Dreamfit

Privacy Policy

1. Who we are

Dreamfit is operated by [Dreamfit Legal Entity, Inc.] ("Dreamfit", "we", "us"), registered at [123 Example Blvd, Dover, Delaware, USA]. We provide a web service that lets you upload a photo and see AI-generated virtual try-on imagery of clothing.

For privacy questions: privacy@dreamfit.app. Our Data Protection Officer / EU representative: [dpo@dreamfit.app / EU rep address].

2. Scope

This Policy applies to dreamfit.app and related subdomains, our web app, and anyone using our services in the United States and European Economic Area. It does not cover third-party stores you reach through "Shop the look" affiliate links — those have their own policies.

3. What we collect

4. How we use your data

• Authenticate you via Google and keep you signed in.
• Process your photo to generate virtual try-on results (the core service).
• Store saved results in "My results" and let you share them.
• Bill subscriptions and "creates" through Stripe.
• Improve the service, debug, and prevent fraud/abuse.
• Comply with legal obligations and respond to lawful requests.

5. Legal bases (GDPR Art. 6)

• Contract (Art. 6(1)(b)) — to provide try-on, billing, and your account.
• Consent (Art. 6(1)(a)) — marketing emails, non-essential cookies, and (with Art. 9) biometric processing.
• Legitimate interest (Art. 6(1)(f)) — security, fraud prevention, service analytics.
• Legal obligation (Art. 6(1)(c)) — tax, record-keeping, lawful requests.

6. Biometric & face data (special category)

To generate a try-on we extract facial/body geometry from your photo. This is special-category data under GDPR Art. 9 and "biometric identifiers/information" under the Illinois Biometric Information Privacy Act (BIPA). We process it only on the explicit consent you give in our Portrait & Biometric Consent form, which you may withdraw at any time.

We do not sell, rent, or profit from your biometric data (BIPA §15(c)). Geometry is destroyed on the schedule in Section 9 and our written retention policy.

7. Who we share with (sub-processors)

• Supabase — account, database, auth hosting.
• RunPod — GPU processing that runs the try-on model (your photo is sent there only for the duration of generation).
• Stripe — payment processing.
• Google — sign-in and, if you enable ads, advertising cookies.
• Analytics / Ads — [Google Analytics 4 / AdSense], only with your consent.
• Merchants (affiliate) — when you click "Shop the look" you leave Dreamfit; we pass no personal data except the referral.

We require each sub-processor to contractually protect your data. We disclose data to authorities only where legally required.

8. International transfers

Our hosting and processing occur in the United States. If you are in the EEA/UK, we rely on Standard Contractual Clauses (SCCs) / UK IDTA and supplementary measures to lawfully transfer your data. Contact us for a copy of the safeguards.

9. Retention & automatic deletion

You can delete any result anytime from Account → My results, and export or erase all your data from Account → Privacy & data.

10. Your rights

EEA/UK (GDPR): access, rectification, erasure, restriction, portability, objection, and withdraw consent at any time. California (CCPA/CPRA): know, delete, correct, opt-out of "sale"/sharing, and limit use of sensitive data. We do not sell personal information.

Exercise rights via privacy@dreamfit.app or the self-service tools in Account. We respond within [30 days / 45 days CA]. You may lodge a complaint with your supervisory authority.

11. Children

Dreamfit is for users 13+ (COPPA). In the EEA we require users to be at least 16 (or the member-state minimum) to give consent for biometric processing. We do not knowingly collect data from children below the threshold; if we learn we have, we delete it.

12. Security

We use TLS in transit, encryption at rest, access controls, and least-privilege processing. No method is 100% secure; we notify affected users and authorities of any breach as required by law (GDPR 72-hour rule).

13. Changes

We may update this Policy. Material changes are notified by email or in-app at least [30 days] before they take effect, and we revise the "Last updated" date.

14. Contact