Privacy Policy

1.Who this policy covers

This policy applies to everyone who uses PassionByBeauty. You do not need an account to browse, search or compare — anonymous browsing is open. Signing in unlocks the parts of the platform that need to remember you: saved products, saved comparisons and your Beauty Profile.

We are built for Europe, with the Netherlands as our home market, and our launch currency is the euro.

Because every purchase happens on an external seller's own website, we never collect payment card numbers, billing addresses or delivery addresses. Anything you enter once you have clicked through to a seller is handled by that seller under their own privacy policy, not ours.

2.Information you give us when you create an account

If you create an account, we store the details needed to run it:

• Your email address, and whether and when it was verified
• Your password — stored only as an argon2id hash. We cannot read it, recover it or show it to you
• The type of account and how you signed up
• Your display name, if you set one
• Your chosen language, country and region
• Whether you have given marketing consent, and when
• Cookie consent fields on your account record — these exist in our database, but we do not currently show a cookie banner, so for most accounts they are simply unset
• Whether two-factor authentication is switched on, and when it was enabled
• Whether the account is active or deactivated, when it was created and last updated, and when you last signed in

3.Your Beauty Profile (optional)

The Beauty Profile is entirely optional and entirely filled in by you. It can hold your skin type, skin concerns, category preferences, allergies, ingredients you want to avoid, and your sensitivity preferences. You can leave it empty, change it, or clear it.

Some of what you might enter here — allergies and skin concerns in particular — is health-related, so please add only what you are comfortable sharing. We use it for one purpose: to personalise the highlights you see in comparisons and to flag ingredients you have told us to watch for.

These highlights and ingredient alerts are informational only. They are not medical advice and are not a safety assessment of any product for you personally.

4.What we record as you use the platform

Alongside your account, we keep records of the things the platform has to remember in order to work:

• Saved products, saved comparisons and your comparison history
• Reviews you submit — written reviews with a score from 0 to 100, plus any photos or videos you attach. Review photos and videos are stored on our own server. All reviews are moderated before they are published, and published reviews are visible to other people
• Click-out records. When you click through to a seller we record the event: your account (if you are signed in — this can be empty), the session, the product, offer, seller and data source involved, whether the link was an affiliate link and which affiliate network, your region and country code, the type of device, and the page you came from
• Sign-in machinery: your active sessions, email verification codes, password reset codes and two-factor challenges. Every one-time code is stored as a hash, never as the code itself

5.How we use this information

We use your information to run the platform and nothing more exotic than that: to keep you signed in, to verify your email address, to let you reset a password or complete a two-factor challenge, to save the products and comparisons you asked us to save, to publish and moderate your reviews, and to personalise comparison highlights and ingredient alerts from the Beauty Profile you filled in.

Click-out records tell us which comparisons actually help people reach a seller, and they are how affiliate referrals are attributed and reconciled with our partners.

We send you email only where it is part of using the platform — verification codes, password reset codes, two-factor codes and account notices. Marketing email goes only to people who have given marketing consent, which you can withdraw.

We do not sell your personal data. Sponsored placements exist on the platform and always carry a visible Sponsored label, and rankings are not for sale — no one can pay us to change the order of a comparison.

6.Cookies

We set exactly two cookies.

pbb_session is set by our API when you sign in or verify your email. It keeps you signed in and nothing else. It is httpOnly, so scripts in your browser cannot read it, it uses SameSite=lax, it is marked secure in production, and it lasts for the lifetime of your session. It is strictly necessary — without it you simply cannot stay signed in.

pbb_locale is set by your browser to remember which interface language you chose. It uses SameSite=lax and is functional only.

There is no analytics cookie, no advertising cookie and no tracking pixel anywhere on this platform. We do not run a third-party analytics tool, a tag manager, a session recorder or an A/B testing tool. Because we set no non-essential cookies, there is no cookie consent banner on the site today.

7.Who we share information with

Two external companies are involved in running PassionByBeauty.

Brevo delivers our transactional email over an HTTPS connection, sending from PassionByBeauty <verify@passionbybeauty.com>. Brevo handles the email address and message content needed to deliver your verification codes, password reset codes, two-factor codes and account notices.

DigitalOcean provides our hosting. Our database is PostgreSQL, which we run ourselves on that same server rather than through a managed third-party database service.

Separately from those two, clicking out is not sharing in the usual sense — it is you leaving. When you click through to a seller you land on that company's own website, and from that moment what they collect about you is governed by their privacy policy and not by this one. The record described above is the record we keep on our side.

We do not offer a public API, so no third party can pull your data from us that way.

8.Where your information is held

The platform runs on a single DigitalOcean server. The PostgreSQL database runs on that same server, and review photos and videos are stored on that server's filesystem. Transactional email travels from us to Brevo over an HTTPS connection.

We are stating here only what we can state accurately. This policy does not yet describe the specific hosting region or the transfer arrangements behind our providers. If that detail matters to you, ask us through the contact page and we will tell you what we know rather than guess in a policy document.

9.How long we keep information

Rather than quote a retention schedule we have not set, here is what actually governs how long things live in the product.

Sessions expire on their own and can be cut short. Signing out revokes that session immediately, and completing a password reset or verifying your email address revokes every existing session on the account.

One-time codes — email verification, password reset and two-factor codes — are short-lived, single-use, and stored only as hashes. Once used or expired they cannot be reused.

Your account, Beauty Profile, saved products, saved comparisons, comparison history, published reviews and click-out records persist while the account exists. There is no automatic expiry on them. If you want something removed, ask us — see your rights below.

10.Your rights

Under EU data protection law you can ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, ask us to restrict or stop certain uses of it, object to a particular use, and ask for your data in a portable form. Where you have given marketing consent, you can withdraw it at any time.

We want to be straightforward about how these requests work today: there is no delete-my-account button and no download-my-data button in the product. Access and deletion are handled by contacting us. We would rather say that plainly than point you at a control that does not exist.

EU data protection law also gives you the right to complain to a data protection supervisory authority if you are unhappy with how your data has been handled.

11.How we protect your account

Passwords are hashed with argon2id, a memory-hard algorithm chosen for exactly this job, and the hash cannot be reversed back into your password. One-time codes are hashed before they are stored and are never written to our logs.

Sessions are opaque records in our database rather than tokens that carry your identity around, which is what lets us revoke them — on sign-out, and across every session at once when a password is reset or an email address is verified. Two-factor authentication is available if you want an extra step at sign-in. Sensitive sign-in and account endpoints are rate limited to slow down guessing and abuse, and all review content, including photos and videos, is moderated before it is published.

No system is perfectly secure. If you think something is wrong with your account, contact us and change your password.

12.Children

PassionByBeauty is not directed at children. The platform is intended for people aged 16 or over, and accounts are not meant to be created by anyone younger.

We should be clear that this is a position rather than a technical control: we do not ask for a date of birth and we do not run age verification. If you believe someone under 16 has created an account, please contact us.

13.Changes to this policy

The platform is under active development, and this policy describes it as it works right now — including the parts that do not exist yet, such as self-service deletion and a cookie banner. When the platform changes in a way that affects your data, the updated policy appears on this page.

14.How to contact us

For anything in this policy — a question, a correction, a request to see or delete the data connected to your account, or a concern about someone else's account — use the contact page on this site. That is the route for data requests, and a person handles them.

Please note that verify@passionbybeauty.com is a sending address used for verification and account emails. Use the contact page instead so your message reaches us.