Privacy policy

SKINTRACE SAS, a French simplified joint-stock company with capital of EUR 2,000 and registered office at 4 rue Saint-Nicolas, 59400 Cambrai, France, publishes the Skintrace website, application and portals. Personal-data contact: skintrace.pro@gmail.com.

This policy covers processing related to the website, professional service and booking, form, consent and follow-up journeys offered to studio clients.

SKINTRACE is the controller for managing its website, professional accounts, subscriptions, billing, support, security, technical service administration and its own legal obligations.

For client data processed for a studio’s purposes, the relevant studio determines the purposes and necessary information and normally acts as controller. SKINTRACE acts as processor on the studio’s behalf, under its documented instructions and the contract with it.

This allocation also applies when clients enter information directly into a public Skintrace portal to book with a professional, fill in a form or complete a consent process. Direct entry does not transfer responsibility for the studio’s processing to SKINTRACE.

Processing may concern website visitors, professional prospects, subscribing professionals, their users and operators, and their clients: people booking appointments, completing consent forms or included in traceability records. Legal representatives of minors are also concerned where their information is necessary.

We process only the categories needed to operate the website and service. The data actually processed depends on the features used and the information supplied by a studio.

• Account and identity data: first and last name, email address, identifiers, authentication information, role, permissions, associated studio, settings and history needed for account security.
• Communication data: support requests, messages, attachments and correspondence history.
• Technical and security data: IP address, date and time, browser, device, authentication events, application logs and operational diagnostics.
• Technical logs and diagnostics may contain URLs, identifiers, IP and device data, messages, stacks, business values, payload metadata, documents, signatures, large JSON and data URIs.
• Local website preferences: consent version and choices stored in the browser’s local storage.

Contract and billing data includes identity, business name, professional and billing contact details, selected plan, subscription status and history, invoices and payment references.

Complete card details are processed by Stripe and are not stored by SKINTRACE.

Depending on the features used and information requested by the professional, client records may include the categories below. The technical ability to store information does not, by itself, justify collecting it.

Skintrace is not intended to collect or retain detailed medical information about clients. Where a health situation may affect a service, necessary information is intended to be communicated orally to the professional. Conditions, treatments, diagnoses, allergies or other medical details communicated in this way must not be transcribed into Skintrace comments, notes or free-text fields.

• Identity and contact details: first and last name, age or date of birth where necessary, email address, phone number and necessary identification information.
• Client journey: appointments and history, requested or completed services, relevant professional or operator, forms, consent records and signatures.
• Documents: photographs related to the service or its follow-up, useful documents, parental authorizations and strictly necessary supporting documents under the conditions below.
• Service and traceability: procedures, non-medical follow-up information, products, jewelry, needles, pigments and equipment used, batches, sterilization cycles and transactions recorded by the studio.

When booking, the portal may collect the client’s identity and contact details, age or date of birth if necessary, selected service and professional, date and time, non-medical comments, appointment status, changes or cancellations and information needed for journey security and traceability.

The professional with whom the appointment is booked normally remains controller for this processing. SKINTRACE supplies the technical solution as processor; the professional determines the information needed for the booking.

For a service involving a minor, data may include their identity, age or date of birth, their legal representative’s identity, parental authorizations and evidence of necessary checks. The professional determines the age rules, supporting documents, authorizations and requirements for a legal representative’s presence applicable to their activity. SKINTRACE does not decide whether a service can lawfully be performed on a minor.

Where visual verification of an identity or supporting document is sufficient, it must be preferred to keeping a copy. A limited record of the check, such as its date, the type of document presented and the operator concerned, should be preferred to a complete copy where this meets the need.

A copy or photograph of a supporting document should be retained only if the professional establishes its necessity and legal basis. The professional must inform the person, limit information and access, set the strictly necessary retention period and delete the copy when no longer justified, subject to a legal retention obligation. Routine retention “just in case” is not justified.

For its own processing, SKINTRACE uses data to create and administer accounts, provide the service, manage subscriptions and invoices, provide support and maintenance, secure the platform, prevent fraud and abuse, diagnose incidents, meet legal obligations and defend its rights.

As processor, SKINTRACE enables the professional, under their instructions, to manage clients and appointments, receive bookings, send necessary communications, collect forms, consent records and signatures, document services and non-medical follow-up, manage photographs, documents and traceability records and retrieve necessary exports.

Where SKINTRACE is controller, each purpose relies on a legal basis under the GDPR, according to the processing concerned.

For studio processing, the professional determines the appropriate legal basis for each purpose; SKINTRACE processes data under documented instructions. Consent to a service is not automatically GDPR consent or permission for marketing.

If health data or other special-category data is nevertheless processed, applicable obligations still apply, including a condition under Article 9 GDPR in addition to the processing legal basis. This requirement does not authorize entering medical details contrary to the minimization rules above.

• Contract performance or requested pre-contractual steps: answer a sales enquiry, create and administer accounts, provide requested features, manage subscriptions, support users and enable exports.
• Legal obligation: retain accounting records, answer legally valid requests and comply with applicable tax or judicial duties.
• Legitimate interests: secure the service, prevent abuse, diagnose incidents, maintain availability and defend legal rights, after balancing those interests against individual rights.
• Consent: use an optional storage or script category on the website when offered. Consent can be withdrawn at any time through Cookie settings.

The studio determines purposes, strictly necessary data, legal bases and retention periods suited to its obligations and service limits. It informs clients, responds to rights requests, manages the rules applicable to minors and limits access to authorized people.

It must not transcribe detailed medical information communicated orally and must justify retaining any copy of an identity document. A photograph used in a client record or for follow-up does not automatically authorize social-media publication or advertising use; that separate use requires checking the applicable legal conditions, particularly for minors.

