Privacy Policy

Responsible for data processing on this platform is Core Customs UG (haftungsbeschränkt) ("BeautyCore", "we"). You can reach us for privacy matters at info@core-customs.de. Full contact details are in our imprint.

This policy covers the BeautyCore platform (marketing site, member portal) and the public Smart Site pages we host for our members (paths under /s/…).

We host on Cloudflare (Workers/CDN) and Supabase (database, authentication, file storage). These providers act as processors on our behalf under data processing agreements.

Technical access data (e.g. IP address) is processed to deliver the service securely. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, working service).

When you visit, the infrastructure automatically processes data such as IP address, date and time, the page requested, referrer and browser/user-agent. This is used for operation, security and abuse prevention and is stored only as long as necessary.

We use strictly necessary cookies (e.g. session/login, storing your consent and language choice). Non-essential cookies are only set with your consent via our consent banner; you can change your choice at any time. Legal basis: § 25(2) TDDDG for essential cookies, § 25(1) TDDDG / Art. 6(1)(a) GDPR for optional ones.

To create an account we process your email address, password (stored only as a secure hash by our auth provider), display name and the role you select. We also store the time and version of the privacy/terms consent you give. Legal basis: Art. 6(1)(b) GDPR (performance of the contract).

Profile data you provide may be visible to other members and, if you choose, publicly. Messages and connection requests are processed to enable networking between members.

Content you add to a Smart Site (texts, images, services, contact details) is published on a public web page once you choose to publish it, including for search engines. You control what you publish.

If you create a CV or apply to a position, we process your career data. A preview may appear in the talent pool for verified businesses; full access requires your CV to be searchable and is granted to a business only after an unlock. Applying shares your application with the respective business. Legal basis: Art. 6(1)(b) and, where applicable, Art. 6(1)(a) GDPR.

Paid plans are processed by Stripe Payments Europe, Ltd. Payment details are entered directly with Stripe; we do not store card data. We receive subscription status to unlock features. Legal basis: Art. 6(1)(b) GDPR.

We send transactional emails (e.g. address confirmation, password reset) and — depending on your settings — notifications (applications, messages, connections). Emails are delivered via an email service provider (e.g. Resend or Brevo) acting as processor. You can manage notifications in your settings; security emails are always sent.

Optional AI features generate text for Smart Sites and assist in the portal (via OpenAI). Content you submit for generation is transmitted to this provider (incl. the USA) solely to produce the result; per its API terms it is not used to train the models. Please do not enter sensitive personal data into AI fields.

Public forms are protected by Cloudflare Turnstile, a privacy-friendly CAPTCHA that helps us prevent spam and abuse. Legal basis: Art. 6(1)(f) GDPR.

If you sign up for news/waiting list, we process your email address based on your consent (Art. 6(1)(a) GDPR). You can withdraw at any time, e.g. via the unsubscribe link.

Some providers (e.g. OpenAI and parts of Cloudflare/Stripe) may process data in the USA. Such transfers are safeguarded by EU Standard Contractual Clauses and/or adequacy mechanisms.

We keep personal data for as long as your account exists or as needed for the purposes described, and thereafter only as required by statutory retention obligations.

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). Where processing is based on consent, you may withdraw it at any time with effect for the future.

You also have the right to lodge a complaint with a supervisory authority, e.g. the Bavarian State Office for Data Protection Supervision (BayLDA).

For any privacy request, contact info@core-customs.de. We may update this policy to reflect changes in our service or the law; the current version applies.