States | Globally distributed infrastructure | Adequacy decision for the EU-U.S. Data Privacy Framework, under which Cloudflare is certified (Commission Implementing Decision (EU) 2023/1795, Art. 45 GDPR); the Standard Contractual Clauses of the Cloudflare Data Processing Addendum (Art. 46(2)(c) GDPR) apply to any transfer not covered by that certification, and automatically if it lapses or is invalidated |
| Anthropic | Anthropic Ireland, Limited, Ireland | United States | Anthropic Data Processing Addendum, including the Standard Contractual Clauses (Art. 46(2)(c) GDPR), together with the contractual commitment that submitted content is not used to train models |
| Amazon SES | Amazon Web Services EMEA SARL, Luxembourg | Europe region, Frankfurt | Processing inside the EEA. The AWS GDPR Data Processing Addendum, which incorporates the Standard Contractual Clauses, covers any access from outside the EEA, for example for technical support |
| Proton AG | Switzerland | Switzerland, Germany or Norway | Adequacy decision of the European Commission for Switzerland, Decision 2000/518/EC (Art. 45 GDPR). Proton's data processing agreement, which forms part of its terms of service, commits Proton to transfer data, to the extent possible, only to Switzerland, the European Union or countries covered by an adequacy decision, and otherwise to rely on standard contractual clauses or another transfer mechanism provided for by data protection law |
| SmartBill | Romania | Romania | No transfer outside the EEA |
| Airtable | United States | United States | Data processing agreement including the Standard Contractual Clauses (Art. 46(2)(c) GDPR) |
| GitHub | GitHub, Inc., United States, and GitHub B.V., Netherlands | United States | Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Art. 46(2)(c) GDPR); GitHub also declares its certification under the EU-U.S. Data Privacy Framework |
| Stripe, processor part | Stripe Payments Europe Limited, Ireland, for European customers | Ireland, with intra group transfers to the United States | Stripe's data processing terms, including the Standard Contractual Clauses (Art. 46(2)(c) GDPR) |
| Stripe, independent controller part | Same entity, part of a group established in the United States | Decided by Stripe | Any onward transfer is decided by Stripe under its own responsibility and under its own privacy policy. We do not claim a safeguard over a transfer we do not control |
| Telegram (internal fixed-text alerts only, Article 11.2) | Outside the European Economic Area | Outside the European Economic Area | No data processing agreement is available from this provider. We keep the content of your documents out of this channel for that reason |
| Meta (only if you accepted its pixel, Article 7.14) | Meta Platforms Ireland Limited, Ireland | Ireland and the United States, by Meta Platforms, Inc. | Adequacy decision for the EU-U.S. Data Privacy Framework, under which Meta Platforms, Inc. is certified (Commission Implementing Decision (EU) 2023/1795, Art. 45 GDPR). What Meta does with the data afterwards, transfers included, it decides under its own Privacy Policy |
You can ask us for a copy of the safeguards we hold by writing to info@cosmetifull.com.
17. How long we keep your data
Different data have different retention periods. We do not use a single generic formula.
