Updated June 9, 2026
Privacy Policy
Your privacy matters. Here’s what we collect, why, and your rights. Quiz health data is handled separately and with particular care.
1. Data controller
PROTOKOL SRL (en cours de constitution), Belgique — hello@protokol.care.
2. Data collected
Account/order data: email, language, subscription info.
Health data (quiz): sleep, skin, energy, and where relevant allergies/pregnancy/medication — only to personalise your recommendation and ensure product safety. Special category under GDPR art. 9.
3. Legal bases
Contract performance (order/delivery). Explicit consent for processing health data (un-checked box before the quiz result). Consent for the marketing newsletter.
4. Cloistering & purpose
Health answers are stored separately from marketing data, with restricted access, and are never sent to ad tools or resold. No sensitive health profiling is shared.
5. Processors
Hosting & database: Supabase (EU region) and Vercel. Payment: Stripe. Email: Resend. Analytics: PostHog (enabled only after your cookie consent). DPAs are in place with each.
6. Retention
Subscription data: duration of the relationship + accounting obligations. Health answers: subscription duration + a limited period, then deletion or anonymisation. Unconverted leads: shorter duration.
7. Your rights
Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent anytime. Write to hello@protokol.care. You may also lodge a complaint with the Belgian Data Protection Authority (APD/GBA).
8. Glow Scan (photo analysis)
If you use Glow Scan, your photos (face and body) are analysed by an AI to produce an aesthetic audit and a score — a strictly aesthetic purpose, never medical. These photos are biometric data (special category, GDPR art. 9).
Legal basis: your explicit consent (un-checked box, before any capture). Photos are processed then deleted — they are not retained (only the report/score is); no photo is shared with ad tools or resold. Adults only.
AI processor: Anthropic (analysis), under a data processing agreement. You can withdraw consent and request erasure of your report anytime: hello@protokol.care.
Before/after vault (optional): if — and only if — you tick the dedicated option while signed in, your photos are kept in a private, encrypted space (Supabase, EU region), accessible to you alone, to track your progress. Legal basis: your explicit, separate consent. You can delete them yourself anytime from “My glow”, which erases them permanently. Without this option, your photos are never kept.