0. Preamble
This policy describes how Adermio (publisher: Antoine Munch, SIRET 999 319 692 00011) collects, uses, protects and shares the personal data of users of the adermio.com website and the Adermio mobile app, in accordance with the GDPR (EU Regulation 2016/679) and the French Data Protection Act (Loi Informatique et Libertés).
1. Data controller
Antoine Munch (sole proprietor — micro-enterprise)
SIRET 999 319 692 00011
67120 Ergersheim, France
Email: contact@adermio.com
Phone: +33 6 22 30 17 31
The data controller also acts as the GDPR point of contact. To exercise your rights: contact@adermio.com — subject line "GDPR".
2. Data we collect
Data you provide directly:
- Identity: first name (optional), last name (optional), age, sex
- Contact details: email address
- Authentication: hashed password (never accessible in plain text) or Apple/Google OAuth credentials
- Skin health: skin type, concerns, allergies, ongoing treatments, pregnancy/breastfeeding, facial photos
- Dietary health: meal photos, food diary, intolerances (if you use the Nutrition tab)
- Skincare routine: products used (brands, references), frequency of use
- Preferences: language, time zone, notification preferences
- Feedback: questionnaire answers, messages to the derm chat, reports
Data collected automatically:
- Technical data: device model, OS version, app version, language, iOS IDFV
- Usage data: pages viewed, features used, sequence of actions (PostHog)
- Performance data: crashes, errors, latency (Sentry)
- IP address: temporary, not stored outside technical logs
- Session identifiers: encrypted tokens (iOS Keychain)
- Push token: Expo identifier used to deliver notifications
Data collected by payment providers: payment card data is processed exclusively by Apple. Adermio never receives your payment details — only an anonymous transaction identifier, the subscription status, the product purchased and the purchase date.
3. Purposes and legal bases
| Purpose | Legal basis | Health-data basis |
|---|---|---|
| Creating and managing your account | Art. 6.1.b — Performance of the contract | — |
| AI-powered skin analysis | Art. 6.1.b — Performance of the contract | Art. 9.2.a — Explicit consent |
| Routine personalization + recommendations | Art. 6.1.b — Performance of the contract | Art. 9.2.a |
| Useful notifications | Art. 6.1.a — Consent | — |
| Premium subscription management | Art. 6.1.b — Performance of the contract | — |
| Improving the app (anonymous product analytics) | Art. 6.1.f — Legitimate interest | — |
| Detecting and fixing bugs | Art. 6.1.f — Legitimate interest | — |
| Accounting obligations | Art. 6.1.c — Legal obligation | — |
No advertising use. Adermio does not engage in ad targeting, does not sell your data, and does not send marketing communications without your explicit consent.
Analysis and retention of your photos. Your photos are analyzed by an artificial intelligence model operated by Google (API Gemini), acting as a processor on behalf of Adermio, for the sole purpose of generating your skin analysis and recommendations. They are stored securely within the European Union (Supabase, Frankfurt) and retained for as long as your account is active, to allow the service to function (history, tracking, comparisons). They are deleted immediately and permanently when you delete your account. Photos from a scan that is never linked to an account are automatically deleted within 7 days.
On-device face detection. Scan framing (distance, lighting, stability) relies on face detection performed locally on your device. This facial geometry data is ephemeral: it is never stored, never transmitted to our servers, and does not constitute a biometric identification template.
No AI training. Your photos and your data are never used to train artificial intelligence models — neither ours nor those of our processors, who are contractually bound to this commitment. Any future change for such a purpose would be subject to a prior, explicit consent request, in accordance with Articles 6 and 9 of the GDPR, with the option to withdraw consent at any time.