| Data | How long we keep them |
|---|---|
| Account data | For the life of the account, then deleted, as a rule immediately on your request |
| Analyses and the documents saved in your account | Kept available for download for 30 days after closure, then deleted within the following 60 days, or earlier at your request |
| Files attached to feedback | Until you delete them, or until the account is deleted |
| Documents attached to a declaration | Not stored today. From the moment the attachment function is active in the service: until you delete them, or until the account is deleted |
| Security and usage logs | 12 months from the date of the event, then deleted |
| Transactional email delivery metadata and bounce logs | 12 months from the date of the message, then deleted. The record of the confirmations that document a contract is kept instead for the same period as the accounting records, because it is the evidence that the contractual document was delivered |
| Customer relationship records, and requests to be contacted about the Enterprise plan | For the duration of the relationship and for 24 months after the last contact |
| Derived knowledge: pseudonymised records, without content (Article 19) | Kept in pseudonymised form and detached from your account when the account is deleted, or earlier where the policy of a service says so. Aggregates that reach the threshold contain no personal data and are kept without a time limit |
| An invitation to join a company's team that you did not accept | Your name and address are deleted 30 days after the last invitation. The delivery record of the invitation email follows the row on transactional email above |
| Feedback and support messages | For the life of the account, then deleted |
| cosmetiLEARN author page: values, version history and proposed changes (Article 7.12) | For as long as the page exists, then deleted when you ask us or when the agreement ends; the copy in our website's repository on GitHub and its history, within one month of that. A page we prepared that never went online: deleted from our website's files within one month of your answer that you are not interested or of the preview link expiring or, if your confirmation is still waiting for our decision, within one month of the decision or of the expiry of its record; its copy in the repository history, within one month of your request. A proposed change that you do not confirm is deleted after 24 hours. We do not keep the conversation with the assistant. The posts in which we presented you stay until you ask us to take them down. The counters behind the assistant's limits are deleted every day; the operational measurements, which contain no text, after 13 months. The count of clicks on the purchase links: by day for 13 months, then only the total for each book and shop, with the first and the last day of the period it covers, for as long as the page exists. The daily summary emails in the administrators' mailboxes are deleted by hand, on request. The record of a page taken off the site (date, administrator, a reason chosen from a closed list, the reference of the site version, a note with the facts and a pseudonym in place of your name) is deleted within 13 months of the removal; if the page stays off the site for longer, the latest record is kept while the page is off the site and is deleted within 13 months of its return to the site or of the deletion of the page. The return to the site, recorded in the same way without notes, is deleted within 13 months. After the page is deleted, a fingerprint of its identifier, without your name, and, if the site asks us for that page, the date of the site's latest request: 13 months; if, when the 13 months are up, the site has asked us for the page within the last 30 days, for as long as it keeps asking and up to 30 days after its latest request |
| Request for a new book for a cosmetiLEARN author page, with our decision (Article 7.12) | At most 13 months from the decision, or from the request if it was never decided; earlier, if you ask us to delete your author page or your account |
| Confirmation of the cosmetiLEARN Author Agreement, and the invitation to confirm it (Article 7.12) | Approved confirmation whose author page was activated: for as long as the agreement lasts and for 3 years after it ends. Approved confirmation whose page was never activated: the agreement ends, and we keep the record for 13 months from that end or, if nobody closed it earlier, 13 months from the approval. Rejected confirmation, or one never decided: 13 months from the decision or, if it was never decided, from the acceptance. Invitation that led to an activated page: as the confirmation that activated it; any other invitation, withdrawn or expired: 13 months from the withdrawal or the expiry, even if it received confirmations that were later rejected or never activated. Name and email written in the invitation: only while it is open, or until you ask us to delete them. Account created from the form without other uses, and its request for access if still open: deleted at the rejection; 13 months after the acceptance, if the confirmation is never decided; or within 7 days of the last confirmation link sent, if the address is not confirmed with that link (valid for 72 hours) or if the confirmation cannot be recorded, and in that case the details entered in the form are deleted too, even if the account stays. At the rejection, the request for access created with the confirmation is deleted even if the account stays. The address we wrote to stays in the email sending log for 12 months, as in the row on transactional email above. If you ask us to erase your data or your account, your name, email address, the link to your account and the page identifier are deleted from the record, and until the same deadlines only the fingerprints (hashes) remain in it; the invitation to your page is deleted too, unless another person has a confirmation through that invitation that is not yet decided, or approved with its page activated or with the agreement not yet ended: in that case the invitation stays for that person. When the invitation is deleted because the author of the page asked us to erase their account, the page identifier is deleted from the records of other people who confirmed through that invitation, and only its fingerprint remains. The alert email to the administrators stays in our mailbox until we delete it by hand, including at your request |
