OutfelloPrivacy Policy
Information about the processing of your personal data, provided under Articles 13 and 14 of the General Data Protection Regulation.
Effective 17 September 2026
1. Controller
The controller of your personal data is BNSM s. r. o., IČO 57731152, registered in the Slovak Republic. Our registered seat is given on the imprint page.
Contact for all data protection matters: [email protected].
2. Purposes and legal bases
| Data | Purpose | Legal basis |
|---|---|---|
| Email address and password hash, or passkey credentials | Creating and securing your account, signing you in, sending verification and password-reset emails | Performance of a contract - Art. 6(1)(b) |
| Outfit photos you upload for import | Detecting the individual garments in the photo and producing a cut-out of each one | Performance of a contract - Art. 6(1)(b) |
| Model reference photo | Generating previews that show a garment as worn | Consent - Art. 6(1)(a) |
| Garment records - cut-out image, part, colours, labels | Providing the wardrobe catalogue | Performance of a contract - Art. 6(1)(b) |
| Billing data - plan, subscription status, payment state, usage counters | Charging for paid plans, enforcing plan limits, issuing and retaining invoices | Performance of a contract - Art. 6(1)(b); legal obligation under accounting and tax law - Art. 6(1)(c) |
| Technical data - IP address, user agent, session cookies, import job logs | Securing the service against unauthorised access and automated abuse, and diagnosing failed imports | Legitimate interests - Art. 6(1)(f). The interests pursued are the security, integrity, and continued operation of the service. |
| Usage data - pages visited, actions in the app, error reports, browser and device details, IP address, the text prompts and responses of AI requests; when you are signed in, your account ID, email address and name | Understanding how the service is used, finding and fixing errors, and monitoring the quality and cost of AI generations | Legitimate interests - Art. 6(1)(f). The interests pursued are improving the service and keeping it reliable. Analytics runs without cookies and stores nothing on your device. |
3. Recipients
We disclose personal data to the service providers that process it on our behalf as processors. Each is identified, by name or by category, together with the data it receives and its location, on the sub-processors page.
We may also disclose personal data to public authorities where we are required to do so by law.
4. Transfers to third countries
Some of our processors are established in the United States, so your personal data - including photographs you upload - is transferred outside the European Economic Area. These transfers are made on the basis of the European Commission’s Standard Contractual Clauses adopted under Article 46(2)(c) of the GDPR, and, where applicable, the recipient’s certification under the EU-US Data Privacy Framework.
You may obtain a copy of the safeguards applying to a given transfer by writing to [email protected].
5. Retention
| Data | Retention period |
|---|---|
| Account data and garment records | For the duration of your account, then erased within 30 days of your account being closed or an erasure request being granted |
| Uploaded source photos | Erased on completion of the import job; photos from failed jobs are erased within 30 days |
| Model reference photo | Until replaced, deleted, or your consent is withdrawn |
| Billing and invoice records | 10 years from the end of the accounting period concerned, as required by Slovak accounting and VAT legislation |
| Security and import logs | 12 months from creation |
| Usage analytics and error reports | 12 months from collection |
6. Your rights
You have the right to:
- Request access to your personal data, and a copy of it.
- Request rectification of inaccurate or incomplete data.
- Request erasure of your data.
- Request restriction of processing.
- Receive your data in a structured, commonly used, machine-readable format, and have it transmitted to another controller.
- Object to processing carried out on the basis of our legitimate interests.
- Withdraw your consent at any time, where processing is based on consent. Withdrawal does not affect the lawfulness of processing carried out before it.
To exercise any of these rights, write to [email protected].
You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, place of work, or of the alleged infringement. The competent authority for us is the Úrad na ochranu osobných údajov Slovenskej republiky (Slovak Data Protection Authority), dataprotection.gov.sk.
7. Whether you must provide this data
Providing your email address and authentication credentials is a contractual requirement: without them we cannot create an account or provide the service. Providing photographs is necessary in order to use the import feature; without them no garments can be produced. Providing billing data is a contractual requirement for paid plans, and its retention is a statutory requirement under accounting law.
Providing a model reference photo is optional and based on consent. If you do not provide one, all other features remain available; only worn previews cannot be generated.