4. Processors and recipients
Adermio relies on the following processors, in accordance with Article 28 of the GDPR:
| Processor | Role | Location | Transfer |
|---|---|---|---|
| Supabase Inc. | Database, auth, storage, edge fns | Frankfurt (EU) | No transfer outside the EU |
| Sentry GmbH | Error monitoring | Germany (EU) | No transfer outside the EU |
| PostHog Inc. (EU) | Product analytics | Frankfurt (EU) | No transfer outside the EU |
| Apple Inc. | App Store, IAP, Sign in with Apple, push | USA + multi-region | EU-US DPF |
| RevenueCat Inc. | IAP subscription management | USA | DPF |
| Google LLC | API Gemini — AI analysis of skin photos and profile data (skin analyses, routines, food analyses). No model training on your data | USA | DPF |
| Amazon Web Services | Temporary storage of photos from scans performed on the adermio.com website (deleted within 7 days) — not used by the mobile app | Paris (EU) | No transfer outside the EU |
| Vercel Inc. | Hosting of adermio.com | Multi-region | DPF |
| Expo Inc. | Push notifications | USA | DPF |
| n8n (self-hosted) | Orchestration of AI analyses (photo processing, report generation) | Germany (EU) | — |
Processors based in the United States are covered either by a European adequacy decision (EU-US Data Privacy Framework) or by Standard Contractual Clauses. Verifiable at dataprivacyframework.gov.
Equivalent protection guaranteed. Every processor — including Google (Gemini API), to which your photos and skin data are sent for analysis — is bound by a data processing agreement (Article 28 GDPR) requiring it to protect your data with a level of security and confidentiality equivalent to that guaranteed by Adermio, to process it only on our documented instructions, and never to reuse it for its own purposes (in particular, no AI-model training).
No commercial third parties. Adermio does not share your data with data brokers, marketing partners, or advertising networks.
5. Retention periods
| Category | Retention period |
|---|---|
| Active account (email, profile) | For as long as the account is active |
| Skin photos (analysis and tracking) | For as long as the account is active — deleted immediately and permanently with the account |
| Photos from a scan never linked to an account | 7 days (automatic deletion) |
| Skin analyses, routines, AI reports | For as long as the account is active |
| Daily tracking (mood, skin, diet) | For as long as the account is active |
| Sentry logs | 90 days |
| PostHog analytics | 12 months |
| Supabase authentication | Active account + 30 days after deletion |
| Invoices and accounting records | 10 years (Art. L123-22 C. com. — French Commercial Code) |
6. Data security
- Encryption in transit: TLS 1.3 enforced on all endpoints
- Encryption at rest: AES-256 (Supabase), encrypted iOS Keychain
- Authentication: OAuth 2.0 PKCE, bcrypt + HaveIBeenPwned
- Access control: PostgreSQL Row-Level Security on all sensitive tables
- Monitoring: real-time alerts via Sentry
- Backups: daily encrypted Supabase backups (7 days)
In the event of a data breach likely to result in a risk to rights and freedoms, Adermio will notify the CNIL (the French data protection authority) within 72 hours (Art. 33 GDPR) and, where applicable, inform the affected users (Art. 34).
7. Your rights
| Right | Description | How to exercise it |
|---|---|---|
| Access (Art. 15) | Obtain a copy of your data | Settings → "Export my data" (complete JSON) |
| Rectification (Art. 16) | Correct inaccurate data | Edit in your profile, or by email |
| Erasure (Art. 17) | Delete account + data | Settings → "Delete my account" (immediate) |
| Restriction (Art. 18) | Temporarily suspend processing | Request by email |
| Portability (Art. 20) | Reusable format | The JSON export fulfils this obligation |
| Objection (Art. 21) | Object to processing (legitimate interest) | Request by email with grounds |
| Withdrawal of consent (Art. 7.3) | Withdraw consent previously given | Settings → disable notifications, or email |
Response time: Adermio undertakes to respond within one month of the request, extendable by 2 months in complex cases (with notification of the extension).
Complaints to the CNIL: in the event of non-compliance, you may lodge a complaint with the CNIL — 3 Place de Fontenoy, 75007 Paris — www.cnil.fr.
8. Cookies and trackers
Mobile app: no cookies. Local storage on the device: Supabase session token (encrypted iOS Keychain), React Query cache (encrypted MMKV), anonymous PostHog identifier.
Website: strictly necessary cookies only (session, language). If analytics or marketing cookies are added in the future, a consent banner compliant with CNIL deliberation No. 2020-091 will be put in place.
9. Minors
The Adermio app is intended for people aged 16 and over (Art. 8 GDPR, the age of digital consent in France). If you are under 16, you must not use the app without the prior explicit consent of a holder of parental authority. If Adermio discovers that an account belongs to a minor without parental consent, the account will be deleted.
10. Changes to this policy
Adermio reserves the right to amend this policy at any time. Any material change will be notified by email and via an in-app banner at least 15 days before it takes effect.
The version history is maintained in Adermio's public code repository.