Privacy policy
This policy explains, in plain words, what personal data the SKINTELLECT shop collects, why, on which legal basis, how long we keep it, who else receives it and what your rights are. It covers this website, your account, orders, consultations and our AI assistant, and it follows the GDPR (Regulation (EU) 2016/679) and Portuguese law.
Version 1.1, 3 October 2026.
Who is responsible for your data
The controller of your personal data is the business that runs the SKINTELLECT shop in Guimarães, Portugal.
- Legal name
- Alena Siamashka da Cunha
- Tax number (NIF)
- 327115009
- Registered address
- Tv. de Vila Meã de Cima, 41-1dir, Bloco A, 4765-527 Serzedelo, Guimarães, Braga, Portugal
- Privacy contact
- skintellect.2025@gmail.com
- Phone
- +351 911 867 089
We have not appointed a data protection officer (DPO). Instead, the privacy contact above answers every question and request about your data.
What we collect and why
We collect only what each service needs. For each purpose below you can see what we collect, why, the legal basis in the GDPR and how long we keep it.
Your account
- What
- Name, email address, password, preferred language, how you prefer us to contact you and the number or username for that channel. The password is stored only in a scrambled form that nobody, including us, can read.
- Why
- To create and run your account: signing in, your orders, your saved address, your preferences and the consultation area.
- Legal basis
- Contract: you asked for an account (GDPR art. 6(1)(b)).
- How long
- While your account is active. An account with no activity for 3 years (no sign in, no order, no change to the account) is deleted, and we send you a warning email 30 days before. Signing in keeps it.
Delivery address and phone
- What
- Delivery and billing address, phone number.
- Why
- To deliver your orders and so that the carrier can reach you.
- Legal basis
- Contract (GDPR art. 6(1)(b)).
- How long
- Saved in your account while it is active, where you can change it. The copy on each order is kept with that order.
Orders, with or without an account
- What
- What you bought, prices, payment and delivery status, name, email, phone, delivery and billing address.
- Why
- To sell and deliver the products, deal with returns and refunds, and keep the invoices and accounting records the law requires. An account is optional: you can also buy as a guest.
- Legal basis
- Contract (GDPR art. 6(1)(b)), then a legal obligation for invoices and accounting (GDPR art. 6(1)(c)).
- How long
- 10 years, as tax and accounting law requires. After that, the name, email, phone and addresses are removed from the order; what was bought, the prices and the dates stay. Internal approval records about an order lose your name 30 days after the change is decided.
Skin profile, skin photos and consultations
- What
- Your skin profile (skin type, concerns, sensitivity, current routine), skin photos, your answers in a consultation (including pregnancy, breastfeeding and prescribed treatments), the written plan from our cosmetologist and the routine from the AI consultation.
- Why
- To suggest products and routines that suit your skin, and to hold the consultations you book.
- Legal basis
- This is health data, a special category. We use it only with your explicit consent (GDPR art. 9(2)(a) with art. 6(1)(a)). You give this consent separately, it is never needed to buy, and you can withdraw it at any time.
- How long
- Until you delete it, or 2 years after you last used it (the last time you saved your skin profile, sent a photo, booked a consultation, or received a plan or an AI routine).
- Your photos are seen only by you and the cosmetologist of that consultation.
- Skin profiles and plans are seen only by the store owner and our cosmetologists, never by other members of the team.
- This data is never used for advertising or to target offers. For marketing we use only your order history.
- You can see, change, download or delete it in My account at any time.
- To withdraw this consent, delete your skin data on the skin profile page. The data is erased, and consultations cannot be prepared until you agree again.
- If we change the wording of this consent, we ask you again before you add new skin data.
- We record each consent you give or withdraw (what it was for, the wording version, the language, the page and the time), so that we can show it was given (GDPR art. 7(1)). When you delete this data or your account, the record stays only under a code, without your name, for 5 years, and is then deleted.
Booking a consultation
- What
- The consultation you chose, the date and time, the cosmetologist and the state of the booking.
- Why
- To arrange the consultation and keep you informed about it.
- Legal basis
- Contract (GDPR art. 6(1)(b)).
- How long
- With your consultation (see above). A booking left unfinished, or cancelled, is deleted 30 days after it ended.
Video consultations
- What
- Your image and voice during the call, live, and the name you join with.
- Why
- To hold the video consultation you booked.
- Legal basis
- Contract (GDPR art. 6(1)(b)), and your explicit consent for what you show and tell us about your skin (GDPR art. 9(2)(a)).
- How long
- Nothing: calls are never recorded.
- Calls run through Daily (daily.co), with the call room in the EU region.