| A report about a cosmetiLEARN page (Article 7.13) | The name and email address of the person who reported: deleted from cosmetiLEARN when the report is closed, or as soon as our email to that person proves undeliverable, and in any case 90 days after the report, even if it is still open. The address we wrote to stays in the email sending log for 12 months, as in the row on transactional email above, and, if the email proves undeliverable or is marked as spam, on the list of addresses excluded from sending for 12 months from the last of these signals. The rest of the report: 13 months after the decision, or earlier if the page is removed. Keyed fingerprint (hash) of the IP address of the person who reported: the next day |
| Credit ledger and usage statements | The same period as the accounting records they support |
| The code entered in an access request | Deleted together with the request, 12 months after the decision on it, or earlier if you ask us |
| Which code a company entered with, and the credits granted for that entry | The same period as the credit ledger and usage statements |
| A code you hold, whose text may be your name | Until your company account is closed, or earlier if you ask us; the code is then withdrawn and its text removed |
| The campaign details in the link you followed to request access (source, medium, campaign and ad), and the page of our website from which you started your request | Deleted together with the request, 12 months after the decision on it, or earlier if you ask us |
| Which campaign and ad, or other link, brought a company to us, whether it was a beta tester, and the day it signed up | 24 months from the day the company signed up, then deleted, also when the account was closed earlier |
| How each company uses the platform, in figures (analyses and questions, credits used, what they cost us, what it paid), without content | The same period as the credit ledger, usage statements and billing data they are read from, also after the account is closed |
| Daily counts of the LabelCheck analyses a company ran before analyses were charged in credits, and what they cost us, without content and without the person who ran them | For as long as your company account exists; deleted when it is closed |
| Invoices, billing data, accounting records and the evidence of the VAT check | Five years, counted from 1 July of the year following the financial year in which the document was drawn up |
| The steps your browser sends to Meta if you accepted its pixel (Article 7.14) | We keep nothing of them. Meta keeps them under its own Privacy Policy. Your answer to the box stays in the `cf_consenso` cookie on your device for 6 months (Article 23) |
| Copies in our backups | Up to 30 days after the deletion, after which the copy itself is overwritten |
17.1 The accounting period explained
Romanian law (Art. 23 and Art. 25 of Accounting Law no. 82/1991, as amended by Law no. 36/2023 in force since 15 January 2023) requires mandatory accounting records and the supporting documents behind them, invoices included, to be kept for five years counted from 1 July of the year following the financial year in which they were drawn up. In practice, for an invoice issued in 2026 the period runs from 1 July 2027 and ends on 30 June 2032.
That period matches the tax limitation period: under Art. 110 of Law no. 207/2015 (Fiscal Procedure Code) the right of the tax authority to establish tax claims expires after five years, running from 1 July of the year following the one the tax obligation relates to. The number is taken from the law, it is not an estimate of ours.
17.2 Closing your account does not delete your invoices
This is the point customers are most often surprised by, so we say it in advance. Closing your account deletes your account, your analyses and the content you submitted, on the timetable in the table above. It does not delete the invoice and the billing data behind it, which we must keep until the legal period above has expired. A request for erasure cannot shorten that period (Art. 17(3)(b) GDPR).
A deletion removes the data from the live systems on the timetable above. Backup copies that still contain them are rotated within 30 days, after which the copy itself no longer exists.
18. Security
Traffic runs over HTTPS and data are encrypted in transit. Passwords are never stored in clear: they are stored as a PBKDF2-SHA256 derivation with a per user salt and 100.000 iterations. Each account sees only its own analyses, and company accounts share only among their approved members. Administrative access is restricted to the persons who need it. Card details never reach our systems, as explained in Article 6.
19. Derived knowledge: records and aggregates
As you use the services we keep records of metadata of the checks, never of content: for example the type and severity of the issues found, the legal provision behind them, the markets, the languages and the score of an analysis, or, for a product information file, which obligations remain open, as closed codes. Each record is linked to a one way code derived from your email address, not to your name, and it stays pseudonymised: it is not anonymous data, so we treat it as personal data and you keep your rights over it.
From those records we derive aggregated knowledge, which we use to improve the services and our knowledge base, including after the contract ends, and, in the future, for sector level reporting. An aggregate is only used or released where it covers at least 20 events and at least 5 distinct accounts. It is shared only in a form that identifies neither you, nor your company, nor your products.
The derived knowledge leaves out original documents, formulas, compositions from which a product could be recognised, product names and the names of companies and people. ExpertDesk describes in its own policy what it derives from the use of its chat.
