Privacy Policy

1. Introduction

This Privacy Policy explains how Stilr collects, uses, stores and protects your personal data. Stilr is operated by Mehdi Chaabi, sole proprietor (entrepreneur individuel) under French law, acting as data controller under the GDPR (EU 2016/679).

2. Data Controller

• Name: Mehdi Chaabi, operating under the trade name "Stilr"
• Status: Sole proprietor (entrepreneur individuel)
• Jurisdiction: France
• Contact: contact@stilr.app

3. Data We Collect

3.1 Account information

• First name
• Email address
• Password (encrypted, never stored in clear text)
• Authentication identifiers if you sign in via Apple or Google

3.2 Profile and preferences

• Gender, body morphology
• Style preferences, sizes
• Selected basics during onboarding

3.3 Wardrobe content

• Photos of clothing items you scan or upload
• Categorisation, color, season, and other metadata
• Outfit history and feedback

3.4 Usage data

• App interactions, screens viewed, features used
• Device identifier, operating system, app version
• Crash reports and diagnostic data

3.5 Location data (with consent)

With your prior consent, the Application accesses approximate device location to provide weather-based outfit suggestions. You may withdraw this consent at any time in your device settings.

3.6 Subscription data

Payment is processed by Apple App Store or Google Play. Stilr does not collect or store your credit card information — only the subscription status (active, cancelled, expired).

4. Legal Basis for Processing

• Performance of the contract (Art. 6.1.b) — to provide the service
• Consent (Art. 6.1.a) — for location data, marketing communications, and AI processing of photos
• Legitimate interest (Art. 6.1.f) — to improve the service, prevent fraud and ensure security
• Legal obligation (Art. 6.1.c) — to comply with applicable laws

5. Purposes of Processing

• Providing AI-powered outfit suggestions and wardrobe management
• Personalising recommendations to your style, body, and context
• Generating avatar previews of suggested outfits
• Sending account-related and marketing communications (with consent)
• Improving the Application, debugging and analytics
• Preventing fraud and ensuring service security

6. Third-Party Processors

6.1 Google Firebase (Google Ireland Limited)

• Purpose: Authentication, database (Firestore), file storage, cloud functions
• Data shared: account data, wardrobe metadata, scanned photos
• Processing location: EU (europe-west1)
• More info: firebase.google.com/support/privacy

6.2 OpenAI (OpenAI Ireland Limited)

• Purpose: AI outfit generation (GPT-4o), avatar generation (gpt-image-1), clothing scan validation
• Data shared: clothing photos, wardrobe descriptions, body morphology
• Location: EU and United States (Standard Contractual Clauses)
• OpenAI does not use API customer data to train its models

6.3 Clipdrop (Stability AI Ltd)

• Purpose: Automatic background removal for scanned clothing photos
• Data shared: scanned photos only — clipdrop.co/privacy

6.4 Apple App Store / Google Play

• Purpose: App distribution and subscription payment processing
• No card data accessible to Stilr

6.5 Open-Meteo, OpenStreetMap, Wikipedia

• Purpose: Weather forecasts, city search, city photos for travel feature
• Data shared: city name, geolocation coordinates (no user identifier)

7. International Data Transfers

Some processors (notably OpenAI) may process your data in the United States. These transfers are protected by Standard Contractual Clauses approved by the European Commission (GDPR Article 46). By using AI-powered features, you explicitly consent to this transfer.

8. Data Retention

• Account data: kept while your account is active
• Wardrobe content (photos, items): kept while your account is active
• Usage and diagnostic data: 13 months maximum
• Billing data: 10 years (legal accounting obligation)
• Backups: 30 days after account deletion

9. Your Rights Under GDPR

• Right of access (Art. 15): obtain a copy of your data
• Right of rectification (Art. 16): correct inaccurate data
• Right of erasure / "right to be forgotten" (Art. 17)
• Right to restriction of processing (Art. 18)
• Right to data portability (Art. 20)
• Right to object (Art. 21)
• Right to withdraw consent at any time
• Right to lodge a complaint with the CNIL (www.cnil.fr)

To exercise these rights, contact us at contact@stilr.app. We will respond within 30 days.

10. Account Deletion

Profile → Settings → Delete Account, or via contact@stilr.app or stilr.app/delete-account. Deletion is irreversible. All personal data will be removed from active systems within 30 days.

11. Data Security

• Encryption in transit (HTTPS/TLS)
• Encryption at rest for sensitive data
• Restricted access to production systems
• Regular security reviews
• Secure password storage (hashing)

12. Children's Privacy

The Application is not intended for children under 13. We do not knowingly collect data from children under 13. Contact contact@stilr.app if you believe this has occurred.

13. Changes to This Privacy Policy

Users will be notified of material changes via in-app notification or email at least 30 days before the new policy takes effect.

14. Contact

• Email: contact@stilr.app
• CNIL (French supervisory authority): www.cnil.fr

Stilr — Mehdi Chaabi — All rights reserved © 2026