- The room is private: only you and the cosmetologist of the consultation can join, and it closes after the booked time.
The Skintellect assistant and the AI consultation
- What
- What you type in the chat bubble or to the assistant in the skin profile form. For the paid AI consultation, your skin profile and your answers to its extra questions.
- Why
- To answer questions about our products, the shop and skin care, to help you fill in your skin profile and, in the paid AI consultation, to write a routine for you.
- Legal basis
- Chat: steps you ask for before buying (GDPR art. 6(1)(b)). Skin profile assistant: your explicit consent, which you give when you start it (GDPR art. 9(2)(a)). AI consultation: contract (GDPR art. 6(1)(b)), with your explicit consent for the skin profile it reads (GDPR art. 9(2)(a)).
- How long
- Conversations with the assistant are not stored: they are gone when you close the window. The AI consultation's routine is kept with your skin profile (see above).
- Answers are written automatically by an AI model that runs on our own server. Your messages are not sent to any outside AI company.
- We always tell you when you are talking to an AI, as the European AI Act asks (Regulation (EU) 2024/1689, art. 50).
- The chat bubble does not know who you are, even when you are signed in, and never reads or writes your skin profile. The skin profile assistant only suggests answers: you review the form and save it yourself.
- The AI routine is advice, not a diagnosis, and it has no legal or similarly significant effect on you, so the rules on automated decisions (GDPR art. 22) do not apply. If you would like a person to look at your skin, book a consultation with our cosmetologist.
- The skin profile assistant only starts when you press its start button. That is your consent for that sitting (about 6 hours). We record that you started it, never what you wrote.
- An AI can make mistakes. For a medical question, please see a doctor.
News, offers and alerts
- What
- Your email address (or the contact you chose), your language and the products you asked us to watch.
- Why
- To send news, new products and offers, and to tell you when a price drops or a product is back in stock.
- Legal basis
- Your consent (GDPR art. 6(1)(a); Lei n.º 41/2004, art. 13.º-A). The boxes are never ticked in advance.
- How long
- Until you withdraw your consent, which you can do at any time in My account or with the link in each email. We record when you said yes or no and which wording you saw.
Reminders to buy again
- What
- Your order history (what you bought and when) and the contact you chose.
- Why
- If you are already our customer, to remind you when a product you bought is probably running out, so your routine continues without a break.
- Legal basis
- Your consent (GDPR art. 6(1)(a); Lei n.º 41/2004, art. 13.º-A): we only send reminders if you ticked the box for them, which is never ticked in advance.
- How long
- Until you withdraw your consent, which you can do at any time, free of charge, in My account or with the link in each reminder. We record when you said yes or no and which wording you saw.
Messages you send us
- What
- What you write, your name and the details of the channel you use: email, phone, WhatsApp, Telegram or Facebook.
- Why
- To answer you and, before you buy, to help you choose.
- Legal basis
- Steps you ask for before a purchase (GDPR art. 6(1)(b)) and our legitimate interest in answering you (GDPR art. 6(1)(f)).
- How long
- As long as we need to deal with your request and any follow up.
- WhatsApp, Telegram and Facebook are run by their own providers, under their own privacy terms. If you prefer, write to us by email.
Security and server logs
- What
- IP address, date and time, the page requested, browser type and error messages.
- Why
- To keep the site secure and working, and to detect abuse.
- Legal basis
- Our legitimate interest in a safe, working shop (GDPR art. 6(1)(f)).
- How long
- Briefly: logs are rotated and deleted automatically. Database backups are kept for 14 days, then replaced.
How long we keep it
In short, how long each kind of data stays with us. When a period ends, the data is deleted or made anonymous.
- Your account
- While your account is active. An account with no activity for 3 years (no sign in, no order, no change to the account) is deleted, and we send you a warning email 30 days before. Signing in keeps it.
- Delivery address and phone
- Saved in your account while it is active, where you can change it. The copy on each order is kept with that order.
- Orders, with or without an account
- 10 years, as tax and accounting law requires. After that, the name, email, phone and addresses are removed from the order; what was bought, the prices and the dates stay. Internal approval records about an order lose your name 30 days after the change is decided.
- Skin profile, skin photos and consultations
- Until you delete it, or 2 years after you last used it (the last time you saved your skin profile, sent a photo, booked a consultation, or received a plan or an AI routine).
- Booking a consultation
- With your consultation (see above). A booking left unfinished, or cancelled, is deleted 30 days after it ended.
- Video consultations
- Nothing: calls are never recorded.
- The Skintellect assistant and the AI consultation
- Conversations with the assistant are not stored: they are gone when you close the window. The AI consultation's routine is kept with your skin profile (see above).
