Privacy

This Privacy Policy (the „Policy") describes how Artbit Ltd., UIC 202339243, with registered office at 34 Preslav Street, Yambol, Bulgaria (the „Company", „we", „us") collects, uses, stores and protects your personal data when you use the DressBuddy service (the „Service") at dressbuddy.app.

This Policy is prepared in accordance with Regulation (EU) 2016/679 (GDPR) and the Bulgarian Personal Data Protection Act. By using the Service you confirm that you are familiar with this Policy.

1. Data controller

The data controller is Artbit Ltd., UIC 202339243. For any questions related to the processing of personal data:

• Email: privacy@dressbuddy.app
• General enquiries: support@dressbuddy.app
• Registered office: 34 Preslav Street, Yambol, Bulgaria

2. Personal data we collect

We process the following categories of data:

• Account data: email address, hashed password (bcrypt), date of registration, email-verification status.
• Photos you upload: a reference photo of yourself, photos of clothes (for the wardrobe or „Should I Buy?"), photos of items in „Marketplace".
• AI-generated content: try-on images, generated images of clothes, outfit suggestions, textual analyses — linked to your account.
• Wardrobe and preferences: data on clothes you have added, size, gender, favourite style, „want to buy" items.
• Payment data: subscription and top-up purchase history, credit balance, Stripe customer ID. Bank-card numbers are not stored on our side — they are processed directly by Stripe.
• Technical data: IP address, browser type, operating system, language, sign-in time, actions in the Service (for security and analytics).
• Cookies and local storage: session tokens (Auth.js JWT), app version, language setting, cookie consent.
• Correspondence: emails you send to support@ or privacy@.

We do not collect „special categories" of personal data within the meaning of Article 9 GDPR (race, political opinions, health data, etc.). Please do not upload photos that reveal such information.

3. Purposes and legal bases

We process your data on the following grounds (Article 6 GDPR):

• Performance of a contract (Art. 6(1)(b)) — to provide the Service: creating an account, generating AI recommendations, try-on images, product analyses, wardrobe, payment processing.
• Legal obligation (Art. 6(1)(c)) — for invoicing, accounting, responding to requests from competent authorities.
• Legitimate interest (Art. 6(1)(f)) — for platform security (fraud prevention, abuse), improving the Service through anonymisedstatistics, email notifications about material updates.
• Consent (Art. 6(1)(a)) — for marketing emails (if and when we start them), non-essential analytics cookies. You may withdraw consent at any time.

4. Photos and AI processing — details

Your photos are the most sensitive data we process. Therefore:

• Photos are transmitted to AI service providers (Anthropic, Replicate, Voyage AI) solely for the purpose of fulfilling your specific request.
• We do not use your photos to train our own models.
• We do not sell your photos to third parties.
• Anthropic and Replicate do not use the content of API requests to train their models (per their API terms).
• Photos are stored in our database (Neon, EU) and in object storage while your account is active. When an account is deleted, photos are removed within 30 days. You can delete your account yourself from Settings → Account.
• You may at any time delete individual photos from the wardrobe, outfits or WTB items — deletion is immediate from the UI and within 7 days from backups.

5. Recipients of personal data (processors)

To deliver the Service we use the following providers („processors") within the meaning of Article 28 GDPR. All are bound by data-processing agreements (DPAs):

• Anthropic, PBC (USA) — Claude AI models for photo analysis, outfit suggestions, product data extraction. Transfer under Standard Contractual Clauses (SCCs).
• Replicate, Inc. (USA) — generation of try-on images and AI images of clothes (nano-banana-pro, seedream-4.5). Transfer under SCCs.
• Voyage AI (USA) — text and multimodal embeddings for hybrid search across the catalogue. Transfer under SCCs.
• Stripe Payments Europe, Ltd. (Ireland) — payment processing for subscriptions and top-ups. Stripe is an independent controller for the payments.
• Neon, Inc. (USA) — managed PostgreSQL database with pgvector; region EU (Frankfurt). Transfer under SCCs.
• Vercel, Inc. (USA) — hosting and serverless execution of the application; primarily EU regions. Transfer under SCCs.
• Resend (USA) — sending transactional emails (registration confirmation, password reset, invoices). Transfer under SCCs.
• Oxylabs UAB (Lithuania) — proxy service for crawling partner catalogues (does not transmit any of your personal data — only anonymous requests to the stores).
• PostHog, Inc. — product analytics and session recordings (consent-based only). Data is hosted in the EU (Frankfurt) region. Session recordings mask text entered into form fields. Transfer under SCCs.
• Meta Platforms Ireland Ltd. (Ireland) — Facebook Login: if you choose to sign in with a Facebook account, Meta provides DressBuddy with your email, name and Facebook ID solely for account creation/identification. Transfer under the EU-U.S. Data Privacy Framework and SCCs.
• Google Ireland Ltd. (Ireland) — Google Sign-In: if you choose to sign in with a Google account, Google provides DressBuddy with your email, name and Google ID solely for account creation/identification. Transfer under the EU-U.S. Data Privacy Framework and SCCs.

