Privacy Policy

1. Introduction

Buena Logica Technologies Private Limited (“Fashually,” “we,” “us,” or “our”) operates the Fashually mobile application and related services (collectively, the “Service”) — an AI-powered fashion photoshoot studio that lets you see yourself, or an AI Model, in any Outfit, Pose, or Background.

This Privacy Policy explains what personal data we collect, how and why we use and share it, how long we keep it, and the choices and rights available to you — wherever in the world you use Fashually.

We wrote this Policy to apply globally, not just to users in any one country. Where a specific law gives you rights beyond what’s described generally below, Section 20 explains those rights region by region.

2. Scope of This Policy and Age Requirement

This Policy applies to everyone who uses the Service, regardless of location. It’s designed to reflect the requirements of multiple data protection frameworks, including (without limitation):

• The EU General Data Protection Regulation and the UK GDPR
• The California Consumer Privacy Act, as amended by the CPRA, and comparable U.S. state privacy laws
• India’s Digital Personal Data Protection Act, 2023, and the DPDP Rules, 2025
• Other applicable data protection and privacy laws around the world

Age requirement. Fashually is intended for adults. You must be at least 18 years old (or the age of majority where you live, if higher) to create an account or use the Service. See Section 19.

3. Information We Collect

3.1 Information You Provide Directly

Account information. Fashually does not support email/password sign-up. You can only create an account by signing in with your Google Account or Apple ID. When you do, Google or Apple shares certain basic profile information with us — typically your name, email address, a unique account identifier, and (if available) a profile photo — depending on the permissions you approve at sign-in. If you sign in with Apple and haven’t set a profile photo, your profile may show your initials instead, since Apple doesn’t always share a photo. We never receive your Google or Apple password.

Profile and personal avatar information. To build your personal avatar, we ask you to provide:

• A Selfie (face photo)
• Full-body photos: front view, left side view, right side view, and back view
• Age
• Height
• Weight
• Location (city and country)

We treat your Selfie and body photos as sensitive biometric information. Section 6 explains exactly how we handle this category of data.

AI Model avatars. Instead of, or alongside, your personal avatar, you can choose a ready-made AI-generated Model avatar that isn’t based on your own likeness. Both your personal avatar and any Model you select can be used to create Looks.

Looks you create. When you use an avatar to try on Outfits, Poses, or Backgrounds, we process the resulting images (“Looks”) along with any Outfit references, styling choices, or prompts you provide to create them.

Username. When you set up your account, we set your username. Other users can see it and search for it to send you a Friend Request.

Friends. Information about the Friend Requests you send and receive, your list of Friends, and your total Friend count — some of which (your Friend count and, to your Friends, your name, username, and photo) is visible to other users through your profile.

Chat. When you message a Friend, we process the text, Looks, photos, and videos you send and receive, including messages you edit or delete, and any Reaction (heart, thumbs-up, or fire) you or a Friend leaves on something shared in Chat.

Streaks. Information about your daily exchange of Looks with a Friend, including your current Streak length, Streak Cups won, and Streak history.

Community content. You can choose, Look by Look, whether to show it on Community, where other Fashually users can see it. See Section 10.

Block and report information. If you block another user, or report them to us, we collect the details of that action — including, for a report, the reason you selected and anything else you add. See Section 11.

Communications. If you contact us for support or send us feedback, we collect what you tell us along with your account details.

3.2 Information Collected Automatically

• Device information: device type, operating system and version, unique device identifiers, and mobile advertising identifiers (such as Google’s Advertising ID or Apple’s IDFA, where you’ve allowed tracking).
• Usage data: the features you use, screens you view, session length, and similar interaction data.
• Log data: IP address, approximate location derived from your IP address, access times, and crash/diagnostic reports.
• Push notification token: a device identifier that lets us deliver notifications to you. See Section 13.

3.3 Information From Third Parties

• From Google or Apple, at sign-in: the basic profile information described above.
• From advertising partners: technical and interaction data related to the ads shown to you (Section 14).
• Age-signal integration (planned): if we integrate Apple’s or Google’s age-verification signals in the future, we may also receive an age-range or verification-status signal about your account from them. This isn’t active yet — we’ll update this section with specifics before it is.