- News, offers and alerts
- Until you withdraw your consent, which you can do at any time in My account or with the link in each email. We record when you said yes or no and which wording you saw.
- Reminders to buy again
- Until you withdraw your consent, which you can do at any time, free of charge, in My account or with the link in each reminder. We record when you said yes or no and which wording you saw.
- Messages you send us
- As long as we need to deal with your request and any follow up.
- Security and server logs
- Briefly: logs are rotated and deleted automatically. Database backups are kept for 14 days, then replaced.
Backups follow the same rules: they are kept for 14 days, so deleted data disappears from them within that time.
Who receives your data
We share data only with the providers that help us run the shop, and only what each one needs. They work under contract and on our instructions.
OVHcloud
Hosting: our website, database and AI model run on servers we rent in the European Union (France).
Cloudflare
Network and security in front of the site: it delivers pages quickly and blocks attacks. A US company (see transfers below).
Daily (daily.co)
Video consultations, with the call room in the EU region. A US company (see transfers below).
Email sending service: one.com
Sends the emails about your account, orders and consultations.
Google (Gmail)
The shop's contact mailbox (skintellect.2025@gmail.com) is a Gmail address, so Google stores the emails you send us and our replies. A US company (see transfers below).
Carriers (such as CTT)
Your name, address and phone, to deliver your parcel.
Payment provider: to be confirmed
Once card payments are available, it processes your payment.
Our accountant
Invoices and accounting records, as tax law requires.
Authorities
Only when the law requires it, for example the tax authority or a court.
WhatsApp, Telegram, Facebook
Only if you choose one of them to talk to us. They are run by their own providers (Meta for WhatsApp and Facebook), under their own privacy terms.
Where data leaves the European Union (Cloudflare, Daily and Google are US companies), the transfer follows the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
We never sell your data, and we never share it for anyone else's advertising.
Your rights
You have these rights over your data (GDPR arts. 15 to 22). Using them is free.
- Access
- Get a copy of the data we hold about you. In My account you can download it in one file: account, addresses, orders, skin profile and its history, photos, plans, AI routines, bookings and your consent record. The team's internal note about you and unfinished drafts of a plan are sent on request.
- Rectification
- Correct data that is wrong or incomplete, including your email address: the confirmation link goes to the new address and works for 1 hour, and we let the old address know.
- Erasure
- Have your data deleted. In My account you can delete your account; the confirmation link we email works for 3 days and must be opened while signed in. Some things stay: orders and invoices for the 10 years the law requires, bookings with their order but without your name or email, and the coded record of your consents for 5 years. While a consultation is still booked, cancel it with us first.
- Restriction
- Ask us to pause the use of your data while a question about it is settled.
- Portability
- Receive your data in a common, machine-readable file (the download in My account is a JSON file), or have it sent to another service where that is technically possible.
- Objection
- Object to uses based on our legitimate interest, such as answering your messages or keeping security logs. For direct marketing we always stop.
- Withdrawing consent
- Withdraw any consent at any time. This does not affect what was done before.
- Automated decisions
- We make no decisions about you by automated means alone that have legal or similarly significant effects.
How to use them
You can do most of it yourself in My account:
- download your data
- delete your account
- change your email address
- change your preferences and consents
Or write to our privacy contact: skintellect.2025@gmail.com
We reply within one month. A complex request may need up to two more months; if so, we tell you why within the first month (GDPR art. 12(3)). We may ask you to confirm your identity first, so that nobody else receives your data.
Complaints
If you think we have not handled your data correctly, you can complain to the Portuguese data protection authority. We would be glad to hear from you first, but you do not have to.
Comissão Nacional de Proteção de Dados (CNPD)Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa
www.cnpd.pt (opens in a new tab)
Minors
Our services are meant for adults (18 or older). We do not knowingly collect data from minors. If you think a minor has given us data, write to our privacy contact and we will delete it.
How we protect your data
In plain words, how we protect your data:
- Every connection to the site is encrypted (HTTPS).
- Access depends on the role: each member of the team sees only what their work needs. Skin data is seen only by the store owner and our cosmetologists.
- Skin photos are stripped of their location and other hidden data before they are stored.
- The database and the AI model are internal services, never open to the internet.
- Passwords are stored only in a scrambled form that cannot be read back.
- If a breach ever puts your data at risk, we tell the CNPD and, where the law requires it, you.
Changes to this policy
This is version 1.1 of the policy, dated 3 October 2026. When we change it, we update the version and the date here. If a change affects how we use your data, we tell you before it applies, by email or on the site.