Privacy Policy
Effective date: 2026-10-04
Version: 1.1.0
Introduction
Welcome to TCA ("The Clothing App"), a subscription-based service owned and operated by Hello Computer, a registered trade name of MY STATIC SELF Ltd. ("Company," "we," "us," or "our"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our services, including any related websites, applications, or platforms (collectively, the "Services").
By accessing or using our Services, you indicate that you have read, understand, and agree to the terms of this Privacy Policy. If you do not agree, you should discontinue use of our Services.
Information We Collect
Personal Information
- Username
- Email address
- First and last name
- Any images of clothing or other user-generated content that you choose to upload
- If you use the AI image features: photos of yourself that you submit to create a model photo, images of clothing you import, and the images we generate for you (model photos, try-ons, and studio flat lays). See AI Image Features & Face Data.
We do not collect sensitive personal information (e.g., health or financial details) beyond the necessary payment details that may be handled by our payment processor.
Non-Personal Information
- Log and Usage Data: This can include your IP address, browser type, operating system, and device type.
- Cookie Data: We use strictly necessary cookies (e.g., for authentication) and analytics cookies (e.g., PostHog) to help us understand how you interact with our Services.
Payment Information
We partner with Polar (our Merchant of Record) for subscription and payment management. When you purchase or subscribe to our Services, your payment information is provided directly to Polar and is subject to their privacy practices.
How We Collect Your Information
Information You Provide Directly
- Account Creation: When you create or update your account, we collect the information you provide.
- Communications: If you contact us by email or through any support channels, we collect the information you provide.
Automated Data Collection
- Analytics: We use PostHog for analyzing user behavior and improving our Services.
Third-Party Sources
- Payment Processor: Transaction-related data may be shared with us by our payment partner, Polar, for purposes of subscription management and record-keeping.
How We Use Your Information
We use the information we collect for various purposes, including to:
- Provide and Maintain the Services: Ensure proper account functionality, process payments, and facilitate image uploads.
- Improve User Experience: Analyze usage patterns and tailor your interaction with the platform.
- Communicate With You: Send you updates, respond to inquiries, and provide customer support.
- Perform Analytics: Understand how users interact with our Services, refine our features, and troubleshoot performance issues.
- Enforce Our Terms and Policies: Comply with legal requirements and protect our rights and interests.
AI Image Features & Face Data
TCA's AI image features (the Fitting Room) generate images for you: a studio model photo of you created from photos you provide, try-on images of you wearing pieces from your closet or pieces you import, and studio flat lays of your clothing items. Using these features is optional.
How your images are processed
- To generate an image, the photos involved (your photos, your model photo, and clothing images) are sent from our servers to Google's Gemini API, which processes them only to produce the image you requested, under Google's API terms. The result is returned to your account. Images are transmitted over encrypted connections.
- Photos you submit to create a model photo are used for that request only. We do not store them; we keep only the model photo that is generated from them.
- When you import a piece from a product link, the product page and image are fetched by your device, not by our servers. The imported image is then uploaded to your account.
Face data
TCA does not collect, detect, or analyze face data. The photos you provide may include your face, because the Fitting Room generates images of you. However, we do not run facial recognition or face detection, we do not extract facial geometry, landmarks, measurements, or embeddings, and we do not create a biometric identifier or template from your photos. Face ID is never used by the app.
- Use. Your photos are used for one purpose: to generate the model photos, try-ons, and flat lays you request. We do not use them for advertising, analytics, or identity verification, and we do not use them to train AI models.
- Sharing. To generate images, your photos are sent to Google's Gemini API as described above. No other third party receives your photos of yourself, your model photos, or your try-ons. We do not sell photos or share them for anyone else's purposes.
- Storage. Model photos, try-ons, and imported clothing images are stored in private storage on Supabase, accessible only through your authenticated account by short-lived links. A studio flat lay you create becomes the cover photo of that clothing item and is stored with your other closet photos.
- Retention and deletion. Generated and imported images are kept until you delete them or your account. Deleting a model photo, try-on, or imported piece in the app deletes its stored copy from our servers. A flat lay used as an item's cover photo stays with that item until you delete the photo or the item. Deleting your account permanently deletes all of your photos and generated images. You can also request deletion by emailing hello@theclothingapp.com, and we will complete it within 30 days.
Only upload photos of yourself, or of someone who has given you permission. Do not upload photos of minors to the AI image features.
