Plain language summary: We are an EU based company (Bulgaria). We use your photos only to edit them (virtual try-on) and to screen them automatically for prohibited content. We do not recognise who you are from your photos, and we never use any of your data - photos, wardrobe, chats, or anything else - to train, fine-tune, or improve AI models, not even in anonymised or aggregated form. We do not sell your data. You can delete data we hold about you at any time, directly in the app.
Clottr is operated by NOVSI IT Ltd, a limited liability company (EOOD) registered in Bulgaria, EU.
Contact and data enquiries:
NOVSI IT Ltd
UIC (company number): 208124639
VAT: BG208124639
Geo Milev str, floor 1, Sofia, 1111, Bulgaria
Registered in the Bulgarian Commercial Register
privacy@clottr.ai
EU/EEA: Our lead supervisory authority is the Commission for Personal Data Protection (CPDP), Bulgaria - www.cpdp.bg. EU/EEA residents may also complain to the authority in their country of habitual residence.
UK United Kingdom: Information Commissioner's Office (ICO) - ico.org.uk
AU Australia: Office of the Australian Information Commissioner (OAIC) - oaic.gov.au
CA Canada: Office of the Privacy Commissioner of Canada (OPC) - priv.gc.ca. Quebec residents may also contact the Commission d'accès à l'information (CAI).
US United States: California residents have specific rights under the CCPA/CPRA - see Section 14.1.
This policy applies to all users of the Clottr mobile application (iOS and Android), the Clottr browser extension, our website clottr.ai (including its waitlist), and any associated web services or APIs.
Age requirement: Our services are intended for users aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has provided us with personal data, contact us and we will delete it promptly.
You may use the app without a named account. Anonymous sessions are supported via device identifier. This policy applies equally to anonymous and registered users.
We only collect what we need to provide the service. Legal bases below reference GDPR/UK GDPR Article 6. Equivalent bases for other jurisdictions are described in Section 14.
| Data Category | What It Includes | Purpose | Legal Basis (EU/UK) |
|---|---|---|---|
| Account & identity | Email address, name (if provided), Sign in with Google / Apple token, authentication credentials | Account creation and login | Contract performance (Art. 6(1)(b)) |
| Device & session identifiers | Supabase anonymous auth ID, internal device ID, push notification token | Anonymous sessions, push notifications, fraud prevention | Contract performance / Legitimate interest (Art. 6(1)(b)(f)) |
| Body & selfie images | Photos you upload of yourself for virtual try-on poses (front, side, back, detail) | Generating virtual try-on visuals (image editing) and automated content moderation (see Section 4.2). Used for nothing else: we do not extract biometric identifiers, do not identify you, and do not use these images for AI training. | Contract performance / Legitimate interest (Art. 6(1)(b)(f)) |
| Wardrobe images & metadata | Photos of clothing items; category, colour, brand, material, pattern, fit metadata | Wardrobe management, outfit creation, fit analysis, automated content moderation (see Section 4.2) | Contract performance / Legitimate interest (Art. 6(1)(b)(f)) |
| Style & fashion preferences | Materials, styles, colours, patterns, fit, brands, occasions | Personalised outfit recommendations | Contract performance (Art. 6(1)(b)) |
| Outfit & activity history | Outfit calendar events, wear history, canvas compositions, favourites, wishlist, try-on history | History, in-app analytics, weekly digest | Contract performance (Art. 6(1)(b)) |
| Routine preferences | Preferred wake-up or get-ready time | Scheduling timely outfit recommendations and notifications | Contract performance (Art. 6(1)(b)) |
| Social media usernames | Instagram, TikTok, and/or Pinterest username (optional) | Verifying posts for the rewards programme only. Our team checks your public posts by hand (see Section 4.2). | Contract performance (Art. 6(1)(b)) |
| Location data | GPS coordinates (latitude/longitude), if you grant permission | Fetching local weather via Google Weather API. Coordinates sent to Google only; no other location sharing. | Consent (Art. 6(1)(a)) |
| IP address (security) | IP address logged at network/application level | Security monitoring, abuse prevention, rate limiting | Legitimate interest (Art. 6(1)(f)) |
| Usage & analytics data | Interaction events, screen views, subscription status, and crash/error diagnostics, processed via PostHog (EU-hosted). Linked to your user ID and email. | Understanding app usage and diagnosing errors to improve the product. Never used to train AI models and never sold. | Legitimate interest (Art. 6(1)(f)) |
