Privacy Policy

1. Scope of this Privacy Policy

This Privacy Policy applies to the OBRAZ mobile application, websites, software, digital-wardrobe tools, outfit-styling tools, social and discovery features, collections, planner features, product links, subscriptions, and related products and services, together referred to as the "Service."

It does not apply to third-party websites, retailers, social networks, payment providers, application stores, or other services that operate under their own privacy policies.

By using the Service, you acknowledge the practices described here. Where applicable law requires consent for a particular processing activity, we will ask for that consent separately.

2. Who we are and how to contact us

OBRAZ is operated from Poland by the owner of OBRAZ, who is the controller responsible for the personal information described in this Privacy Policy.

For any privacy question, request, or complaint — including access, correction, deletion, objection, and opt-out requests — contact us at [email protected]. Please use the same address to report a suspected security issue or a compromised account.

3. Information you provide directly

We collect information you provide when you create an account, build your wardrobe, create outfits, use social features, contact support, or purchase a subscription. This may include:

• name, username, display name, profile image, biography, birthday, optional gender, preferred language, and profile-visibility settings;
• phone number, email address, Google account identifier, authentication tokens, one-time verification information, and account-recovery information;
• Instagram, TikTok, and other social-profile handles or links you choose to provide;
• clothing and accessory photos, wardrobe-item names, categories, colors, brands, seasons, purchase links, visibility settings, favorites, and related metadata;
• looks, outfit compositions, canvas positions, element sizes, backgrounds, text elements, inspiration images, occasion tags, notes, and wear-planning information;
• collection names, descriptions, contents, visibility settings, collaborator lists, invite codes, and shared-collection activity;
• likes, saves, follows, bookmarks, reports, searches, notifications, and other social or discovery activity;
• support messages, feedback, report details, optional screenshots, and other communications with us;
• subscription selections, promotional-code information, and purchase-related information; and
• any other information you voluntarily submit through the Service.

4. Photos, wardrobe content, and image metadata

When you upload or capture an image, we process the image and related information to provide wardrobe, outfit, collection, search, sharing, and AI-assisted features.

Uploaded images may contain more than the garment itself — people, faces, interiors, reflections, documents, locations, or personal belongings visible in the photograph. Crop or remove anything you do not want to upload, and do not upload photographs containing confidential, highly sensitive, or unlawfully obtained information.

Depending on your device and how the image is uploaded, an image may carry technical metadata such as creation date, device information, orientation, and location. We may remove or limit some metadata where practical, but you should not assume that all metadata is always removed.

You are responsible for obtaining any legally required permission from people whose images or personal information you upload.

5. Information collected automatically

When you access or use the Service, we and our service providers may automatically collect:

• IP address, approximate location derived from an IP address, time zone, language, and regional settings;
• device type, device identifiers, operating system, application version, browser type, mobile carrier, and screen characteristics;
• log information, request dates and times, access events, crashes, errors, diagnostics, performance information, and security events;
• the screens, features, searches, filters, content, and links you interact with;
• session duration, referral information, navigation paths, feature usage, and interaction frequency;
• likes, saves, follows, duplications, shares, views, and other activity needed to calculate statistics;
• notification-delivery and notification-interaction information;
• cookie, software-development-kit, local-storage, pixel, and similar technology identifiers where applicable; and
• information used to detect spam, fraud, unauthorized access, automation, and policy violations.

6. Device permissions

Depending on the features you use, OBRAZ may request access to certain device functions:

• Camera access, so you can photograph wardrobe pieces, report content, or create profile and collection content.
• Photo-library or media access, so you can select and upload images and save exported looks where supported.
• Notification permission, so we can send activity, follower, subscription, security, collaboration, and other notifications you enable.
• Location permission, if you enable it, so we can use approximate or precise location to provide local weather or location-dependent styling suggestions.
• Clipboard access, which occurs only when you actively paste a link, code, or other content, subject to your device platform's behavior.

You can manage device permissions in your device settings. Refusing or withdrawing a permission may prevent certain features from working. Where available, you may provide a city manually instead of granting device-location permission.

