This policy explains what personal data skinclub.io collects when you visit the site, request a demonstration or book a call, why we use it, who receives it and how you can exercise your rights. SkinClub is a service for clinic professionals, so most visitors act in a business capacity.
Data controller#
Growth Partners, sole proprietorship (French entreprise individuelle, micro-entreprise regime) of Arnaud Lafosse, SIREN 912 652 773, 24 rue Magenta, 29200 Brest, France, publisher of SkinClub. Privacy contact: privacy@skinclub.io. Full publisher details are in our legal notice.
Data we collect#
- Booking and contact data you give us: name, work email, phone number, clinic name and any details entered in the booking form (Cal.com) or the Create my app form.
- Meta Lead Ads form data you submit on Facebook or Instagram: the contact fields of that form, passed to us by Meta.
- Advertising and campaign data: UTM parameters, the Meta click identifier (fbclid), the referring page and landing URL, and your browser's user agent.
- Meta Pixel data: when you visit any page, the Meta Pixel loads automatically and sends page views and, on the demo page, a ViewContent event to Meta, together with technical data such as IP address and browser information. When you book a call, a Schedule event is sent.
- Meta Conversions API events: after a booking, our server sends a Schedule event to Meta containing your email address, phone number, first name and last name in hashed (SHA-256) form, plus the _fbp and _fbc identifiers and an event identifier.
- Cookies and storage: Meta sets the _fbp cookie (and _fbc when you arrive from a Meta ad). Our own browser storage keeps your campaign parameters for 7 days and, in the Create my app form, a signed draft cookie for 30 days so you can resume.
Purposes and legal bases#
- Answering your request, scheduling and holding the demo, and following up commercially: legitimate interest in prospecting other businesses (GDPR Art. 6(1)(f)), and pre-contractual steps at your request (Art. 6(1)(b)).
- Measuring and optimising our advertising (Meta Pixel and Conversions API): our legitimate interest in understanding which campaigns lead to demo bookings. The Pixel runs automatically for every visitor. We do not currently show a consent banner or an on-site opt-out switch. You can object at any time as described below.
- Security, fraud prevention and keeping records: legitimate interest and legal obligations.
Recipients#
Access is limited to the people and systems needed to handle your request. Recipients acting for us or independently:
- Meta Platforms Ireland Limited (and Meta Platforms, Inc.): Lead Ads, Pixel and Conversions API.
- Cal.com: scheduling of demo calls.
- Supabase: storage of lead records.
- Vercel Inc.: hosting of this website.
- Our internal CRM stack (CRM-Hub, hosted on Railway, and Attio) and internal team notifications, used for commercial follow-up.
- Google (Maps Places autocomplete), only if you use the clinic search in the Create my app form.
Transfers outside the European Union#
Several of these providers process data in the United States or other countries outside the EU/EEA. Where this happens we rely on an adequacy decision, namely the EU-US Data Privacy Framework for certified recipients, or on the European Commission's Standard Contractual Clauses. You can request a copy of the safeguards that apply by writing to us.
Retention#
- Prospect and booking records: up to three years after collection or your last contact, unless a contract or legal obligation requires a different period.
- Campaign parameters in your browser: 7 days. Create my app draft cookie: 30 days.
- Meta Pixel and Conversions API data held by Meta: governed by Meta's own policies. [À COMPLÉTER : durée de conservation des événements Meta et des enregistrements Cal.com / Supabase, si différente]
Your rights#
You have the right to access, rectify and erase your data, to restrict or object to its processing, and to receive a copy of it. To exercise these rights, write to privacy@skinclub.io. We may ask you to prove your identity. If you believe your rights are not respected, you can lodge a complaint with the CNIL (cnil.fr) or your local data protection authority.
Objecting to advertising measurement#
- Block or delete the _fbp and _fbc cookies, or use a browser or extension that blocks third-party trackers.
- Manage how Meta uses your activity for ads in your Facebook or Instagram ad settings.
- Write to privacy@skinclub.io to object. We will stop sending events that concern you to Meta through the Conversions API and delete the related identifiers we hold. Events already received by Meta are handled under Meta's own policies.
Changes#
We update this page when our practices change. The date above shows the latest revision.