Privacy Policy

We Respect and Protect Your Privacy

Your privacy matters to us. This Privacy Policy explains how we collect, use, and protect your personal information when you use our mobile app, visit our websites or purchase our products.

It covers the Analiza Kolorystyczna mobile app and the websites analizakolorystyczna.app, colour-analysis.co.uk, farbanalyse-online.de, colorimetrie-en-ligne.fr, armocromia-online.it, kleuranalyseonline.nl, barevna-typologie-test.cz, colorimetria-online.com and varianalyysi-netissa.fi, all operated by MYMOBI Roman Barzyczak.

Last updated: 30 October 2026.

Data controller and seller details

The data controller and seller is MYMOBI Roman Barzyczak.

Business and correspondence address: ul. Jana Dekerta 2B lok. 3, 30-703 Kraków, Poland.

Polish tax identification number (NIP): 5521676665.

Polish business statistical register number (REGON): 360911062.

Email: contact@analizakolorystyczna.app. You can also use our existing address, analizakolorystycznaonline@gmail.com.

For order complaints, see the customer complaints procedure in our Terms and Conditions (in Polish). Our refund policy (in Polish) explains withdrawals and payment refunds. See also our company information.

What You Should Know

Information We Collect

When you use our website, we may collect the following information:

• Personal details such as your name, email address, phone number, and shipping address when you make a purchase or sign up for updates.
• Payment information processed securely through trusted third-party providers.
• Technical data such as your IP address, browser type, device information, and website usage patterns.
• When you contact support in the mobile app, the reply email, request message, limited app diagnostics, and an optional image that you deliberately attach.
• Your rating of the analysis result and your comment, if you leave them in the app.
• The year of birth entered in the app, used only to confirm you are an adult; it is kept with your account until the account is deleted. Only a ten-year age band (for example 35–44), never the year itself, enters pseudonymous statistics on how people move through the app, kept for up to 400 days like the other pseudonymous app events.

How We Use Your Information

We use your information to:

• Process and deliver your orders.
• Communicate with you regarding your purchases, updates, or promotions.
• Improve our website, products, and customer experience.
• Comply with legal and regulatory requirements.
• Respond to customer-support requests and diagnose the specific app problem you report.
• Review your feedback on an analysis result, check whether the analysis was correct, and improve the accuracy of our analysis system (legitimate interest, Art. 6(1)(f) GDPR).
• Confirm that app users are adults, and measure in pseudonymous statistics at which step users in each age band stop using the app (legitimate interest, Art. 6(1)(f) GDPR).

Purposes and Legal Bases

• Providing the analysis, the app and the products you order, including your account, sign-in emails and customer support: performance of a contract (Art. 6(1)(b) GDPR).
• Accounting and tax records: legal obligation (Art. 6(1)(c) GDPR).
• Website analytics, session replay and A/B tests: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
• Visualizations of your face: your explicit consent given in the app (see Face Data below).
• Marketing emails and ad measurement: your consent (Art. 6(1)(a) GDPR).
• Attributing app installs and in-app purchases to our ad campaigns (the data sent to Meta is listed in the recipients table): our legitimate interest (Art. 6(1)(f) GDPR).
• Reviewing feedback on a result, confirming that app users are adults, pseudonymous app statistics, error diagnostics and security: our legitimate interest in providing a correct, safe and working service (Art. 6(1)(f) GDPR). You can object to this processing.

Providing your photo is needed for the analysis, and providing your email address is needed to deliver a paid product or keep an account; without them we cannot provide these services.

Your Photos

Photos you upload are used solely to prepare your color analysis, in the mobile app your visualizations (hair-color, outfit, and makeup previews), and — if you leave feedback on your result — for our team to review that feedback.

Your color type is determined automatically by our own classifier, running on our own servers. For the paid online analysis, a member of our team also reviews the result. Visualizations are computer-generated from your photo and are labeled as such.

We use the Google Gemini API to generate visualizations. Under the terms of that service, submitted data is not used by Google to improve its models.

Automated Results

The color type you receive is produced automatically. It is not a decision that has legal or similarly significant effects on you within the meaning of Art. 22 GDPR. You can contest the result or ask for a review by a person using the contact details below.

A photo submitted for the online analysis is stored for the duration of the service and deleted on request. In the mobile app your photo remains stored while you use your account — it is what your visualizations are generated from. It is deleted on request and when your account is deleted. Anonymous, unfinished analyses are deleted automatically after 3 days, or after 14 days if you left feedback on the result.

Feedback on Your Result

After an analysis in the app you can rate the result and add a comment. To review it, a member of our team may look at your photo, your questionnaire answers, and the result, and check whether the analysis was correct.

Together with your feedback we keep the analysis data needed to judge whether it was correct: your questionnaire answers, the result, and the measurement parameters from our analysis system. The photo is not part of this data. We use this data only to check and improve the accuracy of our own analysis; we do not share it with third parties or use it to train other companies’ models.

We keep your feedback and this data for 180 days. You can object to this use or ask us to delete your feedback at any time using the contact details below.

