Privacy Policy

Effective from 09 November 2026.

This policy explains what personal data Kosvia processes, why, on what legal basis, who we share it with and what rights you have.

1. Data controller

Your personal data is controlled by Mateusz Wyka Vetch, Jaszczów 11A, 21-020 Milejów, Poland, tax ID (NIP) 5050134076. For anything related to your personal data, contact us by e-mail at kontakt@kosvia.pl or by phone at +48 724 050 102. We have not appointed a data protection officer.

2. What data we process

• Account: e-mail address, password hash (never the password itself), optionally your first name, your account language, the dates your account was created, last active and its e-mail address confirmed. You give your date of birth at registration only so we can check that you are 16 or over — we do not store it.

• Beauty profile and skin diary — only with your explicit consent: skin type, sensitivity, skin concerns and goals, budget, fragrance and ethical preferences, brands and ingredients you avoid (telling allergies apart from preferences), skin diary entries.

• Conversations with Kosvia AI: your questions and the answers. If you type information about your skin or health into a conversation, it is stored too and passed to the AI model provider (section 5) — do not share anything the question does not need.

• Your activity in the Service: products on your shelf and favourites, price alerts, comparisons, products you opened a full fit analysis for, your review of the Service — publicly visible with your first name, if you gave one.

• Plan: your plan (Free or Premium) and usage counters for features with limits. Payments are not live yet, so we process no payment data.

• Technical and security data: active sign-in sessions (browser information, dates), the history of consents you gave (which document version, when, browser information and a salted hash of your IP address) and, when you register, sign in or reset your password, the technical signals Cloudflare Turnstile uses to tell people from bots (section 7).

IP address. We do not store IP addresses in our database. The server processes your IP address briefly to handle the connection and protect the Service from abuse (e.g. limiting sign-in attempts). When you register, sign in or reset your password, your IP address also reaches Cloudflare (section 7). The consent history keeps only a salted hash of the IP address — such a hash can still be personal data, which is why we list it here.

Search. Search phrases are stored without any link to an Account and without an IP address — we use them to show popular searches. Do not type personal data into the search box.

3. Purposes and legal bases

• Running your Account and providing the services (shelf, price alerts, comparisons, reviews, plan) — performance of a contract, Art. 6(1)(b) GDPR.

• System e-mails (address confirmation, welcome, password reset and change, notice of a scheduled Account deletion) — performance of a contract, Art. 6(1)(b) GDPR. They are not marketing, and you cannot opt out of them while your Account exists.

• Beauty profile, Personal Match and skin diary — your consent (Art. 6(1)(a) GDPR) and, for health data, your explicit consent (Art. 9(2)(a) GDPR). The consent covers storing information about your skin and using it for personalised assessment of cosmetics.

• Kosvia AI using your profile, including passing data to the AI model provider — a separate consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR).

• News sent by e-mail — your consent, Art. 6(1)(a) GDPR. We do not currently send such messages.

• Replying to messages, handling complaints and content reports — performance of a contract and legal obligations, Art. 6(1)(b) and (c) GDPR.

• Security of the Service, preventing abuse (including the Cloudflare Turnstile check at registration, sign-in and password reset), proving consents, establishing and defending claims — our legitimate interest, Art. 6(1)(f) GDPR.

4. Health data

Skin type, acne, redness, sensitivity or allergies describe your health. We store them only after you tick a separate consent box that is unticked by default. You can withdraw this consent at any time in your profile — we then delete your beauty profile and skin diary immediately, and the rest of your Account keeps working. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

5. Kosvia AI

Kosvia AI answers with the help of Anthropic’s Claude language model. With your separate consent, for every question we pass to Anthropic: the question, the last few messages of that conversation, the part of your profile the answer needs (skin type, sensitivity, concerns, goals, budget and preferences), the names of the products on your shelf and the data of the products Kosvia found in the catalogue. We never pass on your name, e-mail address or Account ID. The facts about products — prices, ingredients, match scores — are looked up and calculated by Kosvia; the model only puts them into words.

Anthropic processes this data on our behalf as a processor, under a data processing agreement. It does not use it to train models and deletes it from its systems within 30 days — longer only where detecting violations of its usage policies or the law requires it. Processing takes place in the United States; the transfer outside the European Economic Area is based on the standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR). You can get a copy of the clauses by writing to the address in section 1.

Without this consent Kosvia AI is unavailable and the rest of the Service works as usual. You can withdraw the consent in your profile — from then on none of your data reaches Anthropic. Conversations are kept in your Account until the Account is deleted.

