Privacy Policy.Privacy Policy.

The data controller responsible for your personal data is Lumiq Holdings OÜ, a private limited company (osaühing) registered in Estonia, European Union. Lumiq Holdings OÜ operates the Wardropic mobile application and website.

Contact for all privacy and data-related matters: [email protected]

You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), the supervisory authority for data protection in Estonia.

Account Data

• —Email address (required for account creation and authentication)
• —Display name (optional, provided by you)
• —Profile photo (optional, provided by you)

Profile Details

When you set up your profile you give us your gender (a short list of options that includes “Prefer not to say”), optionally your date of birth, your clothing sizes (top, bottom, shoe), your measurement-unit preference and your style preferences. These are ordinary personal data. We use them to personalise outfit suggestions and virtual try-on, which is the service you asked for (Article 6(1)(b) GDPR). You can change them in the app at any time, and they are deleted with your account.

Body Details (sensitive data — only with your explicit consent)

Wardropic works without any of the following. If you choose to share them, each of these three groups is a separate choice, all of them are off until you turn them on, and none is a condition of using the app or of accepting these Terms:

• —Eye, hair and skin color — entered by you, or read from a photo you choose. Skin color can reveal racial or ethnic origin, so we treat it as sensitive. Used only to suggest colors that suit you.
• —Height and weight — body measurements can relate to health. Used only to judge fit and proportions in outfits and virtual try-on.
• —A photo of you — a full-body photo, or your profile picture if you have no body photo. Used only for virtual try-on and for reading your coloring from the photo. We do not use it to identify you.

You make this choice once, when you set up your profile, and again only if you want to change it, if you use a feature that needs a group you left off, or if we change the notice you agreed to. You can turn any group off at any time under Profile → Privacy Settings. The photo, and every virtual try-on and try-before-you-buy image made from it, is deleted straight away. For colors and measurements you choose what happens to what you entered: delete it straight away, or keep it stored but unused for up to 12 months so you can turn the setting back on without typing it again (after 12 months it is deleted). We never keep it without that choice, and we never use it while the setting is off. Anything already processed before you withdrew stays lawful.

For each choice we keep a record of what you agreed to: which groups, when, which version and language of the notice you saw (and a fingerprint of its exact text), and the IP address and device information of the request. You can download a signed copy of your consent receipt from the same screen. These records are kept as legal evidence (see Data Retention).

Garment & Wardrobe Data

• —Photos of clothing items you upload for AI analysis
• —AI-generated metadata (category, color, occasion, material, season) derived from those photos
• —Outfit combinations, wear logs, and outfit history

Stylist Memory (only with your consent)

If you turn on Memory, your stylist can save short notes taken from what you write in the chat: things you like, rules you follow and dates that matter, for example “no wool” or “wedding on 14 November”. You can also write notes yourself. A note can only be made of your own words from the message you just sent, never from photos, search results, product pages or anything the stylist worked out for itself, and whenever the stylist saves or removes one it tells you in the chat, with an Undo.

• —Never saved: health, body measurements or appearance, religion or belief, political views, sexual orientation, ethnicity, contact details, links, or anything taken from a photo or a search result. The body details above keep their own separate consent, and a note cannot be used to get round it.
• —Private chats never read or save notes.
• —Memory is off until you turn it on under Profile → Privacy → Memory, where every note is listed and can be edited or deleted. It is optional, the stylist works without it, and it is not a condition of using Wardropic.
• —Style rules, for example “never wool” or “avoid red”, are kept in the same list. You choose them from fixed lists in the app, or the stylist saves one when you say so in the chat (with the same Undo). They also shape the outfits we pick for you each day, and they are erased with your notes.
• —Up to 60 notes and rules are kept; at most 12 notes, together with your rules, go with a message, to the same AI providers as the rest of your chat (see Section 5). They are never used to train AI, and nothing else receives them.
• —For each choice we keep a record: when, which version and language of the notice you saw (and a fingerprint of its exact text), and the IP address and device information of the request. These records are kept as legal evidence (see Data Retention).

Location Data

With your explicit permission, we collect your approximate location (city-level) to fetch local weather for outfit suggestions. Coordinates are rounded to about one kilometre before we store them. We do not track your precise GPS position or movement. Location permission can be revoked at any time through your device settings.