7. Information from other sources

We may receive personal information from:

• authentication providers, such as Google, when you sign in through them;
• Apple, Google, and other billing providers regarding subscription status, transaction identifiers, receipts, renewals, cancellations, and refunds;
• affiliate networks, retailers, brands, and advertising partners regarding clicks, referrals, purchase attribution, transaction status, returns, refunds, and commissions;
• other users who invite you to a collection, tag or report you, interact with your content, or mention you in a support request;
• public sources where permitted by law; and
• vendors and business partners that help us protect, operate, analyze, and improve the Service.

Information received from third parties may be subject to both this Privacy Policy and the third party's own terms and privacy policy.

8. Subscription and payment information

Subscriptions and purchases are processed by Apple, Google, or another payment provider.

We may receive transaction identifiers, subscription plan, billing period, currency, purchase date, renewal date, expiration date, trial status, cancellation status, refund status, country, and receipt or entitlement information.

We do not receive or store your complete payment-card number when payment is processed by an application store or independent payment processor. The payment provider processes payment information independently under its own privacy policy.

9. Affiliate links and commissions

Some product links allow OBRAZ, the user who shared the product, or both to earn a commission or other compensation.

When you interact with a product or affiliate link, we and our partners may process:

• the product, look, piece, collection, profile, or user associated with the link;
• referral, campaign, creator, and affiliate identifiers;
• click time, approximate location, device, browser, application, and interaction information;
• retailer or affiliate-network identifiers;
• whether a transaction was attributed to the link and its commissionable value where the partner provides it; and
• order, cancellation, return, refund, dispute, or chargeback status, and commission eligibility, approval, or reversal.

Retailers and affiliate partners do not need your complete payment-card information to report an attributed transaction to us.

Affiliate tracking may rely on referral parameters, cookies, software-development kits, device identifiers, transaction identifiers, or similar technologies, depending on the partner and your location. Where consent or an opt-out is required for those technologies, we provide the required control.

If we later introduce payouts to users, we will collect the additional identity, tax, and payment information needed for them and will describe that processing before you enroll.

10. Inferences and recommendations

We may create or use inferences about your fashion interests and Service preferences based on categories, colors, brands, seasons, searches, likes, saves, follows, duplicated pieces, created looks, planned outfits, and interactions with products.

We use these inferences to organize content, personalize recommendations, rank search and discovery results, suggest wardrobe pieces or looks, provide weather-related styling suggestions, and improve the Service.

We do not intend to infer sensitive personal characteristics such as health status, religion, political opinions, sexual orientation, or ethnicity from clothing, photos, or behavior. Photos and fashion choices may nevertheless reveal or suggest sensitive information, so consider this before making content public.

11. How we use personal information, and our legal bases

We use personal information to:

• create, authenticate, maintain, secure, and recover accounts;
• provide wardrobe, canvas, looks, collections, planner, social, discovery, sharing, and collaboration features;
• process images, remove backgrounds, generate tags, categorize items, identify colors, and provide AI-assisted features;
• personalize content, search results, recommendations, feeds, and weather-related suggestions;
• process subscriptions, verify entitlements, restore purchases, manage trials, and provide paid features;
• attribute product clicks and purchases, calculate commissions, and prevent commission fraud;
• send account, security, subscription, collaboration, and other service communications;
• send marketing communications where permitted and manage your communication preferences;
• provide support and respond to questions, complaints, legal requests, and reports;
• calculate likes, saves, views, followers, wear counts, duplicated-piece counts, and related statistics;
• investigate fraud, spam, abuse, security incidents, prohibited content, and policy violations;
• maintain, troubleshoot, analyze, test, develop, and improve the Service;
• enforce our Terms of Service and protect users, OBRAZ, service providers, partners, and third parties;
• comply with legal, accounting, tax, and regulatory obligations; and
• establish, exercise, or defend legal claims.

