Privacy Notice – INCI4ME

1. Controller and contact

The data controller is SELLES S.r.l., Via Salvo d'Acquisto 2, 30033 Noale (VE), P.IVA 04937130278. Privacy requests: support@inci4me.com.

2. Data processed

INCI4ME may process account/authentication data, personal or business details, contact data, preferences, plan and usage information, orders, payments and invoices, support tickets and technical security data. Registration date/time and IP address may also be stored to protect registration and prevent abuse.

3. Purposes and legal bases

• service, account and subscription management: performance of a contract or pre-contractual steps;
• billing, accounting and tax compliance: legal obligation;
• security, abuse prevention and protection of the service: legitimate interests, subject to users' rights;
• optional communications/newsletters: consent where required.

4. Camera, images and OCR

Images acquired for OCR are used to perform the requested analysis and are not kept by INCI4ME as a permanent photo archive. The application follows an application-level zero-retention model for OCR photos, with only transient processing needed for the function.

5. Payments and billing

Payments and subscription management may involve Stripe. INCI4ME retains technical references and commercial data needed to reconcile subscriptions, payments and invoices; full card details are not handled directly by INCI4ME when payment takes place in the provider environment.

6. Recipients and transfers

Data may be disclosed to providers acting for SELLES or as independent controllers where necessary for hosting, email, payments, security and legal duties. Transfers outside the EEA are subject to the safeguards required by applicable law and the relevant provider.

7. Retention

Data is retained for as long as necessary for the stated purposes and, for contractual, tax and accounting records, for statutory periods. Security data is kept for a period proportionate to abuse and incident prevention. Closing an account does not erase records that must be retained by law.

8. Rights

Where the GDPR applies, users may request access, rectification, erasure, restriction, portability and objection, and may withdraw consent without affecting prior lawful processing. A complaint may also be lodged with the competent supervisory authority.

9. Automated decisions

INCI4ME does not use cosmetic-analysis information to make solely automated decisions producing legal effects on the user. Payment providers may apply their own anti-fraud systems under their notices.