Marketing Communications
From time to time we may send you emails about TCA or other products and services we offer.
Legal Basis
- EU / UK: We rely on the“soft opt-in” legitimate interest exception for existing customers (Art 21(2) e-Privacy Directive). You can object at any time by clicking Unsubscribe.
- Canada: Under CASL we send messages only where we have express consent or anexisting business relationship. Implied consent lasts for 24 months after your last purchase or account activity.
- United States: We comply with theCAN-SPAM Act (15 U.S.C. §7701 et seq.).
Your Choices
Every marketing email includes a one-click Unsubscribe link. You may also email hello@theclothingapp.com with the subject line “Unsubscribe” and we will honour your request within 10 business days. Opting out does not affect transactional or service emails (e.g. password resets, billing notices).
Sender Information
All commercial messages are sent by:
Hello Computer / MY STATIC SELF Ltd.
172 Manitou Way, Ancaster, Ontario, Canada L9G 1X8
Legal Basis for Processing (EU/UK Residents)
| Purpose & Data Category | Lawful Basis (GDPR/UK GDPR Art 6) | Notes / Your Rights |
|---|---|---|
| Account creation & authentication (email, password, OAuth token) | Contract – Art 6 (1)(b) | Necessary to deliver the Service you request. |
| Subscription fulfilment (transaction ID, plan tier) | Contract – Art 6 (1)(b) | |
| Accounting & tax records (transaction logs) | Legal obligation – Art 6 (1)(c) | Required for tax compliance and audits. |
| Product analytics (PostHog event data; IP addresses are pseudonymised and truncated)1 | Legitimate interest – Art 6 (1)(f) | Used to improve the Service. You can opt-out at any time in My Account → Privacy. |
| Marketing & product-update emails | Legitimate interest (“soft opt-in”) – Art 6 (1)(f) | Emails relate to our own, similar services. Every message includes an unsubscribe link. |
| User-uploaded images (clothing photos) | Contract – Art 6 (1)(b) | Processed solely to power closet and outfit features you request. |
| Security & fraud prevention logs (IP, failed login metadata) | Legitimate interest – Art 6 (1)(f) | Essential to keep accounts secure and detect abuse. |
| Legal or dispute-resolution archiving | Legitimate interest / Legal obligation – Art 6 (1)(f) or (c) | Data may be retained as needed to establish, exercise, or defend legal claims. |
Disclosure of Your Information
We may share your information in the following situations:
Service Providers
We engage third parties (e.g., Supabase for cloud hosting, Polar for payment processing) to assist with certain tasks. These third parties are contractually bound to protect your data and only use it to perform specific services for us.
All third-party vendors that process personal information on our behalf have executed a Data-Processing Agreement (DPA) or equivalent Article 28 GDPR terms, except where a vendor acts as an independent controller (see table). We review DPA compliance annually. We will update this list when we add or replace a provider, and notify you of material changes as described in Updates to This Policy.
Provider Purpose Personal Data Location / Transfer Mechanism DPA Status Supabase Database, authentication, image storage Email, hashed password, clothing images us-east-1 (USA) — SCCs Signed Vercel Hosting & edge delivery for the front-end IP addresses in server logs us-east-1 (USA) — SCCs Signed Polar (Merchant of Record) Payment processing & tax remittance Billing name, email, transaction details Worldwide — independent controller Acts as controller; DPA not required* PostHog Product analytics Pseudonymised event data, truncated IP US Cloud — SCCs Signed Resend Transactional & marketing email delivery Email address, message metadata us-east-1 (USA) — SCCs Signed Sentry Error monitoring Stack traces, possible user IDs US — SCCs Signed Google (Gemini API) AI image generation (model photos, try-ons, flat lays) and clothing classification Photos you submit, model photos, clothing images USA — SCCs Included in API terms Anthropic Describing and categorizing clothing photos; AI Stylist responses Clothing photos, wardrobe descriptions, Stylist requests USA — SCCs Included in API terms OpenAI Search embeddings; AI Stylist responses Wardrobe text (names, descriptions, tags), Stylist requests — no photos USA — SCCs Signed RevenueCat In-app subscription and credit purchase management App user ID, purchase and subscription status USA — SCCs Included in terms Apple (App Store) In-app payment processing Purchase transactions (handled by Apple) Worldwide — independent controller Acts as controller; DPA not required * As Merchant of Record, Polar determines its own purposes for processing payment data and therefore acts as an independent controller under GDPR/CCPA.
