DreamfitPrivacy Policy
1. Who we are
Dreamfit is operated by [Dreamfit Legal Entity, Inc.] ("Dreamfit", "we", "us"), registered at [123 Example Blvd, Dover, Delaware, USA]. We provide a web service that lets you upload a photo and see AI-generated virtual try-on imagery of clothing.
For privacy questions: [email protected]. Our Data Protection Officer / EU representative: [[email protected] / EU rep address].
2. Scope
This Policy applies to dreamfit.app and related subdomains, our web app, and anyone using our services in the United States and European Economic Area. It does not cover third-party stores you reach through "Shop the look" affiliate links — those have their own policies.
3. What we collect
| Category | Examples | Source |
|---|---|---|
| Account | Google name, email, Google user ID, avatar | Google OAuth (you authorize) |
| Uploaded photos | The portrait/body photo you upload for try-on | You provide |
| Generated images | AI try-on result images | Created by our service |
| Derived biometrics | Face/body geometry extracted to perform try-on (special-category) | Computed from your photo |
| Usage & device | IP address, browser, pages viewed, clicks, "creates" used | Automatic |
| Payment | Billing amount, plan, last 4 digits (we never store full card) | Stripe |
| Cookies | See our Cookie Policy | Automatic |
4. How we use your data
- Authenticate you via Google and keep you signed in.
- Process your photo to generate virtual try-on results (the core service).
- Store saved results in "My results" and let you share them.
- Bill subscriptions and "creates" through Stripe.
- Improve the service, debug, and prevent fraud/abuse.
- Comply with legal obligations and respond to lawful requests.
5. Legal bases (GDPR Art. 6)
- Contract (Art. 6(1)(b)) — to provide try-on, billing, and your account.
- Consent (Art. 6(1)(a)) — marketing emails, non-essential cookies, and (with Art. 9) biometric processing.
- Legitimate interest (Art. 6(1)(f)) — security, fraud prevention, service analytics.
- Legal obligation (Art. 6(1)(c)) — tax, record-keeping, lawful requests.
6. Biometric & face data (special category)
To generate a try-on we extract facial/body geometry from your photo. This is special-category data under GDPR Art. 9 and "biometric identifiers/information" under the Illinois Biometric Information Privacy Act (BIPA). We process it only on the explicit consent you give in our Portrait & Biometric Consent form, which you may withdraw at any time.
We do not sell, rent, or profit from your biometric data (BIPA §15(c)). Geometry is destroyed on the schedule in Section 9 and our written retention policy.
7. Who we share with (sub-processors)
- Supabase — account, database, auth hosting.
- RunPod — GPU processing that runs the try-on model (your photo is sent there only for the duration of generation).
- Stripe — payment processing.
- Google — sign-in and, if you enable ads, advertising cookies.
- Analytics / Ads — [Google Analytics 4 / AdSense], only with your consent.
- Merchants (affiliate) — when you click "Shop the look" you leave Dreamfit; we pass no personal data except the referral.
We require each sub-processor to contractually protect your data. We disclose data to authorities only where legally required.
8. International transfers
Our hosting and processing occur in the United States. If you are in the EEA/UK, we rely on Standard Contractual Clauses (SCCs) / UK IDTA and supplementary measures to lawfully transfer your data. Contact us for a copy of the safeguards.
9. Retention & automatic deletion
| Data | Retention |
|---|---|
| Uploaded source photo | Deleted immediately after the result is generated (not retained). |
| Derived face geometry | Deleted immediately after generation (BIPA written destruction policy). |
| Generated result (not saved) | Auto-deleted after 30 days, unless you click "Save". |
| Saved result | Kept until you delete it or close your account. |
| Biometric hard cap | Under BIPA, no biometric retained beyond 3 years from your last interaction. |
| Account & profile | Purged within 30 days of account deletion (backups per schedule). |
| Payment records | Retained as required by tax law ([7 years]), card numbers never stored. |
You can delete any result anytime from Account → My results, and export or erase all your data from Account → Privacy & data.
10. Your rights
EEA/UK (GDPR): access, rectification, erasure, restriction, portability, objection, and withdraw consent at any time. California (CCPA/CPRA): know, delete, correct, opt-out of "sale"/sharing, and limit use of sensitive data. We do not sell personal information.
Exercise rights via [email protected] or the self-service tools in Account. We respond within [30 days / 45 days CA]. You may lodge a complaint with your supervisory authority.
11. Children
Dreamfit is for users 13+ (COPPA). In the EEA we require users to be at least 16 (or the member-state minimum) to give consent for biometric processing. We do not knowingly collect data from children below the threshold; if we learn we have, we delete it.
12. Security
We use TLS in transit, encryption at rest, access controls, and least-privilege processing. No method is 100% secure; we notify affected users and authorities of any breach as required by law (GDPR 72-hour rule).
13. Changes
We may update this Policy. Material changes are notified by email or in-app at least [30 days] before they take effect, and we revise the "Last updated" date.
14. Contact
[123 Example Blvd, Dover, Delaware, USA]
Privacy: [email protected]
DPO / EU rep: [[email protected]]
For the EU Art. 27 representative: [name & address]