4. How We Use Your Information

We use the information described above to:

• Create and maintain your account
• Generate your personal avatar and any AI Model avatars you select
• Create the Looks you request
• Operate, maintain, and improve the Service
• Provide customer support and respond to your requests
• Operate Friends, Chat, and Streaks, including showing your profile, username, and Friend count to other users (Section 9)
• Operate Community, including showing the Looks you choose to other Fashually users (Section 10)
• Review content and accounts flagged through our block and report tools (Section 11)
• Operate Daily Drop, What’s Viral, and Shop This Look (Section 12)
• Send you push notifications about activity on your account, and occasional marketing messages (Section 13)
• Detect, prevent, and address fraud, abuse, and security issues
• Show you ads through Google AdMob (Section 14)
• Comply with our legal obligations and enforce our Terms of Service

We do not use your Selfie or body photos to train Fashually’s own general-purpose AI models without asking for your separate, opt-in consent first.

5. Our Legal Basis for Processing

Where the GDPR, UK GDPR, or a similar framework applies to our processing of your personal data, we rely on the following legal bases:

• Consent — for your biometric data (your Selfie and body photos), and for optional features like Community sharing and personalized advertising.
• Performance of a contract — to create your account and provide the core Service you’ve asked for, like creating a Look or operating Chat.
• Legitimate interests — for security, fraud prevention, moderating reported content, and improving the Service, balanced against your rights and interests.
• Legal obligation — where we need to retain or disclose information to comply with the law.

Because your Selfie and body photos are biometric data capable of identifying you, we treat this as a special, more sensitive category of data and rely specifically on your explicit consent to process it — see Section 6.

6. Biometric Information — Special Notice

We know photos of your face and body are sensitive, so we’re calling out how we handle them separately from the rest of this Policy.

What we collect: your Selfie and your four full-body photos (front, left side, right side, back), used to build your personal avatar.

Why: solely to create your personal AI avatar and the Looks you request. We do not use this information for facial recognition against other people, surveillance, or any purpose beyond generating your avatar and Looks and showing them to the people you choose to share them with — a Friend you send a Look to in Chat, or anyone browsing Community if you show it there, since Community doesn’t require an account to view (Sections 9 and 10) — unless you separately agree to something else.

Consent: we ask for your explicit, separate consent before processing this information. You can withdraw that consent at any time (Section 20). If you do, we’ll stop creating new avatars or Looks from this data and delete the underlying photos — though Looks you’ve already created may remain unless you delete them separately.

Retention and destruction: when you delete your account, we remove your email and username immediately. Your Selfie and body photos are deleted within 180 days of that account deletion, along with the rest of your profile and content data (Section 17).

No sale, no unnecessary sharing: we do not sell or license your biometric information to anyone, and we only share it as described in Section 7 — to create the Look you’ve asked for — or with a Friend or Community audience you’ve deliberately chosen to share a resulting Look with.

Age assurance (planned): we’re evaluating using your Selfie to estimate an age range, as an extra safeguard alongside our 18+ requirement. This isn’t active yet — before we turn it on, we’ll update this section with the specific provider involved, what’s retained, and your rights over that additional processing.

Where biometric-specific laws apply to you (for example, in Illinois, Texas, and Washington in the United States), we follow the disclosure, consent, and retention practices those laws require.

7. AI-Generated Content and Our Third-Party AI Providers

To create your avatar and Looks, we send the necessary photos, measurements, and prompts to trusted third-party AI providers — established companies offering commercial, business-tier APIs for text and image generation, each currently based in the United States.

We’re not naming these providers individually in this Policy at this time. We can confirm their identities to a regulator or auditor on request, and to you individually if you contact us at the details in Section 24. We’ll update this section if that approach changes.

We access these providers through their standard commercial API terms, rather than a bespoke data processing agreement negotiated specifically for Fashually. Under those standard terms, these providers are contractually restricted from using the content you submit to train their own general-purpose, public-facing models, beyond what’s strictly necessary to generate your requested output — except where required by law.