Face Data

The photo you upload shows your face. We do not create biometric templates or faceprints from it, we do not perform facial recognition, and we do not use the photo to identify people, so we do not process it as biometric data for identification (Art. 9 GDPR). Visualizations of your face are created only with your explicit consent (Art. 6(1)(a) GDPR and, to the extent your image could reveal special categories of data, Art. 9(2)(a) GDPR).

When you take a selfie in the app, face detection runs entirely on your device — it is used only to frame the shot and trigger the automatic capture. The detection output is never stored or transmitted anywhere.

Visualizations showing your face (hair-color, makeup, and outfit previews) are generated only after your explicit consent given in the app. You can withdraw that consent in the app at any time — from that moment we generate no new visualizations of your face and delete the stored daily visualizations, including looks you saved; any remaining short-lived copies expire automatically within days. The preview generated together with your analysis result, and the sample images of your Full Report preview (if you were shown your own preview), remain stored with your analysis and are removed when the analysis or the account is deleted. Visualizations are visible only to you; they are never shared with anyone or published.

Generated visualizations are stored short-term — from 24 hours up to 30 days depending on their type. Looks you deliberately save, and the preview generated together with your analysis result, remain stored with your account — until you remove them or delete the account. Deleting your account (in the app, or by asking us) removes your photo and your visualizations.

Adults Only

Our services are intended for adults (18+). The app asks for your year of birth to confirm this. We do not knowingly process data of children; if you believe we have, contact us and we will delete it.

Mobile Support Data

With diagnostics enabled, a support request may include the app/build version, operating system, language, account tier, selected palette, originating screen, and a safe error code. You can turn diagnostics off before sending. We never attach your analysis photo, password, login token, full logs, or payment credentials automatically.

An optional support image is stored privately and removed from active systems after 30 days. Identifiable support messages, reply addresses, and diagnostics are retained for 12 months and then deleted or anonymized. The private image is not posted to the team’s chat system or attached permanently to support email.

Sharing Your Information

We respect your privacy and will never sell or rent your personal information. We share personal data only with the service providers below, only what each needs, and only for the purpose stated. They process it on our behalf under data-processing terms, except where a provider is marked as acting on its own account.

Provider	What it receives	Purpose	Where it processes data
Railway Corporation (USA)	All service data: photos, questionnaire answers, email address, results, visualizations, purchases, support requests	Hosting of our servers and database	Our servers and database: the Netherlands (EU). Our administration panel and one internal analysis tool currently run in Railway’s US region (USA), so data viewed through them passes through the USA. Railway’s company operations are in the USA
Google (Gemini API)	Your photo and, for some steps, your questionnaire answers; never your email address	Generating visualizations; photo preparation and quality checks	Any country where Google or its sub-processors have facilities (Google does not fix a location for this service)
OpenAI	Your photo and an editing instruction, only if Google’s service fails twice for a hair-color visualization; your photo and questionnaire answers when our team re-checks an analysis with an internal tool (never your email address)	Backup for hair-color visualizations; internal quality checks	USA
Anthropic	Your first name and a description of your coloring and color preferences (no photo, no email address); your photo and questionnaire answers when our team re-checks an analysis with an internal tool (never your email address)	Writing the personalized text of the Full Report; translating it into your language; internal quality checks	Processing may take place in any country where Anthropic operates; stored data in the USA
Google (Firebase Cloud Messaging, Firebase Analytics, Crashlytics)	Push token and notification content; app usage events with a one-way hashed identifier derived from your email address (app versions before 1.1.23 sent the email address itself); crash reports	Push notifications, app analytics, crash diagnostics	Any country where Google has facilities
RevenueCat, Inc.	Your email address as the purchase account identifier, purchase records	Managing in-app purchases	USA
Apple (App Store), Google (Google Play)	Purchase and payment data	In-app purchases; they act on their own account	Per Apple’s and Google’s own policies
Stripe	Email address, purchase and payment data, campaign identifiers	Website payments (not offered in every country); Stripe also acts on its own account for fraud prevention	Ireland and the USA
Functional Software, Inc. (Sentry)	Error reports, which may contain your email address	Diagnosing errors	Germany (EU); account metadata in the USA
Zoho Corporation B.V. (ZeptoMail)	Email address and the content of service emails (sign-in links, results, support replies)	Sending service emails	EU (Zoho’s EU data center)
Twilio (SendGrid)	Email address, name, email content	Sending marketing emails you agreed to	USA
Google Ireland Limited (Gmail)	Email address, name, email content	Sending paid-analysis emails; Google processes these emails under its own terms for Gmail	Any country where Google has facilities
Slack Technologies (Salesforce)	Your email address with order notifications, and the text of feedback you send in the app	Internal notifications to our team	USA
Google (Analytics 4, Tag Manager, Ads)	Browser identifiers, page and conversion events, ad-click identifiers; no email address	Consent-controlled measurement and ad conversion measurement; Google acts on its own account for Ads	Any country where Google has facilities
Microsoft Ireland (Clarity)	Behavior on the website, with forms masked	Consent-controlled behavior analytics and session replay	Microsoft Azure (country not stated by Microsoft)
Meta Platforms Ireland	Website: a hashed (one-way encrypted) email address, browser identifiers and page events (e.g. which step of the analysis form you reached, never your answers), only with separate marketing consent. App: a digest (hash) of the installation identifier, the install data passed on by Google Play (the install referrer, including the ad click identifier), the Android advertising ID (which you can reset or delete in your phone settings; we never link it to your account or e-mail address, and the install data and the ID are deleted at the latest 90 days after the last app launch), the app and operating-system version, on Android at the first launch also the IP address and the HTTP client identifier, and on an in-app purchase a hashed email address	Ad measurement and attributing app installs and in-app purchases to campaigns (our legitimate interest, Art. 6(1)(f) GDPR); for the Meta Pixel we are joint controllers with Meta (Art. 26 GDPR), as set out in Meta’s Controller Addendum	USA
Google (YouTube)	IP address and browser data when the app demo video on our app page loads	Showing the demo video	Any country where Google has facilities