| Website waitlist | The email address you submit on clottr.ai, the time of signup, your IP address, the referring page, and the site language | Adding you to the waitlist and telling you when Clottr opens to you; the IP address is used for rate limiting and abuse prevention | Steps at your request before a contract (Art. 6(1)(b)) / Legitimate interest (Art. 6(1)(f)) |
| Website usage (cookieless) | Pages you view on clottr.ai, clicks on our own buttons and links (such as early access, language and app store links), the page that referred you and campaign tags (utm_*), browser and device type, language, time zone, and country (looked up from your IP address by Cloudflare; the IP address itself is not added to the analytics). Each new waitlist signup is also counted with its page, campaign tags, language and country, without your email. Web addresses are recorded without their query parameters, except campaign tags; an ad click ID (such as gclid) is recorded only as present, never its value. No cookies or device storage; not linked to any account or email. | Counting visits and learning which pages and sources lead to waitlist signups. Never used to train AI models and never sold. | Legitimate interest (Art. 6(1)(f)) |
| Crash & diagnostic data | Device model, OS version, app version, crash logs | Identifying and fixing bugs | Legitimate interest (Art. 6(1)(f)) |
| Browser extension data | On explicit activation: page URL, product name, price, description, availability | Enabling virtual try-on or wardrobe save from retail sites. Only activates on your explicit action - does not passively monitor browsing. | Contract performance / Consent (Art. 6(1)(b)(a)) |
Note on body and selfie images: We process photographs of your face and body solely to perform image editing (virtual try-on generation) and automated content moderation. They are stored in Cloudflare R2 and sent to two AI providers, Runware and Groq, for try-on generation and image analysis (see Section 6). We do not use computer vision to identify or categorise you as a person. We do not use body or selfie images - or any other data you provide - to train, fine-tune, or improve any AI model. These images are deleted immediately when you delete your account.
We use your data to: provide core features; generate personalised weather-aware outfit suggestions; send service communications (account confirmations, resets, weekly digests, opted-in notifications); operate the rewards programme; improve the app through aggregated, non-identifying analytics; maintain security; and comply with legal obligations.
We do not sell your personal data or any data derived from it, use any of your data to train, fine-tune, or improve AI models (see Section 4.1), use your data for advertising profiling, use your images to identify you, or share identifiable personal data with third parties for their own marketing.
Marketing emails: We do not currently send promotional emails. When we do, we will obtain explicit opt-in consent in advance, and every message will include a functional unsubscribe mechanism. Canadian users: see CASL note in Section 14.3. US users: see CAN-SPAM note in Section 14.1.
We do not train AI on you. We never use your photos, wardrobe, chats, style preferences, or any other data you provide - nor any anonymised or aggregated version of it - to train, fine-tune, or improve any artificial-intelligence or machine-learning model. Clottr's AI features run on pre-trained models and hosted inference services that process your input only to produce your result. We do not send your data to any provider for model training, and our data-processing agreements require our providers not to use your content to train their own models.
Moderation is automated. Images you upload and images we generate for you are screened for prohibited content by automated checks. No person reviews your images as part of moderation.
A person on our team looks at a specific image only if it is reported to us as breaching our Terms, if you send it to us yourself (for example with a support request), or if the law requires us to.
The rewards programme works differently: our team checks the public social media posts you submit by hand, to confirm they qualify. That check covers your public post only, not the images in your account.
We may derive, aggregate, and anonymise data from user content and usage patterns - including wardrobe composition trends, style preferences, outfit frequency, and product popularity - in a form that does not identify any individual ("Aggregated Data"). We use Aggregated Data only for our own internal purposes, such as understanding how the Service is used, improving features, and monitoring performance. Aggregated Data does not include your name, contact details, photographs, or any data that could reasonably identify you.
We do not sell your data. We do not sell, license, or share your personal data - or any Aggregated Data derived from it - with third parties for their own commercial purposes. We also never use Aggregated Data to train AI models (see Section 4.1).