We do not share personal data with other third parties unless we are required by law to do so (e.g. a court order, a criminal investigation).

6. International data transfers

Some of our processors are located outside the EEA (mainly in the USA). For every such transfer we apply at least one of the following safeguards:

• Standard Contractual Clauses (SCCs) approved by the European Commission (Decision 2021/914);
• EU-U.S. Data Privacy Framework — for certified providers;
• Additional technical measures: encryption in transit (TLS 1.3) and at rest, data minimisation.

7. Retention periods

• Account data and photos — while the account is active. On deletion — removed within 30 days.
• Financial records and invoices — 10 years (per Article 12 of the Bulgarian Accounting Act).
• Security logs (IP, actions) — up to 12 months.
• Email correspondence — up to 3 years after last contact.
• Cookies — by type: session (until the session ends), functional (up to 1 year).

8. Data security

We apply appropriate technical and organisational measures, including:

• traffic encryption via HTTPS / TLS 1.3;
• encryption at rest (Neon storage);
• password hashing with bcrypt (cost factor 10+);
• sessions with signed JWT tokens (Auth.js v5);
• strict per-user isolation at the database layer (per-user queries);
• restricted employee access to production data — only when operationally needed;
• periodic access reviews and security audits.

Despite all efforts, no transmission of data over the internet is 100% secure. If we detect a security incident affecting your data, we will notify you without undue delay (and within 72 hours notify the Bulgarian Data Protection Authority).

9. Cookies and similar technologies

DressBuddy uses the following types of cookies:

• Strictly necessary (always on) — session (Auth.js), CSRF, cookie consent, language setting.
• Functional — app version (for the changelog modal), interface preferences.
• Analytics (subject to consent) — PostHog (product analytics, EU-hosted): anonymous usage tracking (page views, clicks, funnels) and session recordings to help us improve the product. Recordings mask text entered into form fields — passwords and emails are not recorded. Loads only after “Accept all”.
• Marketing (subject to consent) — Meta Pixel for advertising and conversion measurement (e.g. registration, purchase). Loads only after “Accept all”.

You can manage cookies via the cookie banner on your first visit, or through your browser settings.

10. Your rights under GDPR

As a data subject you have the following rights:

• Right of access (Art. 15) — to obtain information about the data we process about you and a copy of it;
• Right to rectification (Art. 16) — to request correction of inaccurate data;
• Right to erasure („right to be forgotten", Art. 17) — to request deletion of the account and all related data. You can do this yourself and instantly from Settings → Account → „Delete profile"; alternatively write to privacy@dressbuddy.app;
• Right to restriction (Art. 18) — to request temporary suspension of processing;
• Right to portability (Art. 20) — to receive your data in a structured, machine-readable format (JSON);
• Right to object (Art. 21) — to processing based on legitimate interest;
• Right not to be subject to automated decisions (Art. 22) — the AI recommendations are informational and produce no legal effects; you always decide whether to follow the advice;
• Right to withdraw consent — at any time, without affecting the lawfulness of prior processing;
• Right to lodge a complaint with a supervisory authority: the Bulgarian Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd., Sofia, cpdp.bg.

To exercise your rights — write to privacy@dressbuddy.app. We respond within 30 days (extendable by a further 60 days for complex cases, of which we will notify you). Our service is free of charge, except for manifestly unfounded or excessive requests.

11. Automated decision-making and profiling

DressBuddy uses AI to analyse your style profile and generate personalised recommendations. This constitutes profiling within the meaning of Article 4(4) GDPR, but does not produce legal effects for you — the recommendations are informational. You always decide whether to buy a product or follow advice.

You may object to profiling, but this may make using the Service impossible (it is built around AI recommendations).

12. Children

The Service is intended for individuals aged 16 and above. We do not knowingly collect data from children under 16. If you believe we have received data from a child under 16 without a parent or guardian's consent, please contact us at privacy@dressbuddy.app and we will delete it immediately.

13. Changes to this Policy

We may update this Policy. For material changes (e.g. a new processor, a new purpose of processing) we will notify you by email or via an in-app notice at least 14 days before they take effect. The current version is always available at dressbuddy.app/privacy.

14. Contacts and DPO

For questions, requests to exercise your rights, or reports of irregularities:

Artbit Ltd., UIC 202339243
34 Preslav Street, Yambol, Bulgaria
Privacy email: privacy@dressbuddy.app
General enquiries: support@dressbuddy.app
Website: dressbuddy.app

The Company is currently not required to appoint a Data Protection Officer (DPO) under Article 37 GDPR, as it does not perform large-scale systematic monitoring or large-scale processing of special categories of data. If this changes, we will update this Policy.

For links to our other legal documents, see our Terms of Service.

Version dated 2026-06-30. We recommend that you review this page periodically for the current terms of processing of your personal data.