Usage & Technical Data

• —App version, device operating system, and locale
• —Session activity logs (for abuse prevention and service reliability)
• —Expo push notification token (if notifications are enabled)
• —IP address and inferred country at the time of account creation (for geo-tier assignment)

Invites and Rewards

If you take a friend's invite code, or share your own, we record which account invited which, and a keyed one-way hash of the network address and the app installation the code was taken from. When an invite earns a reward (today, virtual try-ons for both people once the friend has set up their closet), we record the reward and how much of it is used. To make sure each person and each phone can earn it once, we also keep a keyed one-way hash of the email address and of the installation identifier. Those hashes cannot be turned back into your email or your device, and they are kept for two years even if you delete your account, because that is what stops a deleted account from earning the same reward again. A friend is shown the first name of the person who invited them; the person who invited them is never told who joined. A streak reward uses the days on which you saved an outfit log, which Wardropic already keeps to run your wear history; nothing else is collected for it. We may send you a notification when a reward lands, which you can switch off under Profile → Notifications. A reward is never a condition of using Wardropic.

This Website

We count visits to this website to see which pages are read and where people come from. The count is made on our own server as a page is served: there is no script for it on the page, we set no cookie, we store nothing on and read nothing from your device, and we keep no IP address, user agent or identifier. All that is recorded is a number going up for the day, the page (from a fixed list, never the full address), the kind of place you came from (search, social, another page of ours or direct, never the site itself), and the campaign name if the link you followed carried one. Because nothing recognises you, we count page views and not visitors, and the same person reading twice counts twice. The links to the app stores pass through our server so that a tap can be counted in the same way. Pages that carry a secret in their address, such as payment and sign-in links, are never counted.

Payment Data

If you subscribe to a paid plan, payment is processed by Stripe. We do not store your card number or full payment details. Stripe shares with us your subscription status, plan tier, and billing period. See Stripe's Privacy Policy for details on how they handle payment data.

If you subscribe inside the iPhone app on a store where Apple handles the purchase, payment is processed by Apple under Apple's own terms and privacy policy, and we never receive your card or Apple ID details. Apple tells us your subscription's status, the product, the price and currency charged, your App Store region, and a purchase identifier. We give Apple a random token that is stored with your account so each purchase can be matched to the right account and to no one else.

Legal Consent Records

The timestamp at which you accepted these Terms of Service and this Privacy Policy, stored as a legal record of your informed consent.

• —Providing the service: creating your account, generating daily outfit suggestions, running AI clothing analysis, and powering the style chat.
• —Personalisation: using your style profile and wardrobe data to tailor outfit recommendations to your body, preferences, and local weather.
• —Stylist memory: if you turn it on, using the short notes you shared in chat so the stylist's answers fit you.
• —Subscription management: processing payments, managing plan limits, and handling upgrades or cancellations through Stripe or, for a plan bought in the iPhone app, Apple.
• —Notifications: sending daily outfit suggestions and product updates if you have enabled push notifications.
• —Geo-compliance: determining your access tier at signup based on your country to comply with our geographic restrictions policy.
• —Security & fraud prevention: detecting VPN/proxy usage, enforcing rate limits, and preventing abuse of the free tier.
• —Legal compliance: maintaining records of your consent, responding to lawful requests, and fulfilling obligations under applicable EU law.

We do not sell your data, use it to serve advertising, or use your photos or wardrobe data to train AI models without your explicit consent.

Under the General Data Protection Regulation (GDPR), we process your data on the following legal bases:

• —Contract performance (Article 6(1)(b)): processing necessary to provide the Wardropic service you signed up for — account creation, outfit generation, wardrobe storage, and the profile details (gender, date of birth, sizes, style preferences) that personalise your suggestions.
• —Legitimate interests (Article 6(1)(f)): fraud prevention, geo-tier enforcement, rate limiting, and service security — where our legitimate interest does not override your rights.
• —Legitimate interests (Article 6(1)(f)): the keyed hashes behind invite rewards, to make sure one person or one phone earns a reward once. They are pseudonymous, single-purpose and kept two years.
• —The website visit count described above holds no personal data, so it needs no legal basis of its own and no consent.
• —Legal obligation (Article 6(1)(c)): retaining financial/payment records as required by EU law, and responding to lawful data requests from authorities.
• —Consent (Article 6(1)(a)): location access for weather-based suggestions (you can withdraw this at any time via device settings).
• —Consent (Article 6(1)(a)): stylist memory, saving the short notes you share in chat so answers fit you. It is a separate choice, optional, withdrawable at any time, and not a condition of using the service.
• —Explicit consent (Article 9(2)(a)): the body details above — eye/hair/skin color, height and weight, and a photo of you — each separately, given in the app, withdrawable at any time, and not a condition of using the service.

