Last updated: March 2026
Mutaly (“we”, “us”, or “our”) operates mutaly.com (the “Service”). This Privacy Policy explains how we collect, use, disclose, and protect your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and other applicable data protection laws. Mutaly is the data controller for the purposes of applicable data protection law. If you have questions about this Policy, you may contact us at: [email protected]
We may collect and process the following categories of personal data: a) Account Information • Name • Email address • Authentication data provided via Google or email login (processed by Clerk) b) Quiz Information • Hair type • Scalp condition • Hair care preferences • Other information voluntarily submitted to generate recommendations Quiz information may constitute health-related data depending on context. We process this information only based on your explicit consent. c) Usage Data • IP address • Device type • Browser information • Pages visited • Session recordings • Click, scroll, and interaction behavior Collected via Microsoft Clarity and similar analytics tools. d) Payment Information Payments are processed by third-party payment providers. We do not store full credit card details.
We process personal data based on the following legal grounds: • Performance of a contract (Article 6(1)(b) GDPR) — to provide the Service after purchase. • Consent (Article 6(1)(a) GDPR) — for processing quiz responses and analytics cookies. • Legitimate interests (Article 6(1)(f) GDPR) — to improve website functionality, prevent fraud, and secure the Service. • Compliance with legal obligations (Article 6(1)(c) GDPR) — where required. Where quiz data relates to potential health information, we rely on explicit consent (Article 9(2)(a) GDPR). You may withdraw consent at any time.
We use personal data to: • Generate personalized hair care recommendations. • Deliver purchased digital content. • Send transactional emails. • Improve website usability and performance. • Prevent fraud and abuse. • Comply with legal obligations. We do not sell personal data.
We use cookies and similar technologies. Microsoft Clarity collects: • mouse movements, • clicks, • scrolling behavior, • session replays, • device and browser data. Analytics cookies are activated only after your consent via our cookie banner, where required by law. You may withdraw consent at any time through the cookie settings.
We use trusted third-party service providers who process personal data on our behalf: • Clerk — authentication and user management. • Microsoft Clarity — analytics. • Resend — email delivery. • Payment provider (e.g., Stripe or similar). These providers process data under Data Processing Agreements (DPAs) and may act as data processors or independent controllers depending on context.
Your data may be transferred outside the European Economic Area (EEA), including to the United States. Where such transfers occur, we ensure appropriate safeguards, including: • Standard Contractual Clauses (SCCs), • or reliance on adequacy decisions where applicable.
We retain personal data only as long as necessary to: • provide the Service, • comply with legal obligations, • resolve disputes, • enforce agreements. You may delete your account at any time. Upon deletion, personal data will be erased unless retention is required by law.
If you are located in the European Economic Area, you have the right to: • Access your data. • Rectify inaccurate data. • Request erasure (“right to be forgotten”). • Restrict processing. • Object to processing. • Data portability. • Withdraw consent. • Lodge a complaint with a supervisory authority. To exercise your rights, contact: [email protected]
If you are a U.S. resident, you may have rights under applicable state laws (e.g., California Consumer Privacy Act), including: • Right to access personal data, • Right to request deletion, • Right to correct inaccurate data, • Right to opt out of certain data uses. We do not sell personal data.
We implement technical and organizational security measures, including: • HTTPS encryption, • secure authentication systems, • access control limitations, • third-party security safeguards. However, no system is completely secure.
The Service is not intended for individuals under 18 years old. We do not knowingly collect data from minors.
We may update this Privacy Policy periodically. Significant changes will be communicated through the website.
We use cookies and analytics (Microsoft Clarity) to improve your experience. Learn more