Legal Obligations
We may disclose information if we believe doing so is necessary to comply with applicable laws, respond to legal processes, or protect the rights, property, or safety of Hello Computer, our users, or others.Business Transactions
In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred. We will notify you if such a transfer occurs and becomes subject to a different privacy policy.With Your Consent
We may share your personal information in other ways if you have provided explicit consent.
Data Storage & Retention
We keep personal information only as long as necessary for the purposes described in this Policy—or as required by law. The table below outlines our standard retention periods and the criteria we use to determine when data is deleted or anonymised.
| Data Category | Examples | Retention Rule / Period |
|---|---|---|
| Account credentials & identifiers | Email, username, OAuth UID | Until the user deletes their account + 30 days |
| Authentication tokens | sb-…auth-token cookies | Rotates on each login; max 12 months of inactivity1 |
| User-uploaded images | Closet & outfit photos | Until the user deletes their account + 30 days |
| Photos submitted to create a model photo | Photos of yourself | Not stored; used only for the generation request |
| AI-generated & imported images | Model photos, try-ons, flat lays, imported clothing | Until the user deletes them or their account |
| Image credit records | Credit balance, credit transactions | Until the user deletes their account |
| Subscription & payment records | Transaction ID, invoices | For as long as required by applicable tax law (typically 7–10 years) |
| Product analytics events | Page views, button clicks, truncated IP | PostHog default retention: 25 months2 |
| Support communications | Emails or in-app messages | Until the user deletes their account + 30 days |
| Server / access logs | Vercel edge logs, Supabase query logs | 7 days |
| Backup archives | Automated DB snapshots | 7 days (point-in-time recovery window) |
| Email marketing lists & opt-out list | Active subscriber list, suppression list | For as long as we send marketing emails |
| Legal / dispute-resolution files | Chargeback records, legal correspondence | 6 years |
1 Supabase auth tokens expire 12 months after issuance but are refreshed on each successful login.
2 PostHog's default retention is 25 months; we periodically aggregate older data or delete it outright.
Security Measures
We implement commercially reasonable security measures to protect your information, including encryption, secure servers, and restricted access. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.
Your Rights and Choices
Depending on your location, you may have legal rights to:
- Access and Review: Request details of the personal information we hold about you.
- Correction: Update or correct any inaccuracies.
- Deletion: Delete your account and associated data.
- Objection/Restriction: Object to or restrict certain data processing activities.
- Withdrawal of Consent: Withdraw any previously given consent.
To exercise these rights, please contact us at hello@theclothingapp.com.
Note on Jurisdiction:
- If you are an EU resident, the GDPR may govern how we process your data. We endeavor to comply with GDPR principles for EU residents.
- If you are a California resident, the CCPA may provide certain additional rights regarding your personal information.
- If you are a Canadian resident, PIPEDA may apply.
Because we may have customers globally, we aim to follow relevant data protection regulations to the extent they apply to us.
Supplemental Notice for California Residents
This section applies only to residents of California and supplements the information elsewhere in this Privacy Policy. Capitalized terms have the same meaning as in the California Consumer Privacy Act (as amended by the CPRA).
Personal Information Collected in the Last 12 Months
| Category (Cal. Civ. Code §1798.140) | Examples | Collected | Sold / Shared† | Disclosed to Service Providers | Business / Commercial Purpose | Retention Period |
|---|---|---|---|---|---|---|
| Identifiers | Name, email, username | Yes | No | Supabase (auth), Resend (email) | Account creation, login, support | Until account deletion |
| Customer Records | Transaction ID, plan tier | Yes | No | Polar (Merchant of Record) | Subscription fulfilment, tax compliance | Indefinite (tax & audit) |
| Internet / Electronic Activity | In-app events, truncated IP | Yes | No | PostHog (analytics) | Product improvement | Indefinite |
| Audio, Electronic, Visual Info | User-uploaded clothing images | Yes | No | Supabase (storage) | Provide closet / outfit features | Until account deletion |
| Sensitive Personal Information | None | No | N/A | N/A | N/A | N/A |
† “Sell” means exchanging personal information for money or other valuable consideration. “Share” means disclosing it for cross-context behavioural advertising. We do not currently sell or share personal information. If that ever changes (e.g., we add third-party ad pixels), we will update this notice and provide a“Do Not Sell or Share My Personal Information” link before such activity begins.