You can opt out with one click. In your account preferences the "Contribute to cosmetiFULL's knowledge" switch is on to begin with. If you switch it off, or write to us at info@cosmetifull.com, from that moment we derive nothing more from your activity, at no cost and with no effect on the service. What is already part of an aggregate can no longer be separated from it; existing records are detached from your account when the account is deleted, and you can ask us to detach them earlier.
Derived knowledge applies to data generated from 3 October 2026. What was done before rests on the description in force at the time and, for the reuse of content, on the written consents given during the beta.
20. Your rights
You have the right to:
- access your personal data and obtain a copy;
- rectify data that are inaccurate or incomplete;
- erase your data, within the limits of Article 17.2;
- restrict processing in the cases provided by law;
- data portability for the data you provided to us and that we process by automated means on the basis of the contract or of your consent;
- object to processing based on our legitimate interest, as set out in Article 21;
- withdraw your consent at any time given during the beta for the reuse of content described in Article 7.8, and your consent to Meta's pixel described in Article 7.14 from Cookie settings at the foot of every page of our website, without affecting the processing carried out before the withdrawal;
- lodge a complaint with a supervisory authority.
To exercise these rights, write to info@cosmetifull.com. We reply within the time limits set by the GDPR, as a rule within one month. Our lead supervisory authority is the Romanian ANSPDCP (Bd. G-ral Gheorghe Magheru nr. 28-30, sector 1, Bucharest, dataprotection.ro). You can also address the supervisory authority of the country where you live or work.
If your request concerns data contained in a document uploaded by one of our customers, Article 4 explains what we do with it.
21. Your right to object
This right is set out separately, because it deserves your attention.
Where we process your data on the basis of our legitimate interest (Articles 7.4, 7.5, 7.6, 7.7, 7.8, 7.9, 7.10, 7.11, 7.12 and, for the fingerprint against repeated sending only, 7.13), you have the right to object at any time, on grounds relating to your particular situation. Write to info@cosmetifull.com, tell us which processing you object to and why. We stop that processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or unless we need the data to establish, exercise or defend legal claims.
Two honest clarifications:
- an objection cannot remove data that we are required to keep under the accounting and tax obligations described in Article 7.2 and Article 17;
- fraud prevention on the payment itself is carried out by Stripe as an independent controller, so an objection addressed to us cannot switch off Stripe's own checks. You can address Stripe directly on that point.
22. If you are a consumer
This article applies only to individuals who buy for purposes outside their trade, business or profession. It adds to, and where they conflict it prevails over, the rest of this policy.
- We ask you for less billing information. For a purchase by a consumer we need your name and your billing address. We do not ask for a VAT number.
- We do not ask for and we do not keep your Romanian personal numeric code (CNP). The invoice is issued with your name and address. Where the e-Factura system requires a beneficiary code and you do not identify yourself with a tax code, the generic code provided by the ANAF technical specifications is used. We made this choice deliberately, in order to keep data collection to the minimum.
- We keep the record of your withdrawal rights. We keep the record of the express request for immediate performance and of the acknowledgement you gave at checkout, and the record of any withdrawal statement you send us, because the law requires us to be able to prove that the information was given. That record follows the accounting retention period.
- Refunds. If you withdraw within 14 days of purchase, we process the refund of the credits you have not consumed. The personal data used for that operation (purchase data, transaction identifier, refund identifier) are processed to perform the contract, Art. 6(1)(b) GDPR, and the credit note that follows falls under the accounting obligations of Article 7.2.
- Complaints. You can lodge a complaint with the Romanian ANSPDCP or with the supervisory authority of the country where you live.
23. Cookies and local storage
The platform uses only strictly necessary technical storage on your device: the session token that keeps you signed in, your email address and company name so the interface can show them without a further request, a record that you have seen the legal notices, and preferences such as language, theme and how your archive is displayed. The one exception depends on you: if you accepted Meta's pixel on our website, our sign-up page reads that answer and loads the pixel, which then stores on your device what is described below (Article 7.14).