We share your data only with the processors below, under Data Processing Agreements (DPAs), and only to the extent necessary to provide the service.
| Processor | Role | Data Transferred | Location |
|---|---|---|---|
| Supabase, Inc. | Database, authentication (including anonymous auth) | Account data, wardrobe data, app data, device IDs | EU |
| Hetzner Online GmbH | Backend infrastructure / servers | All data processed by our backend | EU (Germany / Finland) |
| Cloudflare, Inc. | Object storage (Cloudflare R2), CDN, DDoS protection, network security | Your uploaded and generated images (selfies, wardrobe photos, virtual try-on results) stored in R2; IP addresses and request metadata for CDN and security; on clottr.ai, the country derived from your IP address for website analytics | Global (EU SCCs / UK IDTA apply for non-EEA/UK nodes) |
| Runware, Inc. | AI image generation for virtual try-on (image editing / inference) | Your try-on pose image, which shows your face and body (derived from your selfie), photos of clothing items, and text prompts. No name or email. Used only to process your requested image; never used to train models. | Global (US - EU SCCs / UK IDTA apply) |
| Google LLC | Weather forecasts (Google Weather API) and OAuth authentication (Sign in with Google) only | GPS coordinates for weather; account token and email for sign-in. No photos or other content. | US - EU SCCs and UK IDTA apply. Google's DPA covers both services. |
| Apple Inc. | OAuth authentication (Sign in with Apple) | Apple account token, email address (if not hidden by user) | US (EU SCCs / UK IDTA apply) |
| 650 Industries, Inc. (Expo) | Push notification delivery | Push notification token, notification content | US (EU SCCs / UK IDTA apply) |
| Resend, Inc. | Transactional email delivery | Email address, email content | US (EU SCCs / UK IDTA apply) |
| RevenueCat, Inc. | Subscription and in-app purchase management | Device ID, subscription status, purchase history, app user ID | US (EU SCCs / UK IDTA apply) |
| Groq, Inc. | AI inference (chat, styling, and image analysis) | Text prompts and styling queries; photos of clothing and accessories for classification; images you upload, including photos of yourself, for image analysis. Used only to return your result; never used to train models. | US (EU SCCs / UK IDTA apply) |
| PostHog, Inc. | Product analytics, diagnostics, and error monitoring (app); cookieless website analytics (clottr.ai) | App: interaction and screen events, subscription status, crash/error diagnostics, your user ID, email, and IP address. Website: page views and clicks without cookies or identifiers; your IP address is used only to compute an anonymous hash that changes every day, for counting unique visitors, and is not stored with the events. | EU (PostHog EU Cloud, hosted in the EU) |
| Brave Software, Inc. | Image search for onboarding style inspiration | Search terms only (style and aesthetic keywords). No photos, name, or email. | US (EU SCCs / UK IDTA apply) |
| VostokInc SAS (ScrapingBee) | Web page retrieval (fetching public retailer product pages) | The URL of the public page to fetch, such as a product link you add. No photos, name, or email. | EU (France) |
Platforms that are not our processors: Subscription payments are handled by the Apple App Store or Google Play, which act as independent controllers under their own privacy policies; we never see your card details, and RevenueCat passes us your subscription and purchase status. If you join the rewards programme, you give us your Instagram, TikTok, and/or Pinterest username, and our team checks your public posts on that platform by hand. We do not send Instagram, TikTok, or Pinterest any of your Clottr data.
EU/EEA: International transfers rely on Standard Contractual Clauses (SCCs) approved by the European Commission.
UK UK transfers rely on the UK International Data Transfer Agreement (IDTA) or EU SCCs with the UK Addendum.
AU By using the Service, you acknowledge that your personal information will be disclosed to overseas recipients as listed above. We take reasonable steps to ensure those recipients handle your information consistently with the Australian Privacy Principles (APPs). However, once data is disclosed to an overseas recipient, Australian Privacy Act obligations on us regarding that recipient's handling may not apply, and you may not be able to seek redress under the Australian Privacy Act in respect of that recipient. See also Section 14.4.
We do not share identifiable personal data with advertisers, data brokers, or social media platforms beyond what you explicitly initiate.
Core rights below apply to EU/EEA and UK users under GDPR/UK GDPR. Additional and equivalent rights for US, Canadian, and Australian users are in Section 14.
| Right | What It Means | How to Exercise |
|---|---|---|
| Access | Obtain a copy of all personal data we hold about you | "Export my data" in Profile settings |
| Rectification | Correct inaccurate or incomplete data | Edit in-app, or email us |
| Erasure | Request deletion of your personal data | "Delete my data" in Profile settings - immediate |
| Portability | Receive your data in a structured, machine-readable format | "Export my data" in Profile settings |
| Restriction | Request we limit processing in certain circumstances | Email privacy@clottr.ai |
| Objection | Object to processing based on legitimate interest | Email privacy@clottr.ai |
| Withdraw consent | Withdraw any consent you have given (e.g. location, marketing) without penalty | In-app consent settings or email us |
| Lodge a complaint | Complain to a supervisory authority | See Section 1 for relevant authority by region |
We will respond to all requests within 30 days. No fee applies.
