Privacy policy

In short

INCIMondo has no user accounts and no comments; the newsletter is optional. You can use the site without giving us any personal data. This policy explains what happens to data in a few situations: on every visit (server logs, Cloudflare), when you use the ingredient analyzer, when you submit a product through the "Add product" form, when you e-mail us and when you click a link to a shop.

We do not sell data, we do not use analytics tools or advertising cookies, and we do not profile visitors.

Who is the controller

The controller of personal data processed on incimondo.com is WXQ Spółka z ograniczoną odpowiedzialnością (a Polish limited liability company), ul. Stanisława Bełżeckiego 4, 26-613 Radom, Poland, tax ID (NIP) 5252844355, National Court Register (KRS) no. 0000871653.

For anything related to personal data, write to [email protected]. We have not appointed a data protection officer, as we are not required to.

Server logs and Cloudflare

Every page request is recorded in the server logs with the IP address, date and time, the URL requested, information about the browser and operating system (user agent) and the address of the page you came from (referrer). This happens automatically and is needed to run the site, diagnose errors and detect abuse, such as bots downloading content hundreds of times a minute.

Traffic to the site passes through the network of Cloudflare, Inc., which delivers content and protects the site against attacks. For this purpose Cloudflare may set a technical cookie that helps tell humans from bots; it is not used for tracking or advertising.

The legal basis is our legitimate interest in keeping the site secure and working properly (Art. 6(1)(f) GDPR). We keep logs for no longer than 12 months.

Recall alerts (“My list”)

“My list” is stored only in your browser. If you turn on recall alerts, we process your e-mail address and the identifiers of the products on your list in order to compare them weekly with new notifications in the EU Safety Gate system and e-mail you about a possible match.

The legal basis is your consent (Art. 6(1)(a) GDPR), confirmed by clicking the link in the first e-mail. We keep the data until you unsubscribe – every message contains an unsubscribe link, and unsubscribing deletes your address and list. Unconfirmed sign-ups are deleted. E-mails are sent from our own server, without external mailing services or open tracking.

Newsletter (EU regulation changes and new products)

If you subscribe to the newsletter, we process your e-mail address, your chosen language and the topics you selected (changes in EU rules on cosmetic ingredients, new product lists) in order to send you no more than 2 e-mails a month.

The legal basis is your consent (Art. 6(1)(a) GDPR), confirmed by clicking the link in the first e-mail (double opt-in). You can withdraw consent at any time – every message contains an unsubscribe link, and unsubscribing deletes your address from our database. We keep the data until you unsubscribe; unconfirmed sign-ups are deleted after 7 days. Your address is stored and the e-mails are sent only from our own server – we do not use external mailing services, do not track opens or clicks and do not share addresses with anyone.

INCI analyzer

Text you paste into the analyzer is sent to our server and processed only to produce the report: to recognise ingredient names and match them to encyclopedia entries. The report is returned to your browser; we do not store the full text you pasted.

The only thing we save is individual names the dictionary did not recognise (up to 20 per analysis), together with a counter and the date they were last seen. These entries are not linked to your IP address or to anything else about you – the editorial team uses them to extend the dictionary.

To limit the number of requests from one place, the server briefly keeps a counter tied to the IP address in its working memory; it is not written to the database.

The analyzer is meant for ingredient lists. Please do not paste personal data or any text unrelated to cosmetics.

The "Add product" form

You can use the form to submit a product that is missing from our database – either as a user or on behalf of a brand. We store what you enter: brand, product name, EAN barcode, ingredient list (INCI), a photo (for user submissions a photo of the label is required; for brand submissions a product photo is optional), the product page URL (brands only) and, if you provide them, your e-mail address and a name or nickname for the photo credit. We also store the submission date, your confirmation of the photo rights statement and the result of an automatic analysis of the ingredient list. We do not store your IP address with the submission.

Submissions go into a moderation queue and are not public. Until a submission is accepted, the photo is kept outside the public part of the server. Once accepted, a submission may become a product page: we then publish the brand, name, EAN, ingredient list and the photo with its credit (the name or nickname you gave, or "INCIMondo user" if you left it blank; for brand submissions, the brand name). We never publish your e-mail address.

