Privacy Policy

1. Who We Are

Blendsor is an artificial intelligence application designed exclusively for professional colorists. Our mission is to empower your talent with precision technology, always keeping data security as a fundamental pillar.

For complete data controller information, please visit our Legal Notice.

2. Data We Collect

Your Professional Account Data

• Name and email to identify you on the platform
• Salon information (optional)
• Color brand preferences

Your Clients' Data

• Client name (to identify records)
• Color history and applied formulas
• Photos for chromatic analysis (with consent)
• Technical notes: porosity, underlying pigment, previous treatments
• Health precautions relevant to the service that the professional records in the client file or mentions in the chat (allergies or previous reactions to hair dye, pregnancy or breastfeeding, henna or metallic salts), so the assistant never recommends anything that ignores them
• An automatic summary of each conversation with the assistant, so it does not lose track in long conversations. It is deleted when the conversation or the account is deleted

Who Is Responsible for Your Clients' Data

You decide about your clients' data: the professional or the salon is the data controller. Blendsor processes it only on your behalf and on your instructions, as a data processor (Art. 28 GDPR), under the agreement in section 9.1 of the Terms and Conditions. The artificial intelligence providers listed in section 5 act as sub-processors. Blendsor processes the data of your own professional account as controller.

Health precautions are a special category of data (Art. 9 GDPR). They are only used to make the recommendation safe for your client. As controller, you need your client's explicit consent (Art. 9(2)(a) GDPR) before recording them in the client file or mentioning them in the chat. Blendsor does not use them for any other purpose and only discloses them to the artificial intelligence providers listed in section 5, to generate the answer.

Technical Data

• Device and browser information
• Usage logs to improve the service

3. How We Use Your Information

We use data exclusively to:

• Generate precise formulas using our AI algorithms
• Maintain history of each client to ensure consistency
• Improve our algorithms in an aggregated and anonymous way
• Internally classify your account's usage type (professional or personal) based on your conversations, to adapt the product and our communications (legitimate interest, Art. 6(1)(f) GDPR). This classification is strictly internal, is never shared with third parties, produces no legal effects on you, and you can see it by requesting your data export from the app
• Review a specific conversation, in two cases only. (1) With your express permission: when you ask us or allow us to (for example, when you write to support or answer in the app that we may read it), to see what went wrong or what worked and improve the app's answers (consent, Art. 6(1)(a) GDPR). If you give it in the app, it covers only what was written up to that moment (the text, never the photos) and lasts 90 days; before reviewing it we automatically remove the names, phone numbers and emails of the clients you have saved in the app. You can withdraw it at any time in the app (Settings › Privacy & Security) or by writing to us. (2) Without asking you, only to fix a specific technical failure in that conversation (an answer that was cut off, lost or returned an error), and only the part needed (legitimate interest in keeping the service working and secure, Art. 6(1)(f) GDPR). In both cases the Blendsor team reads it, also with the help of an artificial intelligence model listed in section 5; if it contains your clients' data, we do it on your behalf, to provide you with the service. Outside these two cases, no one on the team reads your conversations
• Communicate with you about important service updates

4. Security and Storage

We implement enterprise-level security measures:

• Servers in the European Union (Supabase, Paris)
• AES-256 encryption for all photographs
• HTTPS/TLS connections for all communications
• Restricted access only to authorized personnel

Photo Retention

Photos sent in the chat are automatically deleted after 24 hours. Photos used for analysis (colorimetry, face shape) are automatically deleted after 14 days, and so are the colour previews the assistant generates from that photo. Photos the professional saves with a client's formula are kept for 90 days, and the before/after photos in the client's record for the duration of the professional relationship with that client, as a visual history of the service. Any of them can be deleted manually at any time from the application, and they are removed when consent is revoked or the account is deleted.

Temporary Copy of Chat Answers

So that a chat answer is not lost if your device locks while it is being written, our server keeps a temporary copy of each answer, on the same European Union infrastructure, and deletes it automatically in less than two hours.

5. Third-Party Sharing

Blendsor only shares data with the following third-party services:

