Last updated: November 7, 2026 · version 2026-11-07
In the event of a conflict of interpretation between versions in different languages, the Italian text shall prevail.
The data controller is Davide Dal Bo — Strada del Mozzato, 3, 31100 Treviso (Italy), telephone +39 340 904 8505. For anything concerning your data and the exercise of your rights, write to info@lucea.app. For technical problems with the app — a save or a deletion that doesn't go through — there is support@lucea.app: it is the same controller, with a mailbox dedicated to support.
Lucea is a web app offering personalized cosmetic advice, designed according to the principle of data minimisation. You can use it in two ways, which involve different data:
Sections 3 and 4 describe the two cases. The sections that follow apply to both.
3.1 Questionnaire answers. These may include information about your skin (type, goals, any allergies or conditions you choose to declare, for example broken capillaries) and, if you give it, your age group. They are sent to our servers only when you request your routine, used solely to work it out and return it to you, and are not saved or recorded in logs. A copy of your answers stays saved only on your device (your browser's local storage), so that you can pick up the questionnaire where you left off: you can delete it at any time from your browser settings.
3.2 Optional “Inside & Out” section (pregnancy or breastfeeding). If you choose to turn on the advice on food supplements, we also ask whether you are pregnant or breastfeeding: this belongs to the special categories of personal data (Art. 9 GDPR) that we use solely, at the moment of the request, to exclude suggestions that aren't suitable. It is processed only in memory, for the duration of the calculation: it is never saved, either on our servers or in the local copy of your answers on your device, and it is not included in the routines you save. The legal basis for the processing is your explicit consent, given by turning on the section and answering the question (Art. 9(2)(a) GDPR); you can simply not turn it on, or not answer.
3.3 City, for the weather and the UV index (optional). You can choose your city from a list. Your choice stays saved only on your device, so that you don't have to choose it again every time, and you can change or remove it whenever you like. To retrieve the UV index, our infrastructure requests the weather data from the provider (MET Norway) using the city's coordinates, not your location: neither your IP address nor anything else about you reaches the provider. Lucea does not use your device's geolocation.
3.4 Products you already use. If you tell us which products you use, you look them up by typing the name or the brand: only the text you type travels to our server, where it is used to find the product in a dataset derived from the public Open Beauty Facts database — always without personal data and without images.
3.5 Language and country for products. To choose products on sale where you are, and to apply the rules that some countries require (section 14), our server reads the country the request comes from, which Cloudflare derives from the IP address. We don't save it. The language you choose and the country for products you set with “Change” stay saved only on your device; if you have an account, we also save the language (section 4.6).
3.6 “Search online”. Next to each product there is “Search online”: it opens a Google search in a new tab with the product's brand and name or, where we suggest a type of product, with the type and the active ingredient to look for. We don't put any of your answers to the questionnaire into the search. From that moment you are on Google, which processes your data according to its own rules. We count the tap in aggregate form, without linking it to you (section 5).
4.1 Your identity. The account is created with an email address and password, or with a Google account. Your identity is managed by Firebase Authentication, a Google service: that is where your credentials live, and Lucea neither sees nor keeps your password. On our servers we record a technical account identifier, your email address and the date the account was created.
4.2 Consents. The first time you log in, we ask you to accept the Terms and to confirm that you have read this Policy. We record the date of each confirmation and the version of the documents you saw (the one shown at the top of this page): this allows us to demonstrate what you accepted and when.
4.3 Saved routines. When you save a routine, we keep the title you give it, the date and the list of products with step, name, brand, approximate price and link. We don't keep the profile the routine came from: neither your questionnaire answers, nor the personalized explanations (“Chosen because…”), nor the highlighted active ingredients. A saved routine is a list of products, not a portrait of your skin. You can save up to ten, rename them and delete them one by one.
4.4 Your plan. We record whether your account is on the free plan or the Premium plan. It is the only piece of data that decides which features you see.
4.5 Your session. So that you don't have to log in on every visit, Firebase keeps a session token in your browser's storage. It is deleted when you log out of your account (“Log out”, in your Profile) or clear the site's data.
4.6 Language. When you choose the app's language while logged in to your account, we save it in your account, so that we can offer it to you when you log in from another device.
The website, the app and Lucea's services are provided through Cloudflare, which processes technical data (such as your IP address) to deliver content and for security (preventing abuse and cyber attacks); to protect the service from bots, it may save in your browser the technical cookies described in the Cookie Policy. The service's database is located in the European Union. To understand how many people use the web app we use Cloudflare Web Analytics, which does not use cookies, stores nothing on your device and does not track individual visitors: it derives the country from the IP address without keeping it, and we see only aggregated data (for example, how many people completed the questionnaire).
If you don't use an account, the web app doesn't connect to Google. The app's code and fonts come from our servers. The Firebase Authentication code (section 4.1) is downloaded from Google's servers (gstatic.com) only when you open the screen to log in or create an account, or when the app opens if you have an open session on that browser: at that moment Google receives, as with any file downloaded from a website, your IP address and your browser's technical data.
Counts without personal data. Hour by hour, we count how many routines are worked out and how many times “Search online” is tapped, with the country for products, the routine step and the product searched for. We record neither the account, nor the IP address, nor the questionnaire answers: these are overall figures that cannot be linked to anyone.
We don't do profiling, we don't do marketing, and we don't take automated decisions that produce legal or similar effects on you (Art. 22 GDPR). Your routine is worked out by handwritten, readable rules, without machine-learning systems: if you want to know why a product was suggested to you, the answer exists and we can give it to you.
The dataset used to recognise the products you type is a copy derived from Open Beauty Facts and is located on our servers: no data travels to that project. “Search online” opens a Google search that you carry out yourself (section 3.6): Google receives none of your data from us. Lucea does not currently use affiliate links.
The main database is located in the European Union. Cloudflare and Google may also process some data in the United States, and the encrypted backups (section 7) may be stored outside the European Union. Transfers take place on the basis of the European Commission's adequacy decision (EU-US Data Privacy Framework) and of the standard contractual clauses, as provided for by each provider's terms.
You have the rights provided for by Articles 15–22 of the GDPR: access, rectification, erasure, restriction, objection and portability. You can exercise some of them directly from the app: you can rename and delete each saved routine, and you can delete your account from your Profile, with immediate effect on the service (for backups, section 7 applies). For everything else — access to your data, portability, correcting your email address — write to info@lucea.app: we answer every request. You also have the right to lodge a complaint with the Garante per la protezione dei dati personali, or with the supervisory authority of the European Union country where you live or work.
The service is reserved for people aged 16 or over. We don't verify age: we rely on your declaration, both when you create an account and when you answer the questionnaire, where the age question cannot be skipped but you can answer “Prefer not to say” — and in that case you declare that you are an adult. We do not knowingly process data of people under 16; if we learn that an account was created by someone under 16, we delete it. In any case, the service is not aimed at children.
Lucea's suggestions are cosmetic in nature and do not constitute medical advice, a diagnosis or a treatment. For skin conditions, the right person to consult is always a professional (for example, a dermatologist).
We may update this page when we introduce new features. The current version, with its update date, is always published here; if you have an account, the app records which version you accepted.
This section complements the others, for those who use Lucea from the United States.