We share data with the following processors under data processing agreements. All EU-based processing is GDPR-compliant.

Supabase

Hosts our database and authentication system. All user data (account, garments, outfits, wear logs) is stored in Supabase's EU infrastructure (currently Germany, eu-central-1). Supabase processes your authentication credentials and issues session tokens.

OpenRouter

All AI-powered features of the Service are routed through OpenRouter (OpenRouter Inc., USA), a model-agnostic inference gateway, under a data processing agreement. OpenRouter is instructed on every request that your content must not be used to train or improve any AI model. Model providers may retain request content for a short period solely to detect abuse and meet their legal obligations, after which it is deleted; they are contractually prohibited from using it for any other purpose. See OpenRouter's Privacy Policy.

AI Model Providers — Standard Mode (EU/US Servers)

By default, AI requests are routed only to a fixed list of vetted model providers operating EU or US infrastructure, each bound by a data processing agreement. Your content is never used to train AI models. No AI request content reaches servers outside the EU or US in Standard Mode.

Where a provider on that list processes data in the United States, the transfer is made under the EU–US Data Privacy Framework or, where a provider is not certified under it, under the European Commission's standard contractual clauses. The list is enforced in the request itself rather than by policy: every AI call names the permitted providers explicitly, and any response served from outside that list is logged as a compliance failure.

AI Model Providers — Performance Mode (Optional)

If you have opted in to Performance Mode via an explicit in-app consent screen, certain AI requests — style chat and outfit generation — may be routed to AI model providers whose infrastructure is located in the People's Republic of China. Performance Mode does not open routing to arbitrary providers: it permits the Standard Mode providers plus vetted providers in the jurisdiction named here, and nothing else. Routing to any additional jurisdiction would be a material change to this policy and would require fresh consent.

Important disclosure: The People's Republic of China does not have an EU adequacy decision under GDPR Article 45. Your AI request content (e.g. garment images, chat messages) is transferred to these servers solely on the basis of your explicit, freely-given, informed consent under GDPR Article 49(1)(a). These providers do not receive your account details, name, email, or payment data. You may withdraw this consent at any time under Profile → Privacy & Data → AI Processing Mode. Withdrawal takes effect immediately for all future requests.

Stripe

Processes subscription payments and manages billing. Stripe receives your payment details directly and returns subscription status to us. Stripe is PCI-DSS compliant. See Stripe's Privacy Policy.

Apple

Processes purchases made through Apple In-App Purchase in the iPhone app, and decides refunds for them. Apple is an independent controller of your payment and Apple ID data and sends us the purchase details described under Payment Data. See Apple's Privacy Policy.

Railway

Hosts our API server. Application logs (including IP addresses used in requests) may be retained by Railway for up to 90 days.

Weather API Provider

Receives your approximate city-level location to return local weather data for outfit suggestions. No personally identifiable data is sent beyond the city name or coordinates you provide.

vpnapi.io

Used at signup to detect VPN or proxy usage and assign your geographic access tier. Receives your IP address at the point of registration only. See Section 12 of the Terms of Service for details on geographic restrictions.

We do not share your data with any other third parties except as required by law.

• —Account and wardrobe data: retained for as long as your account is active. Permanently deleted within 30 days of account deletion.
• —Garment photos: stored in EU cloud storage (currently Germany) and deleted when you remove the item, delete your account, or request erasure.
• —Outfit and wear-log history: retained for the duration of your account. Exported and deleted with account deletion.
• —Payment records (Stripe and Apple purchase records): retained for 7 years as required by EU accounting and tax law, even after account deletion. The Apple purchase records we keep are unlinked from your account when it is deleted.
• —IP address / geo-tier at signup: retained in your user record for the lifetime of your account.
• —Rewards you earned from invites: kept with your account and deleted with it. The keyed hashes that remember a person or a phone has earned a reward (see Invites and Rewards) are kept for two years, then removed.
• —Application logs: retained by Railway for up to 90 days, then automatically purged.
• —Legal consent records (T&C acceptance timestamp, AI provider consent history, the record of each body-detail consent and withdrawal, and the record of each stylist-memory consent and withdrawal): retained as the legal record required under GDPR Article 7(1). After 180 days the IP address in them is replaced by a one-way hash and the device details are shortened.
• —Stylist memory notes: kept only while Memory is on. Turning it off, or deleting your account, deletes every note at once; you can delete any note, or all of them, at any time, and a note about a dated event is deleted automatically a few days after that date has passed.
• —Body details (eye/hair/skin color, height, weight, photo of you): kept only while the matching consent is on. Turning it off deletes them from your account immediately — except that, for everything but the photo, you may choose to keep what you entered stored but unused for up to 12 months, after which it is deleted automatically.

