Your skin.
Your data.

The data controller is Elias Lotfi, publisher of Poiréa. For any questions or requests about your data: elias.lotfi7@gmail.com.

What we use

Your account provides an identifier, an email address and, where available, a name, along with a declared age group (15–17 or 18 and over). The account creation date and the version of the terms you accepted are retained. The questionnaire records your skincare answers; some optional answers may concern health, including allergies or treatments. Your journal contains the feelings and notes you choose to record. We do not ask for a photograph.

Why we use it, and on what basis

Your explicit consent (Articles 6.1.a and 9.2.a of the GDPR where health information is involved) allows suggestions to be personalised using the questionnaire and journal. Discoveries are available in your account area; no daily promotional email is sent without an explicit choice. Managing your account and access is based on performing the service you requested. Billing and legally required records are covered by our applicable obligations. No skincare answers are shared with Amazon or Stripe.

If you are under 18

Personal accounts are available from the age of 15. Your age group is used to adapt suggestions and reserve subscription purchases for adult accounts. It is self-declared: we do not ask for a full date of birth or identity document. It remains linked to your account when you delete your questionnaire; contact us to correct it. If you are under 15, you can read the public guides without creating an account or answering the questionnaire.

Your personal answers require your explicit consent, which you can withdraw in your account area. Discovery emails remain optional and are disabled by default, including for those aged 15–17. No public profile or behavioural advertising is created.

Where your information goes

The site uses OpenAI Sites hosting and a Cloudflare D1 database. Your account belongs to this site: email and password sign-in is managed by the application. Passwords are hashed with an individual salt and are never stored in plain text. Stripe processes payments, billing data and the technical identifier needed to activate access; card numbers do not pass through our server. Amazon receives the browsing information it needs when you open a link to its site, under its own policy.

Recovery messages, verification messages and optional daily updates are sent using Resend. This provider receives your address and the email content, which may include the names of selected products if you enable these updates. Raw questionnaire answers and journal notes are not shared with it. The sending domain is configured in the Ireland region, with transport encryption required and no open or click tracking. These providers may process data in several countries. Their terms and transfer mechanisms apply to their services: OpenAI, Cloudflare and Stripe and Resend.

Retention and deletion

Email updates require a verified address and a separate, voluntary choice. You can stop them in My account or through the link in each message, without cancelling your subscription. Products are selected when the email is scheduled; your account area always shows the selection based on your latest answers. The service keeps the date of your choice and technical delivery records. Completed delivery records are purged after thirty days during subsequent processing. Deleting your skincare data also stops daily emails.

Your sign-in session lasts for a maximum of thirty days, with renewal as you use the service. The session cookie is necessary, accessible only to the server and protected by HTTPS in production. You can sign out from your account. Your answers and observations are kept for your personal account area until you delete them or withdraw your consent. You can delete them immediately in My account. Account and payment information is kept separately to manage access and billing obligations. To delete your account completely or exercise a right relating to billing, contact us.

Before you sign in, a draft is stored in this browser so you can return to your answers and current step after closing it. The draft expires after seven days without changes and is purged the next time you open the questionnaire. Once you sign in, your answers are saved in your account. You are explicitly offered the choice to link an anonymous draft to your account. Signing out or deleting your answers removes the local draft associated with the account.

Application statistics

The administration area shows account counts, access statuses and overall questionnaire progress to help run the service. It does not provide access to your journal notes or individual skincare answers.

A separate choice in My account, disabled by default, lets you contribute to statistics on certain cosmetic preferences. This use is based on your consent: it is optional and does not affect your recommendations or subscription. Allergies, treatments, free-text notes and the journal are excluded. Groups with fewer than five participants are hidden. Withdrawing your consent excludes you from subsequent calculations; no copy of your answers is created for these statistics. This information is not sent to Google Analytics.

Your rights

You can access and correct your answers, export your journal and withdraw your consent from your account area. You can request the erasure, restriction of processing or portability of your data and lodge a complaint with the CNIL. Withdrawing consent stops personalisation; cancelling a subscription is a separate action in the billing portal.

Cookies and audience measurement

Sign-in and hosting use cookies that are necessary for the service. Your audience measurement choice is stored in your browser for 180 days, whether you accept or decline. You can change it at any time through “Cookie choices” at the bottom of the page. Declining does not prevent you from using the service.

Only with your consent, Google Analytics measures page views on the homepage, method page and public guides to understand their audience. No request is made to Google Analytics before you agree. The questionnaire, personal account area, account pages and payment pages are excluded. Skincare answers, the journal, account identifiers and email addresses are not sent to Analytics. URL parameters are excluded from this measurement; only the referring site’s origin, without its path or parameters, may be sent. Measurement cookies with the “lotfi_ga” prefix last for a maximum of 180 days. Their duration is not renewed on each visit. Detailed event and user data retention is set to two months, without an extension following new activity. Aggregated reports are not subject to this retention period.

There is no behavioural advertising, Google Signals or advertising personalisation. Form interactions, clicks and internal searches are not tracked automatically. Google processes the technical browsing data needed for measurement; processing outside the European Union may take place under the safeguards described in its privacy policy. Withdrawing your consent stops measurement and deletes this site’s audience measurement cookies, without deleting your account or journal. External sites you visit have their own cookie choices.