Privacy notice BETA

How Cosmetic Rules handles personal data. We collect as little as we can: this site uses no cookies.

1. Who is responsible

The controller is ZAPPIT AI S.à r.l., 7 Avenue du Swing, L-4367 Belvaux, Luxembourg (RCS Luxembourg B295926, VAT LU36542984). Contact for data protection questions: support@cosmeticrules.com.

2. What we collect and why

• Account data: your email address and, if you give it, a name or company, to create your account, send sign-in codes, key and billing notices, and contact you about the service (contract, GDPR Art. 6(1)(b)).
• Sign-in security: for each signed-in session, when it started and was last used, a coarse browser and operating-system description and a one-way hash of your IP address, to show and end your sessions and to protect your account (contract and legitimate interest), kept until 30 days after the session ends.
• API usage records: for each call, the key id (or, for calls from this website while you are signed in, your account), endpoint, time, units counted and whether it failed, to enforce plan limits, bill and support you (contract). We do not store request bodies.
• How you found us: with a signup we record the campaign tags of the link you arrived by (utm parameters), the referring website and the first page you visited, kept in your browser tab until then (no cookies), to learn which channels work (legitimate interest, Art. 6(1)(f)).
• Abuse protection: short-lived counters keyed by a one-way hash of your IP address and email address, and a Cloudflare Turnstile check on the sign-in, sign-up and recovery forms, to stop automated signups and guessing (legitimate interest, Art. 6(1)(f)).
• Payments: when you upgrade, Stripe processes your payment details; we keep only the Stripe customer and subscription ids, invoices and VAT information (contract and legal obligation, Art. 6(1)(c)).
• Support emails you send us (contract or legitimate interest).

3. Service providers

We use processors under data processing agreements: Cloudflare (hosting, the API, bot protection and web analytics), Resend (sending confirmation and notice emails) and Stripe (payments; Stripe is also an independent controller for its own legal duties). Some of them process data in the United States; transfers rely on the EU-U.S. Data Privacy Framework where the provider is certified, or on the European Commission's standard contractual clauses.

4. How long we keep data

Proposed, pending review: account data for as long as the account exists, then deleted within 30 days of a deletion request or account closure; usage records for 24 months; sign-in codes 7 days after they expire; sessions 30 days after they end; abuse counters for at most 24 hours; invoices for the period Luxembourg law requires; error reports for 90 days.

5. Cookies and storage

This website sets no tracking or advertising cookies. When you sign in, our API sets one strictly necessary cookie, __Host-xm_session, on api.cosmeticrules.com. It holds a random session identifier, is deleted when you sign out and expires after 30 days without use (at most 90 days). Your browser also remembers in local storage that you are signed in (no personal data), to show the right menu. We count page views with Cloudflare Web Analytics, which does not use cookies or local storage and does not build visitor profiles.

6. Error reports from this website

If a page script fails, your browser sends us a short error report: the page path, the error message, the script location and the product name. We remove query strings and link fragments first, and we do not include anything you typed. We use these reports only to fix the site.

7. Your rights

You can ask for access to your data, correction, deletion, restriction, portability, and you can object to processing based on legitimate interest. Write to support@cosmeticrules.com. You may also complain to a supervisory authority; ours is the Commission nationale pour la protection des données (CNPD).

8. Changes

We will post changes on this page and, for account holders, announce material changes by email in advance.

Version for the Cosmetic Rules beta. Cosmetic Rules is a trade name of ZAPPIT AI S.à r.l.