In the event of a personal data breach posing risk to your rights and freedoms:
The mobile app does not use browser cookies. It uses device identifiers for session management. The browser extension does not use cookies to track browsing. Product analytics and diagnostics are provided by PostHog (EU-hosted) for aggregate usage statistics and error monitoring; this data is never sold and never used to train AI models.
Our website (clottr.ai) does not use cookies, local storage, or any other storage on your device for analytics. It measures visits with PostHog's cookieless mode: your IP address and browser details are turned into an anonymous hash that changes every day, so a visit is never linked to you or to your visits on other days. If your browser sends a "Do Not Track" or "Global Privacy Control" signal, the website sends no analytics at all. Where any future web interface uses non-essential cookies, we will implement an appropriate consent mechanism before placing them.
Our services are intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with data, contact us at privacy@clottr.ai and we will delete it promptly.
We may update this policy from time to time. For material changes, we will notify you via in-app notification and/or email at least 30 days before the changes take effect. The updated version is always available in the app under Profile > Privacy Policy. Continued use after the effective date constitutes acceptance.
This section sets out additional rights and disclosures for users in specific jurisdictions. Where this addendum conflicts with the main policy, the addendum takes precedence for users in the relevant jurisdiction.
If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) provides the following rights in addition to those in Section 8:
Categories of personal information collected in the past 12 months: Identifiers (email, device ID); personal records (name); characteristics (style preferences); commercial information (outfit history, wishlist); internet/electronic activity (usage data, IP address); geolocation data (if permitted); inferences drawn from the above (recommendations, trend data).
Categories sold or shared: None. We do not sell or share personal information or Aggregated Data with third parties.
Authorised agents may submit requests on your behalf by providing written authorisation. Residents of other states with applicable privacy laws (Virginia, Colorado, Texas, Connecticut, and others) have comparable rights to access, correct, delete, and opt out of sales - contact us at privacy@clottr.ai.
CAN-SPAM: All commercial email messages sent to US users will comply with the CAN-SPAM Act, including clear identification as commercial messages, a valid physical address, and a functional unsubscribe mechanism honoured within 10 business days.
The Service is made available to UK users subject to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. The rights in Section 8 apply in full to UK users.
International transfers of UK personal data are conducted using the UK International Data Transfer Agreement (IDTA) or EU SCCs with the UK Addendum, as described in Section 6.
The EU-UK adequacy regulations mean that data flows between Clottr's EU infrastructure and UK users benefit from a recognised adequacy framework, subject to that framework remaining in force.
UK users may direct complaints to the ICO at ico.org.uk or by calling 0303 123 1113. UK users also retain the right to bring proceedings in UK courts.
For users in Canada, we process personal information in accordance with the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial legislation.
Your rights under PIPEDA include: access to personal information we hold about you; the right to challenge its accuracy; and the right to withdraw consent at any time subject to legal or contractual restrictions.
Quebec residents - Law 25:
CASL - Commercial Electronic Messages: All marketing emails sent to Canadian users will comply with Canada's Anti-Spam Legislation (CASL). We will only send marketing messages to Canadian users with express or implied consent as defined by CASL. Every marketing message will include a clear, functional unsubscribe mechanism honoured within 10 business days.
Complaints may be directed to the OPC at priv.gc.ca or, for Quebec residents, to the CAI at cai.gouv.qc.ca.
For users in Australia, we handle personal information in accordance with the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs).
Your rights include:
APP 8 - Overseas Disclosure: We disclose personal information to overseas recipients as detailed in Section 6. We take reasonable steps to ensure those recipients handle your information consistently with the APPs. By using the Service, you consent to this overseas disclosure. Once data is disclosed to an overseas recipient, our obligations under the Australian Privacy Act in respect of that recipient's handling may be limited, and you may not be able to seek redress under the Australian Privacy Act against that recipient directly.
Notifiable Data Breaches: Where a breach is likely to result in serious harm to you, we will notify you and the OAIC as required under the NDB scheme (Part IIIC of the Privacy Act 1988).
For any privacy-related questions, data subject requests, or concerns:
NOVSI IT Ltd
Company Registry Number: 208124639
Geo Milev str, floor 1, Sofia, 1111, Bulgaria
Email: privacy@clottr.ai
Clottr · Privacy Policy · Last updated October 2026 · EU GDPR · UK GDPR · CCPA/CPRA · PIPEDA / Quebec Law 25 · Australian Privacy Act