6. Personal Match — automated assessment

The product fit score is calculated by Kosvia’s own deterministic algorithm from the product’s ingredients and your profile: fit with your skin type, concerns and goals, formula quality, fragrance, budget, ethical preferences and the products you already have. Every part of the score has a named reason, shown under “Why this score?”. The score is a cosmetic recommendation, not a dermatological diagnosis. It does not produce legal effects concerning you or similarly significantly affect you.

7. Recipients

• Our server provider (OVHcloud) — servers located in the European Union; it processes data on our behalf as a processor.

• Open Beauty Facts (France) — product photos are shown directly from Open Beauty Facts servers, so when you browse the catalogue your browser connects to them and passes on its IP address and browser information. We share no data from your Account with them.

• E-mail provider — netserwer.pl, the provider of our kosvia.pl mailbox: we send system e-mails through it and keep the messages you write to us there (your e-mail address and the message).

• Anthropic (provider of the Claude language model, United States) — only when you use Kosvia AI with your consent; it processes data on our behalf as a processor, details in section 5.

• Cloudflare (Cloudflare, Inc., United States) — the registration, sign-in and password reset pages use Cloudflare Turnstile, a check that tells people from bots. Your browser then passes Cloudflare its IP address, browser information (the User-Agent header and the TLS fingerprint of the connection) and the technical signals the check needs. Cloudflare processes them on our behalf as a processor and, for improving its bot detection, as a separate controller relying on its own legitimate interest (Cloudflare's Turnstile privacy notice). The data goes to the US under Cloudflare's certification to the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and, should it lose that certification, under standard contractual clauses.

• Public authorities — only where the law requires it.

Fonts and all other files of the Service are served from our own server. We use no analytics, advertising or third-party error monitoring tools. We do not sell data. The only data that leaves the European Economic Area is what is passed to Anthropic when you use Kosvia AI (section 5) and to Cloudflare when you register, sign in or reset your password. When payments go live, we will add the payment operator to this list.

8. How long we keep data

• Account, activity and Kosvia AI conversations — until the Account is deleted. Deletion happens 7 days after you request it — until then you can undo it with the link in the e-mail or in your profile (“Keep my account”); afterwards we keep only a hash of the Account ID as proof that the deletion was carried out.

• Data passed to Anthropic when you use Kosvia AI — at Anthropic for up to 30 days, as described in section 5.

• Beauty profile and skin diary — until you withdraw consent or delete your Account; in both cases we delete them immediately.

• Consent history — for as long as the Account exists, so we can show what you agreed to and when.

• Sign-in sessions — until you sign out or the session expires, at the latest 30 days after it was last used.

• E-mailed links — only a hash is stored, until the link expires: password reset 1 hour, address confirmation 7 days, keeping the Account until its deletion date.

• Correspondence, complaints and content reports — for as long as it takes to resolve the matter, and then until any related claims become time-barred.

• Backups — data disappears from them within 30 days at the latest.

• Inactive accounts — we may delete an Account that has been inactive for 24 months, after notifying you first.

9. Your rights

• Access and portability — download all data linked to your Account as JSON from your profile.

• Rectification — edit your Account and profile at any time.

• Erasure — delete your Account from your profile.

• Restriction and objection to processing based on our legitimate interest — write to us.

• Withdrawing consent — switch off any consent in your profile.

• Complaint to the Polish supervisory authority: President of the Personal Data Protection Office (Prezes UODO), ul. Stawki 2, 00-193 Warsaw.

You can also send any data request to kontakt@kosvia.pl. We will reply without undue delay and within one month at the latest.

10. Do you have to provide data

Providing your e-mail address and password and confirming your age with your date of birth are voluntary, but you cannot create an Account without them. Your beauty profile, first name and everything else are entirely optional — the catalogue, search and comparison work without an Account.

11. Cookies and browser storage

The Service stores in your browser only what the features you use need to work:

• kosvia_at — proof that you are signed in, valid for 15 minutes;

• kosvia_rt — keeps your sign-in session, valid for 30 days;

• kosvia_locale — your chosen language, valid for 12 months;

• kosvia_cookie_notice — remembers that you closed the cookie notice, valid for 12 months;

• browser storage (localStorage) — the list of products you add to comparison yourself; you can clear it in the comparison view;

• Cloudflare Turnstile — on the registration, sign-in and password reset pages, the check may keep a technical identifier in browser storage that it needs to tell people from bots.

The sign-in cookies are not accessible to scripts on the page. Because all of these are strictly necessary to provide the service you ask for, under the Polish Electronic Communications Law they do not require your consent — so on your first visit we only show a notice about them instead of asking for consent. We use no analytics or advertising cookies.

12. Changes to this policy

Every change is published on this page as a new version with its effective date. We will inform Users with an Account of material changes in the Service or by e-mail, and where a change requires your consent, we will ask for it.