This notice describes how WAI LAB currently works and the rules planned for the introduction of statistical services and affiliate links.
This describes the current features. Accounts, newsletters and affiliate programmes are not yet active. Checks on technical retention and provider configuration must be completed before the final launch.
Lorenzo Casazza and Marilena Funaro jointly determine the purposes and essential means of WAI LAB's processing as joint controllers. The shared contact for information and requests concerning personal data is info@wai-lab.com. You may exercise your rights against either joint controller. The agreement and summary of their respective responsibilities are still being formalised.
For business enquiries: partnership@wai-lab.com.
Browsing does not require registration. Cloudflare provides hosting, website delivery and technical services: requests may include your IP address, date and time, requested URL and browser information. Search terms may appear in the results URL. Do not enter confidential data in searches. IP addresses are also used to limit abuse of photo recognition.
The purpose is to provide the requested service and protect its operation. The legal bases are performance of the requested service (Article 6(1)(b) GDPR) and the legitimate interest in security and preventing abuse (Article 6(1)(f)).
Your name or nickname, age range, cosmetic preferences, skin type, needs and selected products are used to prepare the suggestions you request. Your profile and routine are processed in your browser and are not sent to the WAI LAB database. They are not used for behavioural advertising. You can browse the catalogue without completing a profile.
These tools do not assess your health. Do not enter diagnoses, treatments or other health information in free-text fields. Automated selections serve cosmetic purposes and do not produce legal or similarly significant effects. The legal basis for the requested personalisation service is Article 6(1)(b) GDPR.
The application uses sessionStorage, which is separate from cookies, to remember requested features. The keys wai-lab-favorites-v1 and wai-lab-comparison-v1 store favourites and comparisons; wai-lab-profile-v1 and wai-lab-active-needs-v1 store your profile and needs; wai-lab-morning-routine-v1, wai-lab-evening-routine-v1 and wai-lab-routine-meta-v1 store your routine. wai-lab-query remembers your search. The keys wai-lab-profile-step-v1, wai-lab-profile-scroll-v1 and wai-lab-profile-without-pregnancy-v1 support continuity and maintenance of the journey.
Data lasts for the tab's session; restoring tabs in your browser may also restore this data. You can use the reset controls on the pages or clear site data in your browser settings. The application code does not install advertising cookies or analytics tools. Any infrastructure security technologies must be checked against the final configuration.
Cookie consent is not required for tools strictly necessary for the requested features. Before non-essential tools are introduced, their providers, purposes and duration will be stated and, where required, prior consent will be obtained, with options to refuse and withdraw it. Continuing to browse will not be sufficient.
Searching by packaging photo is optional: WAI LAB does not ask for photos of your face or skin. If you choose Product photo mode, the image is sent to Cloudflare Workers AI to recognise the packaging. WAI LAB's code does not save the photo in the database or catalogue. Processing is requested by the user (Article 6(1)(b) GDPR). Include only the product, without people, documents or personal data.
“Read text only, on this device” mode uses Tesseract in your browser: it does not send the photo to the AI service, but may download technical resources from jsDelivr and store them in the local cache. Barcodes and QR codes are also read on your device. When you submit a catalogue suggestion, its code, brand, name, size, official URL and submission dates are saved in Cloudflare D1 for verification. Do not enter personal information in these fields.
The feedback form saves the message, category, page path, any product ID and name, creation and update dates and email address, if provided, in Cloudflare D1. Your email is optional and is used to reply. Do not send health information or other people's data. Messages sent to info@wai-lab.com and partnership@wai-lab.com are managed through Microsoft 365.
We process this information to handle requests and pre-contractual discussions (Article 6(1)(b) GDPR), and for our legitimate interest in investigating errors and improving the service (Article 6(1)(f)). Sending a message does not subscribe you to a newsletter.
Your profile and selections follow the browser-session duration described above. Downloaded PDFs stay on your device until you delete them.
Feedback and routine support communications are deleted from active systems 14 days after the request is closed, unless documented needs related to legal obligations or the protection of rights require otherwise. Deletion is manual. Open requests remain available so they can be handled. This rule does not apply uniformly to contracts, affiliate relationships, disputes and privacy requests: retention for this data depends on managing the relationship, applicable obligations and the documented need to protect rights.
Residual copies may temporarily remain in providers' recovery and backup systems, according to their retention periods. The D1 Time Travel window checked on 18 October 2026 was 7 days; actual email recovery periods, any retention requirements and provider log durations are still being checked. We do not promise permanent deletion of every copy within 14 days. Product suggestions containing no personal data may remain in the catalogue.
The services involved include Cloudflare (hosting, security, database and photo recognition), Microsoft 365 (email) and, when required by OCR, jsDelivr (technical resource delivery). Images loaded from external sites involve requests to their providers, which receive standard connection data. Sharing through WhatsApp or other services is initiated by you and is subject to their privacy notices.
We do not assume all data remains within the European Union. Before launch, processing agreements, locations and safeguards for any transfers outside the EEA, such as adequacy decisions or standard contractual clauses, must be confirmed. Specific information can be requested at info@wai-lab.com.
Retailer links lead to independent sites with their own terms and privacy notices. Affiliate programmes are not yet active. Each partner's attribution systems and any consent requirements will be checked before activation. No user purchase history is created. Read Affiliations and independence →
Where provided by the GDPR, you may request access, rectification, erasure, restriction and portability of data, and object to processing based on legitimate interests. If processing relies on consent, you may withdraw it without affecting processing carried out before withdrawal. Write to info@wai-lab.com, stating your request and the information needed to identify it, without sending unsolicited identity documents.
The usual response period is one month; any extensions in the cases provided by law will be communicated with reasons. For data held only in your browser, you can act directly on your device. You may lodge a complaint with the Italian Data Protection Authority or the competent supervisory authority.