Five of those items are cookies, and we set them ourselves:
| Cookie | Who sets it | What it is for | How long it lasts |
|---|---|---|---|
| `__Host-lobby_sess` | us | keeps you signed in after you enter your password. | 30 days, renewed while you use it |
| `__Host-pif_sess` | us | keeps you signed in to PIFBuilder. The browser sends it only to PIFBuilder, and the page's code cannot read it. | one day if you open PIFBuilder from your account on the platform, renewed the next time you open it from there; 30 days if you sign in with the PIFBuilder password, renewed while you use it |
| `__Host-cl_sess` | us | keeps you signed in to your author area in cosmetiLEARN. The browser sends it only to cosmetiLEARN, and the page's code cannot read it. | one day, renewed the next time you open cosmetiLEARN from your account on the platform |
| `__Host-cl_amm` | us | for our administrators only: keeps the cosmetiLEARN administration area open once they enter it from the platform's administration panel. The browser sends it only to cosmetiLEARN, and the page's code cannot read it. | 30 minutes, not renewed: after that they enter again from the panel |
| `cf_lingua` | us | remembers the language you chose and applies it in every application of the platform. It holds only the language code. | one year |
PIFBuilder also lists its cookie, and what it keeps in the browser's local storage, in its own privacy policy.
Three more cookies concern Meta's pixel (Article 7.14). Our website writes the first when you answer its box, and our sign-up page reads it; the other two are written by Meta's pixel, on our domain, only if you accepted:
| Cookie | Who sets it | What it is for | How long it lasts |
|---|---|---|---|
| `cf_consenso` | us, on our website, when you answer the box | keeps your answer (yes or no) for our website and for our sign-up page on app.cosmetifull.com, so that your choice is respected without asking again. It holds only that answer. | 6 months; after that the pixel stays off until you answer the box again |
| `_fbp` | Meta's pixel, only if you accepted | recognises your browser from one visit to the next | 90 days |
| `_fbc` | Meta's pixel, only if you accepted and you arrived from one of our ads | keeps the identifier of the click on that ad | 90 days |
With each step your browser can also send Meta the cookies Meta keeps on facebook.com, which is how Meta recognises your account. Meta's pixel can also write a few entries in your browser's local storage on our domain, for example `lastExternalReferrer`, which notes whether you came from Facebook, Instagram or another site. If you withdraw, the pixel stops and `_fbp` and `_fbc` are deleted; those local storage entries are no longer read or sent, and they disappear when you clear the site's data.
Our infrastructure provider sets none today, and we did not assume it: we measured it. On 23 August 2026 we opened the four public surfaces with a real browser (the LabelCheck application, its presentation page, ExpertDesk and the website) and counted the cookies present: zero, on all four. If one day we switch on a Cloudflare feature that sets one (bot detection, for instance), this table will say so before it happens.
In the browser's local storage, which is not a cookie and does not travel with requests, we keep the token that keeps you signed in to the application, your email address, your company name, your language and your theme. It disappears if you clear the site's data. In cosmetiLEARN it holds only your language, your theme and where you prefer the assistant, beside the page or in a panel: never anything you have written, and never the conversation.
Apart from Meta's pixel, which runs only with your consent as described above, we use no advertising cookies, no third party analytics and no tracking across websites; the campaign named in a link you follow is recorded only as described in Article 5.1. The platform's own cookies are strictly necessary and exempt from consent under Art. 4(6) of Law no. 506/2004, which is why the platform shows no cookie banner of its own: the one choice to make is about Meta's pixel, and you make it on our website, where you can change it at any time from Cookie settings at the foot of every page. This conclusion holds only for as long as the first table above contains nothing beyond what is strictly necessary.
The payment page is hosted by Stripe on Stripe's own domain. Any storage or reading of information on your device that happens on that page is done by Stripe under its own privacy policy, and is outside our pages.
24. Changes to this policy
If we change this policy we update the date at the top, and for substantial changes we notify you inside the platform. When a change concerns a new purpose or a new recipient, we inform you before that processing starts, not afterwards. Derived knowledge (Article 19) applies only to data generated from 3 October 2026.
This policy, in the version in force at the time, applies to every purchase made on the platform.
Nicodemo & Signa Company Srl · Strada Lucian Blaga nr. 21, ap. 16, 310023 Arad, Romania · CUI RO15617609 · Reg. J02/809/2003 · info@cosmetifull.com
← cosmetiFULL