Personal account privacy

The data controller is Cabina di Zanre Arouna, VAT number IT03151380353. For any question, or to exercise your rights, you can write to privacy@cabina.io.

For the personal account we decide the purposes and means of processing: we are the controller. For site visitors, stores and the try-on widget installed on a store's website, the general privacy policy applies instead.

• Email sign-in: your email address, to which we send the sign-in link.
• Google or Facebook sign-in: from the provider you choose we receive your email address, name and profile picture. They stay in the account's authentication data; for the service we only use the email. We never receive your password or your contacts.
• Profile: the site language, the date you confirmed you are at least 16, your credits and the account creation date.
• Try-on log: for each try-on made from your account, the date, the outcome and whether it was one of the month's 5 free ones. It is used to count free try-ons and credits; it contains no photos.
• Session: to keep you signed in, your browser stores (localStorage) the session tokens and a note that you ticked the 16+ box. These are not tracking cookies.

For try-ons made from your account, photos and measurements follow the try-on rules described in section 6 of the general privacy policy: we don't keep the photo, and the generated image is deleted after 7 days.

• Providing the account and try-ons (sign-in, counting free try-ons and credits): performance of a contract, Art. 6(1)(b) GDPR.
• Security (request limits, providers' technical logs): legitimate interest, Art. 6(1)(f) GDPR.

We do no profiling or advertising, we don't sell or share your data, and we send no newsletters: the only emails are the ones you request to sign in.

The personal account is for people aged 16 or over, the age set by the GDPR (Art. 8) in the strictest European countries. We ask you to confirm it with a checkbox; without confirmation the account cannot make try-ons. If we find out an account belongs to someone younger, we delete it.

• Supabase — account database and authentication, on servers in the European Union (Ireland).
• Vercel — hosting of the site and of the service that answers the account.
• Resend — sending the emails with the sign-in link.
• Google and Meta (Facebook) — only if you choose to sign in with them; for their sign-in they act as independent controllers, under their own privacy policies.

Some providers also process data outside the European Union, in particular in the United States: the transfer relies on the European Commission's standard contractual clauses (Chapter V GDPR).

As long as you keep the account. When you delete it we immediately delete the account, profile and try-on log; database backups roll over and the data disappears from them too within 7 days. Providers' technical logs are short-lived.

• Yourself: sign in, open My account and press “Delete permanently”. Deletion is immediate.
• By email: write to privacy@cabina.io from the account's address: we delete it within 30 days and confirm it to you.

Removing Cabina from the apps connected to your Google or Facebook account only stops sign-in with that provider: to delete your data, use one of the two ways above.

You can ask us at any time to give you access to your data, to correct it, erase it, restrict its processing, to receive it in a readable format (portability) and to object to the processing. Where processing is based on consent, you can withdraw it whenever you like, without affecting what was done before the withdrawal.

Write to privacy@cabina.io: we reply within one month. If you believe the processing infringes the Regulation, you have the right to lodge a complaint with the Italian Data Protection Authority or with the supervisory authority of your country.

If the way we handle data changes, we update this page and the date at the top. When the change is substantial — a new provider that processes images, for instance — we flag it in the product too, not only here.