• OpenAI (OpenAI Ireland Ltd.), GPT AI models: answers the chat with the assistant (including when you send a photo), generates formulas and the formula chat, and produces the automatic conversation summaries and the suggestions to complete the client file. It receives what you write, the photos you send in the chat and, so the assistant never recommends anything that ignores them, the health precautions in the client file linked to the conversation and in the files of the people you name in it, together with their name. It acts as a sub-processor. Under its terms, data sent through its API is not used to train its models and is kept for up to 30 days. OpenAI Ireland may transfer the data outside the EEA to other companies in its group or to its providers; such transfers rely on Standard Contractual Clauses approved by the European Commission (Art. 46(2)(c) GDPR) or on an adequacy decision (Art. 45 GDPR).
• Google (Gemini API, paid service), Gemini AI models: analyses photos (colorimetry, comparison between visits), generates colour previews and, in some cases, answers the chat with a photo. In that chat it also receives the health precautions of the client file linked to the conversation, together with its name. It acts as a sub-processor. Under its terms for the paid service, Google does not use this data to improve its products and keeps it for up to 55 days to detect abuse. Google may process the data outside the EEA; such transfers rely on the EU-U.S. Data Privacy Framework (adequacy decision, Art. 45 GDPR) and, failing that, on Standard Contractual Clauses (Art. 46(2)(c) GDPR).
• Anthropic (Anthropic Ireland, Limited), Claude AI models: reads the text of the conversations reviewed in the two cases described in section 3. It does not receive photos. It acts as a sub-processor, under the data processing addendum in its commercial terms. Under those terms, it does not use this data to train its models and deletes it within 30 days. Anthropic may process the data outside the EEA; such transfers rely on Standard Contractual Clauses approved by the European Commission (Art. 46(2)(c) GDPR).
• Photos are sent to these providers encrypted. Before uploading a client's photo, each professional obtains the client's consent as controller, and the formula assistant asks them to confirm it in the safety checklist.
• Supabase: Secure storage infrastructure in the EU
• Cloudflare: Application protection and performance
• PostHog: Product analytics to improve the mobile app experience. Data is stored in the EU (Frankfurt). We collect usage data (screen navigation, feature usage) and, after sign-in, your account identifier (Supabase user UUID) and email address as a person trait so we can attribute support requests, debug abandoned funnels, and honour deletion requests. We do not send any other personally identifiable information. PostHog also records in-app interaction (taps and screen navigation) to detect usability issues; any text you type and all images are masked automatically before recording, so neither your clients' data nor their photographs are captured. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). You may request erasure of your PostHog profile under Art. 17 — see Section 6.
• Sentry: Error monitoring, so we can detect and fix app failures. When the app hits a technical error we send a report with the device model, app version, your account identifier (UUID) and the technical context of the failure, along with a short recording of the preceding seconds in which text and images are automatically masked. We do not send unmasked screenshots or client photographs. If you write to us from the app's feedback screen, that report also includes your name, email address and the message you write, so we can reply. Data is stored in the EU (Germany) and deleted automatically after 90 days. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• TikTok: For publishing video content through our social media integration. Only content you explicitly choose to share is sent to TikTok. No client data or personal information is shared with TikTok. International transfer: TikTok may transfer data outside the European Economic Area (EEA) to countries without equivalent protection. Such transfers rely on Standard Contractual Clauses approved by the European Commission (Art. 46(2)(c) GDPR). See TikTok's privacy policy.

Our AI providers, Supabase, Cloudflare, PostHog, and Sentry comply with GDPR and maintain the highest security standards. TikTok's data processing is governed by Standard Contractual Clauses as described above.

6. Your Rights (GDPR)

As a European user, you have the right to:

• Access: Request a copy of all your data
• Rectification: Correct inaccurate information
• Deletion: Delete your account and all associated data
• Portability: Export your data in a standard format
• Objection: Limit certain uses of your information
• Withdraw consent: At any time, without consequences

To exercise any of these rights, contact us at hello@blendsor.com. We will respond within a maximum of 30 days.

7. How to Delete Your Account and Data

You can delete your account and all your data easily:

From the app (recommended)

1. Open Blendsor and go to Settings (gear icon)
2. Tap on Privacy & Security
3. Scroll down to Delete Account
4. Type "DELETE" to confirm and enter your password
5. Your account and all data will be permanently deleted

By email

If you prefer not to use the app, send an email to hello@blendsor.com with the subject "Delete my account" from the email associated with your account. We will process your request within a maximum of 30 days.

Delete only some data

If you only want to delete certain data without deleting your account:

• Client photos: Settings → Privacy → Revoke photo consent
• A client's record: Open the client record → Menu → Delete client. It disappears from the app right away; after 30 days it is permanently deleted along with its formulas, photos and appointments
• Export your data: Settings → Privacy → Export my data

8. Client Photos

We understand the sensitivity of your clients' images:

• Should only be captured with explicit client consent, which each professional obtains as controller
• Stored encrypted and separate from identifying data
• Used for chromatic analysis and, if the professional saves them, as a before/after visual history in the client's record
• You can delete them at any time
• Chat photos are automatically deleted after 24 hours; analysis photos and the colour previews generated from them, after 14 days; photos saved with a client's formula are kept for 90 days; before/after photos, for the duration of the client relationship. All of them are removed when consent is revoked

9. Minors

Blendsor is designed for professionals. We do not intentionally collect data from individuals under 16 years of age. If we detect that we have received information from a minor, we will delete it immediately.

10. Changes to This Policy

We may update this policy occasionally. We will notify you of any significant changes by email or through a notice in the application. We recommend reviewing this page periodically.

11. Contact

If you have questions about this policy or how we handle your data, write to us at hello@blendsor.com.

Complete data controller information is available in our Legal Notice.

You can also exercise your GDPR rights through the Spanish Data Protection Agency.