Using Skintrace does not replace the studio’s professional, health or regulatory obligations or its GDPR documentation. The detailed data-processing commitments in the contract supplement this policy.

Data is available to the relevant professional, their authorized users and authorized SKINTRACE personnel who need it for their work. Technical providers access it only as needed for their service. A studio’s data is not made available to other studios using Skintrace.

Authorities or professional advisers may receive necessary information when required by law or to establish, exercise or defend a legal claim.

We may use the following contractually controlled providers according to the features enabled. Using a provider does not give it the right to freely use studio client lists.

• OVH for website hosting; Cloudflare R2 for service object and document storage.
• Stripe for payments, subscriptions and related billing documents.
• Amazon Web Services for SMS delivery when that feature is used.
• The production-configured SMTP provider for transactional and support email.
• Google for optional authentication with a Google account.
• Scanbot and the delivery networks required by its components when scanning is used.
• SigNoz for technical logs and diagnostics to secure the service, diagnose incidents, maintain availability and provide support.

Primary hosting is organized in the European Economic Area. Some international providers may nevertheless process data from a country outside the EEA to deliver their services, support customers or secure infrastructure.

Where a transfer is required, it relies as appropriate on an adequacy decision, the recipient’s valid participation in the EU-US Data Privacy Framework, or European Commission Standard Contractual Clauses with appropriate supplementary measures. Information about the relevant safeguard can be requested from our contact address.

We retain data for the period needed for its purpose, then delete it or place it in a restricted archive where the law or a legal claim requires this. Plan settings and studio instructions may result in a shorter period for some service data.

The professional determines retention for client records processed on their behalf according to their legal, regulatory and professional duties, within service limits. Where justified, copies of identity documents are limited to the period strictly necessary for their purpose; they are not automatically kept as long as the entire client record.

• Account and service content: for the contractual relationship and the operational period needed for closure, recovery or deletion, subject to mandatory archives.
• Professional prospecting: up to 3 years after the last meaningful contact, unless the person objects or a different obligation applies.
• Support correspondence: up to 3 years after closure, unless a particular justified need requires otherwise.
• Technical and security logs: up to 12 months, unless longer retention is needed to investigate an incident or comply with law.
• Invoices and accounting records: 10 years under French accounting rules.
• Contract evidence: up to 5 years in a restricted archive after the relationship ends, according to the applicable limitation period.
• Evidence of parental consent for a procedure involving a minor: set by the studio under its duties; the specific French 3-year period may apply to this evidence. It is not a general retention period for every record.

SKINTRACE applies technical and organizational measures proportionate to risk, including access controls, logical separation between studio workspaces, security logging, encryption in transit, backups and incident-management procedures.

No system provides absolute security. Each studio must manage its users, use strong authentication, promptly remove unnecessary access and limit entered data to what is needed.

If an incident may affect personal data, SKINTRACE takes the necessary measures to determine its origin and limit its consequences. As processor, SKINTRACE informs the relevant professional without undue delay after becoming aware of a breach so they can assess necessary measures and notifications, in accordance with the contract and GDPR.

Where SKINTRACE is controller, it notifies the supervisory authority and informs affected individuals in the circumstances and within the time limits required by the GDPR. Each studio remains responsible for the notification duties applicable to its own processing.

Depending on your situation, you may request access, correction, erasure, restriction or portability, and object to processing based on legitimate interests. You may withdraw consent without affecting earlier processing. For processing controlled by SKINTRACE, send requests to skintrace.pro@gmail.com with enough information to identify the relevant processing.

For a client record processed on a studio’s behalf, contact the relevant professional first, including if you entered data directly into a portal. SKINTRACE assists under its processor obligations and may refer your request to the professional.

We may request identity evidence only where needed to avoid disclosure to a third party. We answer within the GDPR time limit.

You may lodge a complaint with the competent supervisory authority if you believe your rights are not being respected. In France this is the Commission nationale de l’informatique et des libertés (CNIL), through cnil.fr. You may also contact the competent authority where you live or work.

The website currently uses no audience analytics tool or advertising script. It stores only your privacy choice in browser local storage so that the same decision is not requested on every visit. This storage is necessary to manage your choice.

Analytics and Marketing are off by default, and no scripts in those categories are currently loaded. If purposes or providers change, the consent version will be renewed so that an up-to-date choice is requested. You can change or withdraw your choice at any time with the Cookie settings button in the footer.

Emails and, depending on the features used, SMS confirming, reminding, changing, cancelling or preparing appointments, as well as messages necessary for accounts, billing, security or support, are operational communications distinct from marketing messages.

An address supplied to receive a confirmation does not automatically authorize advertising. The professional remains responsible for marketing rules when using client contact details for that purpose, including consent where required and the right to object.

SKINTRACE does not sell personal data from client records or commercialize studio client lists. We do not use service data to create advertising profiles.

Data entrusted by studios is processed only as necessary to provide, secure, maintain and support the service, under documented instructions and applicable contractual commitments.

This policy may change to reflect updates to the service, providers or applicable law. The date at the top identifies the current version. We will provide more prominent information where a change materially affects individual rights.

Any introduction of new features changing processing, such as client payments, booking guarantees or card pre-authorizations, will require appropriate information. This statement does not announce their current availability.

For questions about this policy or processing carried out directly by SKINTRACE, contact SKINTRACE SAS, 4 rue Saint-Nicolas, 59400 Cambrai, France, at skintrace.pro@gmail.com.

For data in a client record or relating to a booking with a studio, contact the relevant professional first.