Privacy Policy

1. Data we collect

We do not collect: height, weight or body measurements; your device location; your contacts; your photo library (only photos you select); government identification; or your age beyond your confirmation that you are an adult.

2. Photos, My Model and AI-generated images

Photos of a person’s face or body may be treated as biometric or special-category data under some laws. We apply the terms below to every photo, wherever you live.

• Optional. My Model is never required. Without it, looks are drawn on a standard model.
• Consent. Before any photo can be taken or selected, you must confirm that you are an adult and separately consent to the processing of your photo to create looks for you. Both confirmations are recorded with a timestamp. Our servers refuse to analyse or draw from a photo if either is missing.
• Preparation. Before upload, the photo is resized and re-encoded on your device, which removes embedded metadata including location and capture time.
• Storage. One reference photo per account, in private storage readable only by your account. A new photo replaces the previous one. It has no public link.
• Use. The photo is used only to (1) produce an analysis of general colouring and face shape, and (2) serve as a visual reference when drawing the looks you request. It is processed by an AI service provider for these purposes, and checked by an automated content-moderation service.
• No identification. We do not create a facial-recognition template or faceprint, do not compare your photo with any other image or database, and do not use it to identify you or anyone else.
• No sensitive inferences. The analysis does not infer or record ethnicity, health, weight, body shape, age or attractiveness. Only fixed styling categories are stored.
• No training, no sale, no advertising. Photos and generated images are not used to train or fine-tune AI models, are not sold, and are not used for advertising.
• Minors. A photo that clearly shows a child is not used to generate anything. We do not estimate, store or display age.
• Generated images. Images drawn on you are synthetic. They are private to your account, stored in private storage and served only through links that expire. They are never added to the public feed or shown to other users. They leave your account only if you share them.
• Other people. You may submit only photos of yourself, or of adults who have agreed. See the Terms of Use.
• Photos in conversations. A photo you send in a conversation is used only to advise you. It is not used to generate images of you; that requires My Model and consent.
• Deletion. “Delete my face data” immediately and permanently removes the reference photo, its analysis and your consent record. Deleting your account removes all photos and generated images.

3. How we use personal data

We use personal data to:

• provide the Service: converse with you, give recommendations, draw looks and refinements, maintain your Wardrobe and style profile;
• authenticate you and manage your account, credits and subscription;
• moderate content and enforce our Terms of Use, including limits and restrictions;
• prevent fraud, abuse and misuse, including repeated use of free looks;
• send notifications and reminders you opted into;
• diagnose errors, maintain security and improve the Service;
• respond to your requests and comply with legal obligations.

We do not sell personal data. We do not share personal data for advertising or cross-context behavioural advertising. We do not build advertising profiles. We do not use your photos or conversations to train AI models. We do not use your photos to identify any person. We do not display your data to other users.

4. Who receives personal data

We disclose personal data only to the following categories of recipients, each limited to what it needs for its function and bound by contract to use the data only on our instructions and not to use it to train its own models.

We may also disclose personal data where required by law or valid legal process; to protect the safety, rights or property of any person or of Freya; to detect and prevent fraud, abuse or illegal content, including reporting content involving minors to the competent authorities; and in connection with a merger, acquisition or sale of assets, in which case the recipient is bound by this Policy or you will be notified and given a choice.

Other users never receive your personal data. The public Inspiration feed contains no user data.

5. Notifications and calendar

• Notifications and calendar access are optional, independent, and off until you enable them.
• Reminders are scheduled locally on your device. They state only the type of occasion and the day, never a title or place, and are limited in frequency.
• Calendar access is read-only in Freya’s code. Titles, notes, guests and locations are classified on your device and are not uploaded, synced or stored by us. Some operating systems offer no read-only calendar permission; the system prompt you see may request broader access than Freya uses.
• Push registration is created only after you opt in, and is removed when you sign out, turn notifications off or delete your account.
• Reminder data kept on your device is erased when the occasion passes, when you disconnect the calendar, when you sign out, when you delete your account or when you uninstall the app.

6. Safety, moderation and automated decisions

Messages, photos, look descriptions and reference photos are automatically screened by a content-moderation service before they are processed. Prohibited content is refused. Serious or repeated violations are recorded and may lead to restriction of the account. These decisions are automated. You may request human review at [email protected].

We apply usage limits per person to keep the Service available.

Safety and usage records contain no message, photo or image content. They are kept only as long as needed for abuse, fraud and cost prevention, and are then deleted automatically.

7. Retention and deletion

• While your account exists, we keep your data to provide the Service. Freya also removes older conversations and unsaved generated looks from time to time.
• Reference photo: until you delete it or delete your account.
• Deleting your account permanently deletes the data associated with it, including your photos, generated images, conversations, Wardrobe, preferences, credits, subscription records, feedback and push registration. Deletion is immediate and cannot be undone.
• One exception: to prevent abuse of free looks and limits, we keep a one-way cryptographic hash of your sign-in identity, together with non-identifying safety and usage records. They contain no readable personal data and cannot be reversed into your identity.
• Providers: diagnostics and analytics data is kept by those providers under their own retention rules, and is deleted on request.
• Backups: copies in infrastructure backups expire on the regular backup cycle.

8. Your controls and requests

In the app:

• Delete my face data (Settings): removes your reference photo, its analysis and your consent record.
• Remove a look from your Wardrobe.
• Edit or remove your style preferences.
• Notifications and calendar: turn off or disconnect in Settings.
• Delete account (Settings): permanently deletes your account and the data associated with it. It also withdraws Freya’s access to your sign-in account and requests deletion of your customer record with our subscription management provider. Deleting your account does not cancel a subscription; cancel it in your app store subscription settings.