International Transfers

We are based in Poland, and the app’s primary data storage is in the Netherlands (EU). Some providers listed above may process personal data outside the European Economic Area. The applicable transfer mechanism depends on the recipient and destination. Transfers to a U.S. organisation covered by an active EU-U.S. Data Privacy Framework certification may rely on the European Commission’s adequacy decision. Other transfers require an applicable safeguard, such as the European Commission’s Standard Contractual Clauses where they form part of the relevant agreement. Contact us using the details below to ask about the mechanism and safeguards for a specific provider or transfer, or to request a copy of the applicable safeguards.

How Long We Keep Data

• Accounting records: up to 5 years.
• Email address: until the contract is fulfilled or you withdraw marketing consent.
• Photos for the online analysis: for the duration of the service; deleted on request.
• Your photo in the mobile app: until you delete your account or ask us to delete it. Anonymous, unfinished analyses: 3 days, or 14 days if you left feedback on the result.
• Feedback on a result, with the analysis data needed to judge whether it was correct (without the photo): 180 days.
• Year of birth: until the account is deleted. The ten-year age band in pseudonymous app statistics, like other pseudonymous app events: up to 400 days.
• Generated visualizations: from 24 hours to 30 days depending on their type; looks you save and the preview generated with your result: until you remove them or delete the account.
• Optional support attachments: 30 days in active systems. Support messages, reply address and diagnostics: 12 months, then deleted or anonymized.
• Business inquiries sent through our form for companies: 90 days.
• Your privacy choice in the browser: up to 12 months. The ca_ga4_bridge cookie: up to 60 seconds, only after analytics consent. Microsoft Clarity recordings: up to 30 days under the provider’s rules.

Data Protection

We take appropriate security measures to protect your personal data from unauthorized access, alteration, or disclosure.

Cookies

We store your privacy choice for up to 12 months. Microsoft Clarity session recordings are retained for up to 30 days under the provider’s service rules; aggregated analytics may be retained according to each provider’s configured settings and policies.

You can change or withdraw consent at any time through Privacy settings in the website footer. It does not affect processing that occurred lawfully before withdrawal.

Analytics and Session Replay

Google Analytics 4 helps us measure traffic sources, page usage, and funnel performance. When analytics consent is denied, Google Consent Mode does not read or write analytics cookies; Google may receive a limited cookieless technical signal for aggregated measurement. See Google Analytics data safeguards and the Google Privacy Policy.

After analytics consent, a first-party cookie named ca_ga4_bridge may hold the existing Google Analytics browser and session identifiers for up to 60 seconds. It connects an app-store link click to the website visit that preceded it. Those identifiers are not included in the App Store or Google Play URL. Withdrawing analytics consent deletes this short-lived cookie and stops this measurement.

We may test two versions of the app offer after the Polish homepage quiz. Participation requires analytics consent. The existing Google Analytics browser identifier determines a consistent variant; we do not create a separate participant identifier or store quiz answers or results for this test. Google Analytics receives the variant and offer-view/click events. Store links carry only the shared campaign label for that variant. Withdrawing consent stops participation and future test events.

After analytics consent, Microsoft Clarity may capture clicks, scrolling, pointer movements, heatmaps, and a replay of the session. Form fields and sensitive mini-quiz and analysis-form regions are masked. We do not send mini-quiz answers, color-season results, photos, or email addresses to Clarity. See Microsoft Clarity cookies and the Microsoft Privacy Statement.

Your Rights

You have the right to:

• Access your personal data and receive a copy of it.
• Have inaccurate data corrected.
• Have your data deleted. In the app you can delete your account yourself (Settings).
• Restrict processing.
• Data portability.
• Object to processing based on our legitimate interest.
• Withdraw any consent at any time, without affecting processing carried out before the withdrawal; opt out of marketing communications at any time.
• Lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl, or with the data protection authority in the country where you live.

Contact Us

If you have any questions about this Privacy Policy or how your information is handled, please contact us at: contact@analizakolorystyczna.app