Privacy policy

• Account data — email address, display name and profile photo. If you sign in with Google, we receive these from Google; we never receive your password.
• Style profile — the answers you give during onboarding: gender, age range, height, weight, country, preferred brands, colours, sizes and budget.
• Wardrobe items — clothing you choose to add to your digital wardrobe, including any images you upload.
• Product interactions — items you save, skip, open or click through to a retailer, used to improve your recommendations.
• Technical data — IP address, browser type and pages viewed, collected in server logs for security and troubleshooting.

We process your data to create your account, generate personalised recommendations, keep your wardrobe and wishlist in sync across devices, prevent abuse, and meet our legal obligations. Personalisation is performed on the data listed above only — we do not build profiles from data bought from third parties.

The legal bases are performance of a contract (running your account), legitimate interests (security, service improvement, affiliate attribution) and consent (optional analytics cookies, marketing email).

We do not sell personal data. We share it only with processors that operate the service: Supabase (database, authentication and file storage), Google (only if you use Google sign-in) and our hosting provider. When you click through to a retailer, the affiliate network records the referral — this is a click identifier and does not include your name, email or style profile.

Account and style data are kept while your account is open. Delete your account from Settings and we remove your profile, wardrobe, wishlist and interaction history within 30 days, except records we must retain for accounting or fraud prevention.

Under the GDPR you can request access, correction, deletion, restriction, portability, and object to processing based on legitimate interests. You can withdraw cookie consent at any time from the cookie policy page. Email privacy@dressmate.ai and we will respond within 30 days. You also have the right to complain to your national data protection authority.

Data is transmitted over HTTPS and stored in a managed Postgres database with row-level security, so each account can only read its own records. Administrative access is limited to named staff and protected by two-factor authentication.

Monmaks d.o.o., Bulevar Crnogorskih serdara 5/6, Lamela F, 81000 Podgorica, Montenegro — hello@dressmate.ai