For any other request (access, copy, correction, deletion, restriction, objection, portability, withdrawal of consent, human review of an automated decision, or removal of analytics data), write to [email protected] from the e-mail address of your account. We respond within the period required by the law that applies to you. We may verify your identity. We do not charge for reasonable requests. We do not discriminate against you for exercising your rights.

9. GDPR (European Union / EEA)

Freya complies with the General Data Protection Regulation. We process personal data only where we have a lawful basis: performance of our contract with you to provide the Service; your consent for your reference photo, notifications and calendar; our legitimate interests in security, fraud and abuse prevention, diagnostics and cost control; and legal obligation where applicable. A face or body photo is processed only with your explicit consent, collected separately before any photo is processed, recorded, and withdrawable at any time. We do not use photos to uniquely identify anyone and do not infer special categories of data from them.

You have the right to access, rectify, erase, restrict and port your data, to object to processing, to withdraw consent, and to have automated decisions reviewed by a person. You can exercise these rights in the app or by e-mail. We collect only the data we need, keep it only as long as needed, protect it with appropriate technical and organisational measures, and use service providers only under contracts that bind them to our instructions. Where data is transferred outside the EEA, we use approved safeguards such as standard contractual clauses. We notify the supervisory authority and affected persons of breaches as required. The Service is for adults only. You may complain to your local supervisory authority at any time.

10. UK GDPR

Freya complies with the UK GDPR and the Data Protection Act 2018. Everything stated in the GDPR section applies equally to users in the United Kingdom. Where data is transferred outside the United Kingdom, we use approved safeguards. You may complain to the Information Commissioner’s Office.

11. LGPD (Brazil)

Freya complies with the Lei Geral de Proteção de Dados (Lei 13.709/2018). We process personal data on the legal bases the law provides, namely performance of a contract, legitimate interest, legal obligation and, for your reference photo, notifications and calendar, your specific and highlighted consent. Photos are treated as sensitive data and processed only on your specific consent and for the stated purposes. We follow the principles of purpose, adequacy, necessity, free access, data quality, transparency, security, prevention, non-discrimination and accountability.

You may at any time request confirmation of processing; access; correction; anonymisation, blocking or deletion; portability; information about the entities we share data with; information about the possibility of refusing consent and its consequences; revocation of consent; and review of automated decisions. Requests are received at [email protected], which is also our channel for the ANPD. Where data is transferred outside Brazil we rely on mechanisms accepted by the LGPD. The Service is for adults only. We notify the ANPD and data subjects of security incidents as required. You may petition the ANPD (Autoridade Nacional de Proteção de Dados).

12. CCPA / CPRA (California)

Freya complies with the California Consumer Privacy Act as amended by the California Privacy Rights Act. In the past twelve months we have collected identifiers, commercial information, internet and app activity, images and inferences used for styling, as described in “Data we collect”; and, with your consent, photos that may be considered sensitive personal information. We do not sell personal information and do not share it for cross-context behavioural advertising. We use sensitive personal information only to provide the Service you request and for security and fraud prevention, and do not use it to infer characteristics about you.

You have the right to know, access, delete and correct your personal information, to opt out of sale or sharing (which we do not do), and to be free from discrimination for exercising your rights. Submit requests to [email protected]; authorised agents may do so with proof of authorisation. We do not knowingly collect personal information from anyone under 18, and offer no financial incentives for personal information.

13. Other U.S. state privacy laws

Freya complies with the comprehensive state privacy laws that apply to it, including those of Virginia, Colorado, Connecticut, Utah, Texas, Oregon and Montana. Residents of those states may confirm, access, correct, delete and obtain a portable copy of their personal data, and may appeal a decision on a request by replying to our response and, if still unresolved, contacting their state attorney general. We obtain your consent before processing sensitive data such as photos, and we do not sell personal data or use it for targeted advertising or for profiling that produces legal or similarly significant effects. Requests: [email protected].

14. Biometric privacy laws (Illinois, Texas, Washington and similar)

Freya does not create or store faceprints, face-geometry templates or any biometric identifier used to identify a person. Even so, before processing any photo we give you written notice of the purpose (styling and drawing looks for you) and of how long we keep it (until you delete it or your account), and obtain your written, explicit consent, which you may withdraw at any time. We do not sell, lease, trade or otherwise profit from photos or any data derived from them, and we disclose them only to the service providers needed to provide the Service, or as required by law.

15. Children (COPPA and similar)

The Service is for adults and is not directed to children. We do not knowingly collect personal data from anyone under 18, and a photo that clearly shows a child is not used to generate anything. If we learn that a minor has an account, we delete it and its data. To report such a case, write to [email protected].

16. Other countries

Freya also follows the data-protection laws of other countries where it is offered, including Canada (PIPEDA and provincial laws), Australia (Privacy Act and Australian Privacy Principles), Japan (APPI), South Korea (PIPA), Thailand (PDPA) and Vietnam. In each, we tell you what we collect and why, obtain consent where the law requires it (including for photos and for transfers abroad), collect only what is necessary, and honour your rights of access, correction, deletion, restriction and withdrawal of consent. Wherever you live, the commitments in this Policy apply to you, and we honour the rights your local law grants you.

17. Security

We protect personal data with technical and organisational measures appropriate to its sensitivity: encryption in transit; private storage with per-account access controls enforced at the database and storage level; expiring links to images; verification of your identity on every request; and no image content, links or tokens in logs.

18. International transfers

Your personal data may be transferred to and processed in countries other than your own, which may not offer the same level of data protection. Where required, we use standard contractual clauses or other lawful transfer mechanisms.

19. Use of AI

Freya is an artificial-intelligence system. Replies and images are generated automatically, may be inaccurate, and are not professional advice. Generated images are synthetic illustrations.

20. Contact

Privacy questions and requests: [email protected].