Legal bases: handling a submission you chose to send us, and e-mailing you about it, is based on our legitimate interest (Art. 6(1)(f) GDPR) – without it we could not check and publish the data. Publishing your name or nickname next to the photo is based on your consent (Art. 6(1)(a) GDPR), which you give by filling in the credit field. You can withdraw that consent at any time by e-mail and we will replace the credit with "INCIMondo user". Withdrawal does not affect the lawfulness of publication before it.

We use your e-mail address only to ask about your submission (for example, if the photo is not legible). We do not send advertising or newsletters to it and we do not pass it on to anyone.

Retention: rejected submissions (including the photo and e-mail address) are deleted 12 months after the decision. E-mail addresses are deleted 12 months after the submission was handled, even if it was accepted. Accepted submissions, photos and credits are kept for as long as the product page exists.

Photos must not show people or personal data (such as a receipt or a shipping label). Phone photos may contain location data in their metadata – it is best to switch this off or remove it before uploading. If you notice something about you in a published photo, write to us and we will remove or blur it.

E-mail correspondence

When you write to [email protected], we process your e-mail address, the content of your message and any data you include in it, in order to reply and continue the conversation, including checking an error you reported. The legal basis is our legitimate interest in answering you (Art. 6(1)(f) GDPR).

We keep correspondence for no longer than 12 months after it ends, unless the law requires us to keep it longer or we need it to establish, exercise or defend legal claims.

Browser storage

The site stores a single value in your browser's local storage (localStorage): your theme choice, light or dark (key "im-theme"). It never leaves your device, is not sent to our server and cannot be used to identify you. You can delete it by clearing the site data in your browser settings.

We do not use analytics tools or advertising cookies. If that changes, we will update this policy and, where the law requires it, ask for your consent first.

Images loaded from other servers

Some images are displayed directly from third-party servers: product photos from Open Beauty Facts, manufacturers' photos quoted in reviews (from their websites) and logos from Wikimedia Commons. When your browser loads such an image, that server receives your IP address, browser information and usually the address of the INCIMondo page on which the image appears.

These parties process the data as separate controllers under their own privacy policies. We do this on the basis of our legitimate interest (Art. 6(1)(f) GDPR) in showing illustrations with their source, without copying them to our server.

Links to shops

The "Buy at …" buttons on product pages are affiliate links. When you click one, you leave incimondo.com and go through an affiliate network (such as Convertiser, Adtraction, webePartners and others) to the shop. The affiliate network and the shop then set their own cookies to attribute any purchase to our site – they, not we, are the controllers of that data.

We do not receive information about who made a purchase or what they bought; we only see aggregated commission reports. How affiliate networks and shops process data is described in their own privacy policies.

Processors and transfers outside the EEA

The following process data on our behalf: the hosting provider whose servers run the site and database, our e-mail provider and Cloudflare, Inc. (content delivery and protection against attacks). They process data only to the extent needed to provide their services.

Cloudflare is based in the United States. Transfers outside the European Economic Area rely on the European Commission's adequacy decision (EU-US Data Privacy Framework) and, beyond its scope, on standard contractual clauses.

Only members of the editorial team have accounts in the admin panel. We process their data solely in connection with their work on the site.

Your rights

You have the right to access your data, to have it corrected, erased or its processing restricted, the right to data portability and the right to object to processing based on our legitimate interest. Where processing is based on consent, you can withdraw it at any time.

You can lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, Poland), which is competent for us as a controller established in Poland, or with the supervisory authority in the EU member state where you live, work or where the alleged infringement took place.

In practice, data about you can be in only a few places: server logs linked to an IP address, a product submission (if you sent one) and our mailbox (if you wrote to us). Write to [email protected] and we will reply without undue delay and within one month at the latest. Providing data is always voluntary. We do not make automated decisions about you or profile you.

Changes

If the scope of the data we process changes – for example, if we introduce an analytics tool – we will update this policy and the date below.

Last updated: 30 October 2026.