These providers act as our processors (sometimes called sub-processors) and are contractually required to use your information only to provide the AI generation service we’ve requested on your behalf, and to protect it appropriately.

We may add, remove, or change AI providers over time. We’ll update this section when we do, and — for the biometric data described in Section 6 — we’ll seek fresh consent if the change is material.

8. How We Share Your Information

We do not sell your personal information. Outside of what’s described in Section 7, we share information only as follows:

• With service providers who support our infrastructure — for example, cloud hosting, analytics, or customer support tools — under contracts that limit their use of your information to providing services to us.
• With Google AdMob, for advertising purposes (Section 14).
• Publicly, only if you choose to show a Look on Community (Section 10) — and only the Look and the settings you choose, never your underlying profile details like your age, height, weight, or exact location.
• With another user, if you share something in Chat (Section 9) — only with the specific Friend you send it to.
• For moderation, if you or someone else submits a report, or if we’re reviewing a suspected violation of our Terms of Service (Section 11).
• For legal reasons — to comply with the law, respond to lawful requests from public authorities, or protect the rights, property, or safety of Fashually, our users, or others.
• In a business transaction — such as a merger, acquisition, financing, or sale of assets, in which case your information may be transferred as part of that transaction, subject to this Policy or a successor policy that offers equivalent protections.

9. Friends, Chat, and Streaks

Fashually lets you connect with other users as Friends, message them directly, and build a Streak together.

Friends. You can send, accept, or decline Friend Requests, and unfriend a Friend at any time. Once you’re Friends, your profile — your photo, name, username, and total Friend count — is visible to them, and theirs to you.

Chat. You can message a Friend directly: text, Looks from My Looks, and photos or videos from your gallery or camera taken in the app. You can edit or delete a message after sending it, reply to a shared Look, and react to what a Friend shares with a heart, thumbs-up, or fire Reaction.

Streaks. If you and a Friend each send the other a Look on the same day, you build a Streak together, with Cups awarded at 7, 15, and 30 days.

Unfriending and blocking. Unfriending someone ends your Streak with them for good. Blocking someone pauses your Streak and hides your Chat and Community visibility with them until you unblock.

How private is Chat? Messages are encrypted in transit (standard TLS) between your device and our servers, the same as the rest of the Service — Chat isn’t end-to-end encrypted, so message content is technically accessible to us. In practice, we only look at Chat content when investigating a report made under Section 11, or where the law requires it.

10. Community Features

Community lets you choose which of your Looks to show to other users.

Sharing is opt-in and Look-by-Look. You decide, for each Look, whether to show it on Community or keep it private, with a confirmation step before it goes public.

Anyone can browse; you need an account to do anything else. You don’t need a Fashually account to view public Looks on Community. Reacting to a Look, viewing full profiles, and the rest of the Service require signing in.

Signed-in users can react. Once you show a Look on Community, anyone browsing can see it alongside your profile, and signed-in users can react with a heart, thumbs-up, or fire. There’s no commenting feature, and no way for another user to recreate your Look using your styling or likeness — this version doesn’t have a recreation feature at all.

You can remove a Look at any time. Turning a Look’s Community visibility off removes it immediately, with no confirmation step required.

Deleting your account removes your Community Looks too. See Section 21.

11. Block, Unblock, and Reporting

Blocking stops you and another user from messaging each other, seeing each other’s Community Looks, or sending each other Friend Requests, until one of you unblocks. If you were Friends, blocking doesn’t end the friendship, but does pause messaging and visibility as above.

Reporting lets you flag another user’s profile to us, choosing from a set of reasons (for example, harassment, impersonation, or inappropriate content) and adding details if you want. Reports are confidential — we don’t tell the reported user who filed it. Filing a report doesn’t automatically restrict the other user; a member of our team reviews it and decides what action, if any, to take.

We keep a record of blocks and reports — including the reporter, the reason given, and the user reported — to support this review process and to help protect the safety of our users, including, where necessary, after the reporting user’s own account is deleted.

