Privacy policy

Privacy Policy


Last updated: June 2026


1. Data Controller

The personal data collected on this site is processed by:

SECRETS DE LOLY
Société par Actions Simplifiée (SAS)
56 rue Coriolis, 75012 Paris, France
SIRET: 749 848 842 00011
Email: contact@secretsdeloly.com


2. Data Collected and Purposes


2.1 Orders and customer account

When you place an order or create an account, we collect: last name, first name, postal address, email address, phone number and payment information. Bank details are processed directly by our payment providers (Shopify Payments, Klarna, Mollie and PayPal) — we do not store them.

This data is used to process your orders, manage your account and send you order confirmations and delivery information.


2.2 AI Hair Diagnostic

Our online hair diagnostic collects and processes the following data:

Photo(s) of your hair
Your photo is sent to an artificial intelligence analysis service (Anthropic, see section 4) to identify your hair type and generate your personalised diagnostic. Your photo is not retained: it is processed in memory for the duration of the analysis, then immediately deleted. It is not stored on our servers or in any database. The only exception is described below ("Reporting a problem with a diagnostic").

Hair quiz answers
Your answers to the quiz questions (hair type, concerns, treatment history, etc.) are used together with your photo to refine the diagnostic. This data is not retained beyond the session, except in the case of a report (see below).

Diagnostic results
Your hair type, the issues detected and the recommended product routine are associated with your profile if you provide your email.

Email and first name (if provided)
If you choose to receive your diagnostic and our communications by email, your first name and email address are stored and sent to Klaviyo (see section 4) to send you your personalised routine and, if you have consented, our tips and commercial offers.

Reporting a problem with a diagnostic (optional)
If the result of your diagnostic does not seem correct to you, you can report it to us using the feature provided for this purpose. In this case only, and subject to your explicit consent (dedicated checkbox), we retain your photo(s), your quiz answers and the message you send us, so that a member of our team can review them and improve the reliability of the diagnostic. This data is retained for a maximum of 30 days and then automatically deleted, and is hosted within the European Union. Without this consent, no photo or answer is retained. You may request its deletion at any time.


2.3 Marketing emails and newsletter

If you have ticked the corresponding consent box, we use your email to send you hair care tips, information about our products and promotional offers. You can unsubscribe at any time via the link included in every email.


2.4 Product reviews

Reviews published on the site are associated with a nickname. Your email address is never displayed publicly. Each review is moderated before publication.


2.5 Browsing and cookies

We use cookies and audience measurement tools to analyse site traffic and improve your experience. For more details, see section 7.


3. Legal Bases for Processing

  • AI analysis of your photo: explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR)
  • Human review of a reported diagnostic: explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR)
  • Order and payment processing: performance of a contract (Art. 6(1)(b))
  • Customer account management: performance of a contract (Art. 6(1)(b))
  • Sending the diagnostic by email: consent (Art. 6(1)(a))
  • Marketing emails: consent (Art. 6(1)(a))
  • Audience measurement and targeted advertising: consent (Art. 6(1)(a)); anonymised audience measurement: legitimate interest (Art. 6(1)(f))
  • Accounting obligations: legal obligation (Art. 6(1)(c))

You may withdraw your consent at any time, without affecting the lawfulness of processing carried out before that withdrawal.


4. Subprocessors and Transfers Outside the European Union

We use the following subprocessors to operate our services:

  • Shopify — online store hosting and payments via Shopify Payments (Canada / United States)
  • Klarna — payment solution (Sweden — European Union)
  • Mollie — payment solution (Netherlands — European Union)
  • PayPal — payment solution (Luxembourg — European Union / United States)
  • Anthropic — AI analysis of hair diagnostic photos (United States)
  • Klaviyo — sending marketing and transactional emails (United States)
  • Railway — hosting of the diagnostic backend, including temporarily retained reports (European Union — Netherlands)

We also use advertising partners (Meta, Google Ads, TikTok and the Awin affiliate network) for the delivery and measurement of our campaigns — see section 7.

Shopify, Anthropic and Klaviyo are established in the United States, and PayPal transfers some data there. These transfers of data outside the European Union are governed by Standard Contractual Clauses (SCCs) approved by the European Commission, in accordance with Article 46 of the GDPR. Each of these subprocessors has concluded a data processing agreement (DPA) with us.

Data resulting from a diagnostic report (see section 2.2) is hosted by Railway within the European Union (Netherlands) and is not transferred outside the EU. Its review is carried out internally by our team; it is not shared with any third party.


5. Retention Periods

  • Diagnostic photo: not retained (deleted immediately after analysis)
  • Quiz answers: duration of the session only
  • Reported diagnostic problem (photo, quiz answers, message): maximum 30 days, then automatically deleted
  • Order data: 10 years (legal accounting obligation)
  • Customer account: duration of the commercial relationship + 3 years after the last activity
  • Email and hair profile: until unsubscription or deletion request
  • Browsing data / cookies: maximum 13 months

6. Your Rights

In accordance with the GDPR, you have the following rights over your personal data:

  • Right of access: obtain a copy of the data we hold about you
  • Right to rectification: correct inaccurate or incomplete data
  • Right to erasure: request the deletion of your data ("right to be forgotten")
  • Right to portability: receive your data in a structured, machine-readable format
  • Right to object: object to processing based on our legitimate interest or for direct marketing purposes
  • Right to restriction: request the temporary suspension of a processing operation
  • Right to withdraw consent: withdraw your consent at any time, without retroactive effect

To exercise your rights, contact us by email at contact@secretsdeloly.com, specifying your request. We undertake to respond within one month.

If you consider that the processing of your data does not comply with regulations, you may lodge a complaint with the CNIL (the French data protection authority) — 3 Place de Fontenoy, 75007 Paris — www.cnil.fr.


7. Cookies

We use cookies on our site. A cookie is a small file placed on your browser that allows us to remember your preferences and analyse the use of the site.

Essential cookies (no consent required)
Necessary for the site to function: cart management, login session, security.

Analytics cookies (with your consent)
We use Google Analytics 4 to measure site traffic and understand how our visitors use it. This data is anonymised.

Marketing and advertising cookies (with your consent)
Used to offer you relevant advertising on other sites and measure the effectiveness of our advertising and affiliate campaigns (Meta, Google Ads, TikTok and the Awin affiliate network).

You can manage your cookie preferences at any time via the cookie management banner on the site.


8. Security

We implement appropriate technical and organisational measures to protect your data against any unauthorised access, loss or disclosure: encrypted connections (HTTPS), hashing of identifiers in our system logs, access control to production data.


9. Changes to This Policy

We may update this privacy policy to reflect legal developments or changes to our services. The date of the last update is shown at the top of this page. In the event of a significant change, we will notify you by email if you have an account with us.


10. Contact

For any question relating to your personal data:
SECRETS DE LOLY — contact@secretsdeloly.com