Privacy Policy
Last updated: September 23, 2026
1. Data Controller
Reverdin Studio — Corso Vittorio Emanuele II 154, 00186 Rome (Italy) — VAT number IT17458801002 — privacy@myhairboard.com
2. Data Collected
Hairboard collects the following data:
- Account: email address, username
- Photos: photos uploaded for hair simulation (AI vision processing, Claude model by Anthropic Inc.)
- Simulations: generated results and saved inspiration boards
- Subscription: subscribed plan, billing history (via Stripe)
- Analytics: anonymized usage data (via Umami, no personal identifier)
3. Legal Basis for Processing
- Performance of contract (GDPR art. 6.1.b): account creation, service provision, billing.
- Explicit consent (GDPR art. 9 — biometric data): the AI analysis of your photo constitutes processing of data that may be classified as biometric (facial morphology). This processing only occurs with your express consent, collected for each analysis.
- Legitimate interest (GDPR art. 6.1.f): fraud prevention, service security.
4. Retention Period
- Account data: duration of the active subscription, then 30 days after account deletion.
- Photos: not stored persistently — processed in memory at the time of analysis, then immediately deleted.
- Simulations and boards: retained as long as the account is active.
- Billing data: 10 years (statutory accounting obligation).
5. Subprocessors
| Subprocessor | Country | Purpose |
|---|---|---|
| Anthropic Inc. | USA | AI photo analysis (Claude Vision model) — DPA signed, SCC in place |
| Together AI | USA | Hair simulation generation — SCC in place |
| Stripe Inc. | USA | Payment processing — PCI DSS certified, SCC in place |
| Hetzner Online GmbH | Germany (EU) | Server hosting |
Transfers outside the EU to US-based providers are carried out on the basis of the Standard Contractual Clauses (SCC) approved by the European Commission.
6. Your Rights
In accordance with articles 15 to 22 of the GDPR, you have the following rights:
- Access (art. 15): export your data via the Export my data button in the application (endpoint
GET /auth/me/export). - Erasure (art. 17): delete your account and all your data via the Delete my account button in settings.
- Rectification (art. 16), portability (art. 20), objection (art. 21): contact privacy@myhairboard.com.
We respond to any request within a maximum of 30 days. The competent supervisory authority is the Garante per la protezione dei dati personali (Italy, www.gpdp.it), as Reverdin Studio is established in Rome. You also retain the right to lodge a complaint with the data protection authority of your country of residence, for example the CNIL (cnil.fr) for French residents.
7. Data Protection Officer (DPO)
Our DPO can be reached at: privacy@myhairboard.com
8. Cookies
For details on our use of cookies, see our cookie policy.
9. Governing Law
This policy is governed by Italian law, as Reverdin Studio is established in Italy. In the event of a dispute, the courts of Rome shall have exclusive jurisdiction, without prejudice to the mandatory consumer protection rights applicable in your country of residence.