Privacy Policy
1. Who we are
The controller for account, service and usage data processed through Hair Atelier AI is:
Nostro box j.d.o.o.
Jurja Ves III odv. 5, 10000 Zagreb, Croatia
OIB: 58661874766
Privacy contact:
hair_support@smc.com.hr
2. Scope of this Policy
This Policy explains how personal data is processed when you use Hair Atelier AI (“Service”), including authentication, hairstyle generation, account administration, plan and credit management, and support.
If a salon, company or other professional account uploads a photograph of its own customer, that business may be the controller for the customer's image and Nostro box j.d.o.o. may process the image on that business's behalf, depending on the circumstances. The business user is responsible for having an appropriate legal basis and for providing any required privacy information to that customer.
3. Personal data we process
| Category | Examples and purpose |
|---|---|
| Account and authentication data | Email address, account identifier, account status, login/authentication metadata and password-reset activity used to provide and secure your account. Plain-text passwords are not intentionally stored in the Hair Atelier application database. |
| Uploaded photographs | A photograph you choose to upload or take with the device camera, processed to analyze visible hair length and to generate the requested hairstyle/color preview. |
| AI output | The generated hairstyle preview. The Service displays the result in your browser and allows you to download it. |
| Plan and credit data | Your assigned plan, credit allowance, credits used, remaining credits, one-time bonus credits and related usage records. |
| Technical and security data | IP address, browser/device information, request metadata, timestamps and security logs that may be processed by us or our infrastructure providers to operate, secure and troubleshoot the Service. |
| Support communications | Information you provide if you contact us for account, privacy, technical or commercial support. |
4. How photographs are handled
Hair Atelier AI is designed not to persist uploaded customer photographs or generated hairstyle images in its own application database or file storage after the generation request. The image is temporarily processed by the application and transmitted to the AI service provider as necessary to perform the requested function.
We do not use uploaded photographs for biometric identification, identity verification or facial recognition. The Service is intended only to create a visual hairstyle/color preview.
The AI provider used by the Service is OpenAI. OpenAI states that data submitted through its API is not used to train or improve its models by default unless the API customer explicitly opts in. Under OpenAI's current default API data controls, abuse-monitoring logs may contain customer content and may be retained for up to 30 days, unless a longer period is legally required or different approved retention controls apply.
5. Purposes and legal bases
We process personal data for the following purposes and legal bases under the GDPR:
- Providing the Service and account: processing necessary to perform our agreement with you or to take requested steps before providing the Service (Article 6(1)(b) GDPR).
- AI hairstyle processing: processing the photograph you deliberately submit in order to provide the requested try-on service (Article 6(1)(b) GDPR, where applicable).
- Security, fraud prevention and troubleshooting: our legitimate interests in protecting the Service, users and systems and ensuring reliable operation (Article 6(1)(f) GDPR).
- Legal and regulatory obligations: where processing is necessary to comply with applicable law (Article 6(1)(c) GDPR).
- Consent-based processing: where we specifically ask for consent for a separate optional purpose, the legal basis will be Article 6(1)(a) GDPR. Consent may be withdrawn at any time for future processing.
6. Service providers and recipients
We use service providers that process data as necessary to operate Hair Atelier AI, including:
- OpenAI – AI image analysis/generation and related API processing.
- Supabase – authentication, database and account/credit data infrastructure.
- Vercel – web hosting, serverless/API execution and related technical infrastructure.
- Email/SMTP infrastructure – account and password-reset email delivery.
These providers may use their own subprocessors. We disclose personal data only as necessary for the relevant service, security, legal compliance or other purposes described in this Policy.
7. International data transfers
Some infrastructure or AI processing may involve providers or subprocessors located outside Croatia or the European Economic Area. Where GDPR Chapter V applies, transfers are handled using an applicable transfer mechanism, such as an adequacy decision or the European Commission's Standard Contractual Clauses (SCCs), together with appropriate safeguards where required.
8. Retention
- Uploaded/generated images: not intentionally retained as a persistent photo library by Hair Atelier AI. They are processed transiently to provide the request. Third-party infrastructure and AI provider retention may apply as described above.
- Account, plan and credit data: retained while the account is active and as reasonably necessary for administration, security, legal obligations and dispute resolution. Account-linked application records are intended to be removed when the account is deleted, subject to provider backups and legally required retention.
- Technical/security logs: retained according to operational need, security requirements and the relevant provider configuration/policies.
- Support communications: retained for as long as reasonably necessary to handle the request and related legal or operational needs.
9. Browser storage and cookies
The Service may use strictly necessary browser/session storage mechanisms to keep you authenticated and operate account functionality. We do not currently use third-party behavioral advertising in Hair Atelier AI. If analytics or non-essential cookies are introduced later, this Policy and any required consent mechanism will be updated.
10. Your GDPR rights
Subject to the conditions of applicable law, you may request access to your personal data, correction, deletion, restriction of processing, data portability, and you may object to processing based on legitimate interests. Where processing is based on consent, you may withdraw consent at any time without affecting earlier lawful processing.
To exercise a privacy right, contact hair_support@smc.com.hr. We may need to verify your identity before acting on a request.
You also have the right to lodge a complaint with the Croatian supervisory authority, the Agencija za zaštitu osobnih podataka (AZOP), or another competent supervisory authority in the EU/EEA.
11. Automated processing
Hair Atelier AI uses automated AI processing to create visual hairstyle previews. The Service does not use this processing to make decisions that produce legal effects or similarly significant effects about you within the meaning of Article 22 GDPR.
12. Children and photographs of minors
User accounts are intended for adults or authorized professional/business users. If you upload a photograph depicting a minor, you must be the parent/legal guardian or otherwise have the necessary authorization and lawful basis to submit the photograph for this purpose.
13. Security
We use reasonable technical and organizational measures designed to protect personal data, including authenticated access, server-side authorization for administrative functions, restricted database access and third-party infrastructure security controls. No online system can guarantee absolute security.
14. Changes to this Policy
We may update this Privacy Policy as the Service, providers, legal requirements or processing activities change. The current effective date will be shown at the top of this page.
15. Contact
Privacy questions and requests:
hair_support@smc.com.hr
Nostro box j.d.o.o.
Jurja Ves III odv. 5, 10000 Zagreb, Croatia
OIB: 58661874766
This Policy is intended to provide transparent information about the current Hair Atelier AI implementation. It should be reviewed whenever the technical architecture, payment model, analytics, storage practices or service providers materially change.