12. Daily Drop, What’s Viral, and Shop This Look

Daily Drop is a curated daily set of Looks, limited to one per user per day. Using it doesn’t involve any information beyond what we’d already collect for any Look you create.

What’s Viral shows curated collections of Looks by trend. Browsing it doesn’t involve any information beyond standard usage data (Section 3.2).

Shop This Look links some Looks to Amazon for items shown in that Look, through the Amazon Associates Program — currently the only affiliate program we use. Amazon’s Operating Agreement requires us to clearly and prominently state: “As an Amazon Associate, Fashually earns from qualifying purchases.” Tapping a Shop This Look link takes you to Amazon’s website or app, outside Fashually. We don’t share your Fashually profile with Amazon — only a standard referral signal used to track the link and the resulting commission, if any. Amazon’s own privacy policy governs what happens to your information once you’re there (Section 22).

13. Push Notifications

With your device’s notification permission, we send push notifications about activity on your account — for example, when a Look finishes, someone sends you a Friend Request, reacts to something you shared, or your Streak is about to break — and, occasionally, marketing messages about Fashually generally. We don’t currently offer in-app settings to turn off specific types of notification; you can turn off push notifications entirely through your device’s own settings.

14. Advertising and Google AdMob

We currently show ads through Google AdMob. AdMob (and Google) may collect and use information such as your device identifiers, advertising ID, IP address, and in-app interaction data to show and measure ads, including personalized ads where you’ve allowed it. You can learn more about, and manage, Google’s advertising practices through Google’s own privacy and ad settings.

Your choices:

• You can limit ad personalization through your device settings (for example, Apple’s App Tracking Transparency prompt, or resetting/limiting your Android advertising ID).
• Where required — including in the EEA, UK, and Switzerland — we’ll ask for your consent to personalized advertising through a consent management tool before showing you personalized ads.
• If you’re in California, or another U.S. state with a comparable law, you have the right to opt out of the “sale” or “sharing” of your personal information for cross-context behavioral advertising. Because AdMob may use identifiers for personalized ads, this may qualify as a “share” under those laws even though we don’t sell data for money. See Section 20.2.

15. Cookies and Similar Technologies

Our app, and the third-party SDKs we use (such as Google AdMob), may use cookies, mobile identifiers, and similar technologies to operate the Service, remember your preferences, and measure and personalize ads.

16. International Data Transfers

Fashually is a global service, and your information may be transferred to, stored, and processed in countries other than the one where you live — including the United States, where our current AI providers and some of our infrastructure providers are based.

Where we transfer personal data internationally from a jurisdiction that requires a specific safeguard for that transfer — for example, out of the EEA or UK, or under India’s DPDP framework — we put appropriate mechanisms in place before doing so, such as the European Commission’s Standard Contractual Clauses, the UK’s International Data Transfer Addendum, or another lawful transfer mechanism recognized under GDPR Chapter V, UK GDPR, India’s DPDP framework, or equivalent regimes elsewhere.

If you’d like more information about the safeguards used for a specific transfer, contact us using the details in Section 24.

17. Data Retention

We keep your information for as long as your account is active, and for a reasonable period afterward to comply with legal obligations, resolve disputes, and enforce our agreements.

We keep information for up to 180 days after deletion, rather than removing it immediately, because India’s IT Rules, 2021 allow this kind of information to still be requested by a court or government authority for a period after an account is cancelled.

18. Data Security

We use administrative, technical, and physical safeguards designed to protect your information, including encryption in transit, access controls, and regular security reviews. Chat messages are encrypted in transit; see Section 9 for what that does and doesn’t cover. No method of transmission or storage is completely secure, and we can’t guarantee absolute security.

19. Children’s Privacy

Fashually is intended for users who are 18 or older (or the age of majority where you live). We do not knowingly collect personal information — and in particular, biometric information such as photos — from anyone under this age. If we learn we’ve collected information from someone under the required age, we will suspend their account immediately and delete their data — including avatar photos, generated Looks, friend graph, Chat messages, Streak data, and anything shown on Community — promptly, on an expedited basis, rather than waiting for the general 180-day schedule described in Section 17. If you believe a minor has used the Service, please contact us using the details in Section 24.

