Privacy policy

1. Controller

The controller of personal data of Soina app users (Android/iOS app and soina.app) is Tukonea sp. z o.o., ul. Ks. Alojzego Koziełka 22, 44-190 Knurów, Poland, KRS 0001263471, VAT ID PL9691680946.

Data protection contact: contact@soina.app.

2. You, your salon and Soina

Soina connects a client with her beauty salon. Data you enter in the app yourself (account, rituals, reminders, skin analyses) is processed by us as controller.

The salon keeps its own client record (e.g. visit history, notes, contraindications). The salon is the controller of that data and Soina processes it only on the salon's behalf under a data processing agreement. Please contact the salon directly about that data.

3. Data we process

• Account: e-mail address, password (stored only as a secure hash), name, language, optionally your city.
• App use: ritual check-ins, reminder settings, your product shelf and estimated usage time, product requests, messages to your salon, support requests.
• Skin analysis (only if you use it): your face photo is sent for analysis and is not stored by us. We keep only the results (scores and description), which you may share with your salon.
• Skin type and care goals from the questionnaire.
• Technical data: session identifiers, the notification subscription in the browser version, basic server logs needed for security.
• Payments (only if you buy a plan): plan type, subscription status and period, and your Stripe customer ID. We never see or store your card details — Stripe handles them.

4. Purposes and legal bases

• Running your account and the service (rituals, reminders, salon connection) — Art. 6(1)(b) GDPR (contract).
• Skin analysis and sharing its results with your salon — your explicit consent, Art. 6(1)(a) and Art. 9(2)(a) GDPR. You can withdraw consent at any time without affecting earlier processing.
• Marketing messages — only if you opt in (Art. 6(1)(a) GDPR).
• Security, support and legal claims — our legitimate interest (Art. 6(1)(f) GDPR).
• Payment records when you use paid features — legal obligations such as tax law (Art. 6(1)(c) GDPR).

5. Processors and recipients

We use trusted providers who process data only on our instructions:

• Supabase — database and sign-in (EU servers, Frankfurt).
• Vercel — web app hosting (server functions in the EU, Frankfurt).
• Brevo — transactional e-mail (confirmations, password reset).
• Google — Gemini language model on Google Cloud (skin analysis description) and company e-mail.
• Perfect Corp. (YouCam) — skin parameter scoring from the photo; the photo is not stored by us.
• Hetzner — database backups (Germany).
• Open-Meteo and Photon (Komoot) — weather for your city; we send only the city name or coordinates, no account data.
• Stripe — payment and subscription processing (card details, billing) when you buy a plan.

Your salon receives the data you share with it: the card connection, messages, product requests and — with your consent — analysis results.

Some providers may process data outside the European Economic Area. Such transfers rely on the European Commission's standard contractual clauses or an adequacy decision (e.g. the EU-US Data Privacy Framework).

6. Retention

We keep account data while you have an account. When you delete the account, data is erased from the production database immediately and from backups within 14 days. Payment records are kept as long as tax law requires.

7. Your rights

You have the right to access, rectify, erase, restrict, port and object to the processing of your data, and to withdraw consent. Write to us: contact@soina.app.

You can delete your account and data yourself in the app: Profile → Privacy & data → Delete account. Details: soina.io/en/delete-account.

You may also lodge a complaint with the Polish supervisory authority (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw) or the authority in your country.

8. Security and children

Access is protected by database-level security rules (each user sees only her own data, a salon only its own clients), encrypted connections and limited team access.

The app is intended for people aged 16 and over.

9. Changes

We will inform you in the app or by e-mail about material changes to this policy.