Data Retention on Plan Downgrade

When you downgrade from a paid plan (Pro or Premium) to the Free plan — whether by cancelling, failing to renew, or switching — your wardrobe items, outfit history, wear logs, chat sessions, and all other data are not deleted. Data that exceeds Free plan limits (for example, items beyond 12, wear history older than 30 days, or wishlist entries beyond 15) remains stored securely and will be fully accessible again if you upgrade. We do not reduce your stored data upon downgrade.

Virtual Try-On Renders

Virtual try-on renders are removed automatically together with your outfit history — within 30 days on Free, 90 days on Pro, and 365 days on Premium — and we never keep more than your 5 most recent renders per outfit. Try-Before-You-Buy results are deleted 30 days after creation on all plans.

Data Portability on Plan Change

You can request a full export of all your data — including wardrobe items, outfit history, wear logs, and style profile — at any time and regardless of your subscription status, by using the export function in Profile → Privacy & Data → Export My Data, or by contacting us at [email protected]. This right is guaranteed under GDPR Article 20 (Right to Data Portability) and is not conditional on holding a paid plan.

As an EU data subject, you have the following rights, which you can exercise at any time:

• —Right of access: request a copy of all personal data we hold about you.
• —Right to rectification: correct inaccurate or incomplete data.
• —Right to erasure ("right to be forgotten"): permanently delete your account and all associated personal data (except payment records retained by legal obligation).
• —Right to data portability: export your full wardrobe data, outfit history, wear logs, and profile as a structured ZIP archive.
• —Right to restriction of processing: request that we limit how we use your data while a dispute is resolved.
• —Right to object: object to processing based on legitimate interests.
• —Right to withdraw consent: turn off any group of body details at any time in Profile → Privacy Settings (the data it covered is erased at once). Turn off stylist memory at any time in Profile → Privacy → Memory (every note is deleted at once). Revoke location access at any time through device settings. If you have opted in to Performance Mode (AI processing on Chinese servers), you may withdraw that consent at any time in Profile → Privacy & Data → AI Processing Mode.

How to exercise your rights: Account deletion and data export are available directly in the app under Profile → Privacy & Data. For all other requests, contact [email protected]. We will respond within 30 days.

You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) if you believe your data has been processed unlawfully.

• —All data in transit is encrypted using TLS 1.2 or higher.
• —Data at rest is encrypted by our infrastructure providers (Supabase, Railway) using AES-256.
• —Authentication is managed by Supabase, which issues signed JWT tokens. Sensitive tokens are never stored in plain text.
• —All account, wardrobe, and payment data is stored within the EU. AI request content (garment images, chat messages) is processed in the EU/US by default. If you opt in to Performance Mode, AI request content may be processed on servers in the People's Republic of China — see Section 5.
• —Access to production systems is limited to authorised personnel only.

No system is completely immune to breach. In the event of a data breach that poses a risk to your rights, we will notify the relevant supervisory authority within 72 hours and affected users without undue delay, as required by GDPR Article 33/34.

Wardropic is not directed at persons under 16 years of age. We do not knowingly collect personal data from anyone under 16. If we become aware that a user is under 16, we will immediately terminate the account and delete all associated data without notice. If you believe a child under 16 has registered, please contact us at [email protected].

We may update this Privacy Policy from time to time. Material changes will be communicated with at least 14 days' notice via the app or your registered email address. The "Last Updated" date at the top of this page reflects the most recent revision.

Your continued use of Wardropic after the effective date of any update constitutes your acceptance of the revised policy. If you do not agree to the updated policy, you must stop using the Service and delete your account.