20. Your Privacy Rights

Your specific rights depend on where you live. To exercise any of these, contact us using Section 24 — we may need to verify your identity first. Where a right below includes erasure or deletion, see Section 21 — deleting your account removes your email and username immediately, with the rest of your data erased within 180 days.

20.1 European Economic Area, UK, and Switzerland

If the GDPR or UK GDPR applies to you, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Erase your data (“right to be forgotten”)
• Restrict or object to our processing
• Receive a portable copy of data you provided to us
• Withdraw consent at any time, without affecting processing that already took place
• Lodge a complaint with your local data protection authority

20.2 United States

If the CCPA/CPRA, or a comparable state law (such as those in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, or Montana), applies to you, you have the right to:

• Know what personal information we collect, use, and disclose about you
• Delete personal information we hold about you
• Correct inaccurate personal information
• Opt out of the “sale” or “sharing” of personal information — which may include our use of advertising identifiers through AdMob
• Limit the use of “sensitive personal information,” a category that includes your precise location and your biometric information (Selfie and body photos)
• Not be discriminated against for exercising any of these rights

We honor Global Privacy Control (GPC) signals as a valid opt-out request wherever legally required.

If you’re a resident of Illinois, Texas, or Washington, additional rights and disclosures apply specifically to biometric information under those states’ laws — see Section 6.

20.3 India

If India’s Digital Personal Data Protection Act, 2023 applies to you, you have the right to:

• Obtain a summary of the personal data we process about you and the processing activities involved
• Correct, complete, and update your personal data
• Erase personal data that’s no longer necessary for the purpose it was collected
• Have a readily available way to register a grievance with us
• Nominate another individual to exercise your rights if you die or become incapacitated
• Withdraw consent at any time

You can reach our Grievance Officer using the details in Section 24.

20.4 Other Jurisdictions

If you’re elsewhere — for example, Canada, Australia, Brazil, or another country — you may have similar rights to access, correct, or delete your personal information under your local law (such as PIPEDA in Canada, the Privacy Act 1988 in Australia, or the LGPD in Brazil). Contact us, and we’ll do our best to honor your request under the law that applies to you.

21. Account Deletion

You can delete your Fashually account at any time from within the app. When you do:

• We remove your email address and username from your account record immediately, so your account can no longer be found or signed into.
• Within 180 days of that, we delete the rest of your data too — your name, profile photo, personal avatar photos, Looks, Chat messages, Streak data, friend graph, and any Looks you shared to Community.

We keep information for that window, rather than deleting it immediately, because India’s IT Rules, 2021 allow this kind of information to still be requested by a court or government authority for a period after an account is cancelled. During that window, we can’t look up your data by your old email or username, since those are already removed — any such request would need to identify you some other way, such as by name or photo.

If someone under 18 was using the Service, we handle that differently and faster — see Section 19.

Deletion is permanent. We can’t restore your account or content once this process is complete.

22. Third-Party Links and Services

The Service may contain links to third-party websites or services, including sites belonging to our AI providers, advertisers, and the stores linked from Shop This Look (Section 12). We aren’t responsible for the privacy practices of those third parties, and we encourage you to review their privacy policies separately.

23. Changes to This Policy

We may update this Privacy Policy from time to time, including as we launch new features. We’ll post the updated Policy with a new “Last Updated” date, and where changes are material, we’ll provide additional notice — such as an in-app notification — or seek your consent again, wherever the law requires it.

24. Contact Us

If you have questions about this Privacy Policy, or want to exercise any of your privacy rights, contact us at:

Buena Logica Technologies Private Limited First Floor, 1 New BEL Road, RMV 2nd Stage, Bengaluru, Karnataka 560094 Email: hi@fashually.com

Grievance Officer (India): grievances@fashually.com — designated under the Digital Personal Data Protection Act, 2023.

EU Representative: eu-rep@fashually.com

UK Representative: uk-rep@fashually.com