Version 1.1 · Effective: October 19, 2026.
This policy explains how Space Made Code LLC handles personal data when you use Stylium: the Stylium Wardrobe app (wardrobe.stylium.app), the website stylium.app, our sign-in pages (accounts.stylium.app) and, when released, the Stylium mobile apps.
1. Who we are
1.1 Controller: Space Made Code LLC ("SMC", "we"), a Delaware (United States) limited liability company. Stylium is an SMC product, not a separate company.
1.2 Registered agent: Harvard Business Services, Inc., 16192 Coastal Highway, Lewes, Delaware 19958, United States. Business address: [BUSINESS ADDRESS].
1.3 Privacy contact: legal@spacemadecode.com.
1.4 EU representative (GDPR Art. 27): [NAME, ADDRESS, EMAIL]. UK representative: [NAME, ADDRESS, EMAIL].
2. What we collect, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Account: name, email, sign-in identifiers, profile picture if provided by your sign-in method | Create and secure your account | Contract (Art. 6(1)(b) GDPR) | Until account deletion |
| Wardrobe content: clothing photos; type, colour, pattern, fabric, season, formality, names; wardrobe groups; wear history | Provide the digital wardrobe | Contract | Until you remove it or delete your account |
| Outfits and planning: outfits, plans, trips, events, saved looks, style preferences, notes | Outfit suggestions and planning | Contract | Until removed or account deletion |
| Location: a city with its region and country; your browser location only if you allow it, used once to find the nearest city and not stored | Weather-aware styling | Contract; consent for browser location | City: until account deletion; precise position: not stored |
| Time zone (from your browser) | Show dates and plans correctly | Legitimate interest (Art. 6(1)(f)) | Cookie: 1 year |
| AI processing of photos and wardrobe attributes (see section 3) | AI tagging, AI styling and AI outfit images | Explicit consent (Art. 6(1)(a)) | See section 3 |
| AI outfit images: the image of your outfit on Stylium's standard mannequin, stored in your account | Show your outfit on a model and reuse it in Today, Outfits, Planner and Trips | Contract; the AI processing itself rests on your explicit consent | Until you delete the piece or your account (we keep up to 80 images per account and remove the oldest unsaved ones) |
| Upload safety check (see section 3) | Block nudity and protect users and the Service | Legitimate interest and legal obligation; [counsel to confirm basis] | Check record: 24 hours |
| Subscription and billing (web): plan, status, billing period, amounts, taxes, billing address and country, tax ID if you give one, invoice records. Card details are handled by Stripe; we never see your full card number | Sell and bill subscriptions, calculate tax, keep accounting records | Contract; legal obligation (Art. 6(1)(c)) | 10 years after the transaction year |
| Subscription (App Store / Google Play): transaction and subscription identifiers and status | Give you plan access | Contract | Until account deletion, then anonymised reconciliation records |
| AI usage records: time, feature, model, token counts, status (no photos, prompts or outputs) | Cost control, abuse prevention, reliability | Legitimate interest | 90 days |
| Consent records: AI consent version, date, accept/withdraw | Prove and respect your choice | Legal obligation; legitimate interest | Until account deletion [counsel: consider retaining proof for 3 years] |
| Security and technical data: IP address, device and browser data, request logs, rate-limit counters | Keep the Service secure and working | Legitimate interest | Logs: per hosting provider (typically up to 30 days); rate-limit counters: 24 hours |
| Communications: messages to our support addresses or contact form | Answer you | Legitimate interest; contract | 24 months after the conversation ends |
| Waitlist and marketing: email (and name, if given) | Launch invitations and, with consent, product news | Consent (Art. 6(1)(a)) | Until you unsubscribe; proof of consent 3 years after withdrawal |
We do not knowingly collect special categories of data (such as health, religion or biometric data). Photos may unintentionally show a person; we do not use photos to identify anyone. Please photograph clothing on its own.
3. AI processing
3.1 Wardrobe app (Anthropic and Google). With your consent, we send only what a task needs to two AI providers:
- Anthropic PBC (Claude) for AI tagging, AI styling and our safety filters:
- *AI tagging:* a reduced copy of the photo, without location or camera metadata.
- *AI styling:* the type, colour, fabric, fit, season and formality of your pieces, your city's weather and your note. Your note is first checked by our input filter (section 3.4); the styling model sees only the styling preferences that pass it, not your raw text. We do not send your name, email, piece names or (for styling) photos.
- *Safety filters:* the note (for the input filter) and each generated outfit image (for the output check).
- Google LLC (Gemini API) for AI outfit images: the photos of the pieces in the outfit (up to 8, at the reduced size stored in your wardrobe), each piece's type and colour label, and our fixed instructions, together with Stylium's standard mannequin image. We do not send your name, email, note or location. Google returns an image of the outfit on the mannequin, which we store in your account.
3.2 Mandatory safety checks. Every uploaded photo is checked for nudity by Anthropic before it is saved, whether or not you have given AI consent. This protects users and is a condition of using uploads.
