Note: In case of discrepancy, the French version of this document is legally binding.

Privacy Policy

Last updated: 25 August 2026 (Amplitude analytics)

Capiria is committed to protecting your personal data. This policy explains what information we collect, why, how we use it and what your rights are.

Data controller: Capiria (sole proprietor), 22 allee des minotiers, 49080 Bouchemaine, France — privacy@capiria.com

1. Data we collect

When you use Capiria, we may collect:

We do not use advertising cookies or retargeting. Audience measurement is provided by Amplitude (European instance); details of data collected are in section 7.

2. Purposes of processing

We use your data to:

• Create and manage your user account
• Analyse the shape of your face and generate hairstyle recommendations
• Produce try-on previews and barber briefs
• Process your payments and manage your Looks credits
• Respond to your support requests
• Comply with our legal obligations (including accounting)
• Measure service usage, understand where users drop off and improve the product (Amplitude analytics)
• Provide customer support via online chat (Crisp)

3. Photo processing

Your selfie is analysed by specialised artificial intelligence providers, hosted outside the European Union, and stored securely on Supabase Storage.

• Purpose: generate hairstyle recommendations, personalised barber briefs and try-on previews on your photo.
• AI providers: Anthropic (Claude) for morphological analysis and barber brief drafting; fal.ai for try-on image generation. These providers process your face photos as subprocessors.
• Legal basis: performance of the contract (provision of the service) and, where applicable, your explicit consent upon upload.
• Transfer outside the EU: data is transferred to the United States. These transfers are governed by the European Commission's standard contractual clauses and/or the EU-US Data Privacy Framework where applicable.
• Retention: the photo is retained while your account is active, to view your reports and use the test room. You may request deletion at privacy@capiria.com.

By uploading a photo, you confirm:

1. That you are the person depicted in the photo, or have obtained the explicit consent of the person depicted
2. That you accept processing of this photo for the generation of hairstyle recommendations, including by the AI providers mentioned above

4. Subprocessors and partners

Each subprocessor is selected for compliance with security and data protection requirements. A data processing agreement (DPA) is in place or required with each subprocessor.

5. Retention period

6. Deleting your account

You can delete your account directly from the application via the account deletion button. Deletion is immediate: your account data is erased without a retention period.

For any additional request: privacy@capiria.com

7. Cookies, local storage and audience measurement

7.1 Strictly necessary cookies

Capiria uses cookies strictly necessary for the service to function (Supabase authentication session, preferences). We do not use advertising cookies or retargeting.

7.2 Amplitude — audience measurement and product improvement

We use Amplitude (European instance api.eu.amplitude.com) to understand how the site is used and where the sign-up journey blocks. Amplitude is loaded on public and app pages (home, sign-in, onboarding, dashboard).

What Amplitude collects automatically:

• Pages visited, URL, referrer and UTM parameters (<code>utm_source</code>, etc.)
• Browser, system, device type, screen resolution, language
• Anonymous identifier stored in localStorage (no analytics cookie)
• On the homepage only: button clicks (button label)

What we send explicitly (product events):

• Journey steps (step number and name, without quiz answer content)
• Sign-up / sign-in success or failure (method used, error codes — never the password or email entered)
• Successful or failed selfie upload (file type and size — never the image)
• Report generation and display (face shape, name and score of recommended hairstyle — not the full brief)
• Paywall and payment interactions (plan chosen, Looks balance, checkout steps)
• On sign-in: only the Supabase account identifier, which is pseudonymous, to link the anonymous journey to the account. Your email address is not sent to Amplitude.

We do not record sessions. Screen recording (« session replay ») is disabled : no capture of your mouse movements, clicks or screen is performed.

What Amplitude does not receive: your email address, the selfie, detailed questionnaire answers (hair type, age, first name, etc.), error message content containing an email, card payment data.

Legal basis: legitimate interest (service improvement and audience measurement). Audience measurement is not loaded when the browser's « Do Not Track » signal is enabled.

7.3 Crisp — online support

The Crisp chat may collect messages you send us and, if you are signed in, the email address associated with your account. Crisp is not loaded on the sign-in page.

7.4 Your choices

You can refuse audience measurement at any time, in three ways:

• from Settings → Audience measurement in your signed-in space, in one click;
• by enabling «&nbsp;Do Not Track&nbsp;» (DNT) in your browser, which we respect;
• by writing to us at privacy@capiria.com to request erasure of your analytics data.

Refusal has no effect on your access to the service. Refusing strictly necessary cookies, however, may prevent sign-in.

Retention period : audience measurement data is retained for a maximum of 13 months.

8. Your rights (GDPR)

Under the General Data Protection Regulation, you have the following rights:

• Access — obtain a copy of your data
• Rectification — correct inaccurate data
• Erasure — request deletion of your data
• Restriction — restrict processing in certain cases
• Objection — object to certain processing
• Portability — receive your data in a structured format
• Withdrawal of consent — for processing based on consent (e.g. photo / AI)

To exercise your rights: privacy@capiria.com. We respond within one month.

If you encounter difficulties, you may lodge a complaint with the CNIL: cnil.fr

9. Security

We implement appropriate technical and organisational measures: password hashing, encryption of communications (HTTPS), restricted data access, secure hosting.

No method of transmission over the Internet is completely secure. We cannot guarantee absolute security, but we continuously work to strengthen our protections.

10. Minors

Capiria does not knowingly collect data from minors without the consent of a parent or legal guardian. If you are a parent and find that your child has sent us data, contact us at privacy@capiria.com.

11. Changes

We may update this policy. The last update date appears at the top of the page. In case of material changes, we will notify you by email or via the application.

12. Contact

Personal data: privacy@capiria.com
General support: contact@capiria.com