Your CCPA / CPRA Rights
California residents may request to (1) know, (2) correct, (3) delete, or (4) obtain a copy of their personal information. You also have the right to limit the use of any sensitive personal information (none is collected) and to be free from retaliation for exercising these rights. To submit a request, email hello@theclothingapp.com. We will verify your identity as required by law and respond within 45 days.
Children's Privacy
Our Services are not directed to, and we do not knowingly collect personal information from, any person under 13 years of age in the United States or Canada, or 16 years of age in the European Economic Area (“EEA”) and United Kingdom—except where the applicable member-state or local law sets a lower age of digital consent (never below 13).
If we learn that we have collected personal information from a child below the relevant age threshold without verifiable parental consent, we will delete that information as quickly as possible. Parents or legal guardians who believe their child has provided us with personal information may email hello@theclothingapp.com to request deletion.
International Data Transfers
Hello Computer is based in Canada, but several of our service providers operate from — or store data in — the United States. Whenever personal information leaves your jurisdiction, we rely on one of the following legal safeguards:
- EU Standard Contractual Clauses (SCCs).
- EU-US & UK-US Data-Privacy Framework (DPF) for vendors that are self-certified in the U.S.
| Provider | Host Country / Region | Transfer Mechanism | Key Safeguards |
|---|---|---|---|
| Supabase | USA (us-east-1) | SCCs (2021/914) | End-to-end TLS, encryption at rest [oai_citation:0‡Supabase](https://supabase.com/downloads/docs/Supabase%2BTIA%2B250314.pdf) [oai_citation:1‡Supabase](https://supabase.com/privacy) |
| Vercel | USA (edge network) | EU-US DPF UK Extension DPF | Self-certified June 4 2024 [oai_citation:2‡Vercel](https://vercel.com/changelog/vercel-is-now-certified-under-the-eu-us-data-privacy-framework-dpf) |
| PostHog Cloud | USA | EU-US DPF UK Extension DPF | Active certification since May 8 2024 [oai_citation:3‡Data Privacy Framework](https://www.dataprivacyframework.gov/participant/2915) |
| Resend | USA | EU-US DPF UK Extension DPF | DPA §11 confirms DPF adherence [oai_citation:4‡Resend](https://resend.com/legal/dpa) |
| Sentry | USA | EU-US DPF UK Extension DPF | Self-certified; public listing available [oai_citation:5‡Sentry](https://sentry.io/trust/privacy/) |
| Polar (Merchant of Record) | Payment processing & tax remittance | Billing name, email, transaction details | USA — Privacy Shield† / SCCs *Acts as independent controller |
For copies of the SCCs or details on a vendor's DPF certification, please contact us at hello@theclothingapp.com.
Third-Party Links
Our Services may contain links to third-party websites. We do not control, and are not responsible for, the privacy practices or content of these third-party sites. We encourage you to review their privacy policies before providing them with any personal data.
Updates to This Policy
We may update this Privacy Policy from time to time. When we do, we will change the "Effective date" at the top of this page. Your continued use of our Services after these changes indicates your acceptance of the revised policy.
Contact Us
If you have questions about this Privacy Policy or wish to exercise any data rights, please contact:
Hello Computer / MY STATIC SELF Ltd.172 Manitou Way
Ancaster, Ontario
Canada L9G 1X8
Email:hello@theclothingapp.com
Complaints
We hope to resolve any privacy concern quickly and satisfactorily. If you believe we have not addressed your issue, you have the right to lodge a complaint with your local supervisory authority:
- European Economic Area (EEA) — You may contact the data-protection authority in the member state of your habitual residence or workplace. A full list is available at edpb.europa.eu.
- United Kingdom — Information Commissioner's Office (ICO), ico.org.uk.
- Canada — Office of the Privacy Commissioner of Canada (OPC):
30 Victoria Street, Gatineau QC K1A 1H3 — Tel 1-800-282-1376 — priv.gc.ca
We have not appointed an EU representative under GDPR Art 27 because we do not undertake large-scale processing in the EEA. Should this change, we will update this section accordingly.
Change Log
| Date | Version | Summary of Changes |
|---|---|---|
| 2026-10-04 | v1.1.0 | Added AI Image Features & Face Data; added Google, Anthropic, OpenAI, RevenueCat, and Apple as service providers; added retention rules for AI images and credits; removed the 30-day sub-processor notice period. |
| 2025-07-16 | v1.0.0 | Initial publication of comprehensive Privacy Policy. |