3.3 Retention by providers.
- *Anthropic* deletes API inputs and outputs within 30 days, except content flagged by its safety systems as violating its usage policies, which it may keep for up to 2 years. Anthropic does not use this data to train its models.
- *Google:* we use the paid Gemini API. Under Google's Gemini API Additional Terms, Google does not use prompts or responses from paid services to improve its products; it may log them for a limited time only to detect and prevent violations of its Prohibited Use Policy and to meet legal obligations [confirm the period with Google's current terms]. Images created by Google carry an invisible digital watermark (SynthID) that marks them as AI-generated.
3.4 Stylium's own safety filters. Besides the providers' filters, Stylium applies its own: (a) outfits are shown only on one fixed, plain white, faceless mannequin; (b) any note you type goes through an input filter that keeps only styling preferences and discards requests for real people or bodies, nudity, changes to the mannequin and attempts to give instructions to the AI (profanity alone is ignored); (c) free-text names are cleaned before they reach any AI model; (d) every generated image is checked, and one that shows a real person, a face, skin, nudity, added text or unsafe content is discarded; (e) daily limits apply. These filters process your note and the generated image with Anthropic as described above.
3.5 No automated decisions with legal effect. AI suggestions do not produce legal or similarly significant effects on you.
3.6 You can withdraw AI consent at any time in Settings → Privacy. Withdrawal does not affect processing already carried out.
4. Who receives your data
We share personal data only with providers that help us run Stylium (processors), under contracts that limit their use of it:
| Provider | Role | Data | Location |
|---|---|---|---|
| Clerk, Inc. | Sign-in and account management | Account data, sign-in events | United States |
| Supabase, Inc. | Database and file storage | All app data and photos | Ireland (EU), AWS eu-west-1 |
| Vercel, Inc. | Hosting and delivery | Request data, logs | United States and global edge |
| Anthropic PBC | AI tagging, styling, safety filters | See section 3 | United States and other regions |
| Google LLC (Gemini API) | AI outfit images | Photos of the pieces in an outfit, type and colour labels (see section 3) | United States and other regions |
| Stripe, Inc. / Stripe Payments Europe | Web payments, tax calculation, invoices | Billing data | United States / EU |
| Resend, Inc. | Waitlist and contact emails | Email address, name, message | United States |
| Cloudflare, Inc. | Bot protection on forms (Turnstile) | Browser and device signals, IP | Global |
| MET Norway (Norwegian Meteorological Institute) | Weather forecasts | Coordinates rounded to about 1 km (no personal data) | Norway / EEA |
Apple and Google act as independent controllers for purchases made through their stores. We may also disclose data when required by law, to protect rights and safety, or as part of a merger or sale of the business (with notice to you). We do not sell or share personal data for cross-context behavioural advertising.
5. International transfers
SMC is based in the United States and some providers process data outside your country. For transfers from the EU/EEA, UK and Switzerland we rely on the EU-U.S. Data Privacy Framework where the provider is certified, or on Standard Contractual Clauses (and the UK Addendum) with supplementary measures. [Counsel to confirm the mechanism for each provider; see the processor register in our DPA.]
6. How long we keep data
See the table in section 2 and our Data Retention and Deletion Policy. When you delete your account, we permanently delete your photos, wardrobe, outfits, plans, trips, saved looks, preferences, AI usage records and consent records, and anonymise your account record. Web billing records are kept for 10 years because tax law (including EU VAT rules) requires it. Deleted data disappears from backups within [BACKUP RETENTION, e.g. 7 days].
7. Your rights
Depending on where you live, you may have the right to access, correct, delete or export your data, to restrict or object to processing, to withdraw consent, and not to be subject to solely automated decisions. Residents of some US states (for example California) have similar rights, including the right to know and to delete, and the right not to be discriminated against for exercising them.
- In the app: export your data or delete your account in Settings → General → Your data; withdraw AI consent in Settings → Privacy.
- By email: legal@spacemadecode.com. See our User Rights Request Procedure.
- We reply within 30 days (GDPR: within one month, extendable as the law allows).
- You can complain to your data protection authority, for example the authority in your EU country or the UK ICO.
8. Cookies
We use only cookies and similar storage that are needed for the Service to work, (for example your sign-in session and language choice). On the website, the language is chosen from the country our hosting provider reports for your request; your IP address is not sent to anyone else. Details are in our Cookie Policy.
9. Children
Stylium is not for anyone under 18. See our Children and Minimum Age Policy.
10. Security
Photos are stored in private storage and served only to their owner. Database access is limited to our servers and protected by row-level security. We do not log photo, prompt or AI output content. Connections are encrypted in transit. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.
11. Changes
We will update this policy when our practices or providers change and tell you about material changes before they apply. If the AI consent text changes, we will ask for your consent again.
12. Related documents
Terms of Use · Cookie Policy · AI Usage Policy · AI Consent Notice · Data Retention and Deletion Policy · Legal Notice