Where the General Data Protection Regulation or a similar law applies, we rely on these legal bases: performance of our contract with you, for providing the Service, your account, subscriptions, and the features you use; our legitimate interests, for security, fraud prevention, analytics, service improvement, product development, and enforcing our Terms; your consent, for optional device permissions, non-essential cookies and similar technologies, and marketing where consent is required, which you can withdraw at any time; and compliance with legal obligations, for tax, accounting, and lawful requests.

12. AI-assisted processing

We process photos, item metadata, text, interactions, and other relevant information using automated and AI-assisted systems to provide background removal, object segmentation, product recognition, tagging, categorization, color detection, search, recommendations, moderation support, and styling suggestions.

This processing may be performed by OBRAZ or by service providers acting on our behalf under contractual restrictions.

Automated results may be inaccurate. You can review and edit generated names, categories, colors, brands, seasons, and other information before saving or publishing.

Unless we clearly disclose otherwise and obtain any permission required by law, we do not authorize private User Content to be used to train publicly available general-purpose AI models.

We may use limited data to evaluate feature quality, detect failures, prevent abuse, and improve OBRAZ-specific systems, where permitted by law and consistent with your settings and choices.

13. How we disclose personal information

We may disclose personal information:

• To other users and the public, when you make content public, follow users, interact with content, participate in shared collections, or otherwise use social features.
• To collaborators, when you join or create shared collections or provide access through collaboration features or invite codes.
• To vendors and service providers supporting cloud hosting, storage, authentication, communications, image processing, AI features, analytics, crash reporting, notifications, customer support, security, moderation, payments, and subscriptions.
• To application stores and payment processors, in connection with purchases, subscriptions, refunds, entitlements, disputes, and fraud prevention.
• To retailers, brands, affiliate networks, advertisers, and commercial partners, in connection with product links, attribution, purchase reporting, and commission calculations.
• To professional advisers, auditors, insurers, banks, accountants, and legal representatives, where reasonably necessary.
• To law-enforcement authorities, courts, regulators, and government agencies, where required by law or reasonably necessary to protect rights, safety, security, or the integrity of the Service.
• In connection with a merger, financing, acquisition, reorganization, bankruptcy, sale of assets, or change of control.
• At your direction, with your consent, or as otherwise clearly disclosed when the information is collected.

Service providers may process personal information only for the services they provide to us and subject to appropriate contractual restrictions, except where they independently determine the purposes and means of processing under applicable law.

14. Public content and other users

Information you mark public may be accessible to other OBRAZ users and, depending on the feature, to people without an OBRAZ account. It may include your profile image, name, username, biography, follower and following information, social links, wardrobe pieces, looks, collections, likes, statistics, and other content you make public.

Other users may save, share, duplicate, export, quote, record, or capture public information. If another user duplicates a public wardrobe piece, a new copy becomes associated with that user's account, and changing or deleting your original does not delete their copy.

Search engines or external services may index public web content if OBRAZ later makes such content accessible through public web pages.

Do not make content public unless you are comfortable with these uses.

15. Sale, sharing, and targeted advertising

OBRAZ does not sell personal information for monetary payment.

Some privacy laws define "sale," "sharing," and targeted advertising broadly, and may include certain disclosures involving advertising, analytics, cookies, software-development kits, device identifiers, or affiliate attribution. If our use of a technology is treated as a sale, sharing, or targeted advertising under applicable law, you may have the right to opt out.

To opt out, contact us at [email protected], or use the privacy controls in the application where they are available.

Where required, we recognize legally valid browser or device-based opt-out preference signals, such as the Global Privacy Control, for the browser or device sending the signal.

We do not knowingly sell or share for cross-context behavioral advertising the personal information of users under 16 without legally required authorization.

16. Cookies and similar technologies

OBRAZ and its partners may use cookies, software-development kits, local storage, pixels, mobile identifiers, referral parameters, and similar technologies to:

• keep you signed in and maintain sessions;
• remember settings, language, appearance, privacy choices, and preferences;
• protect accounts and detect fraud or abuse;
• understand usage, diagnose errors, and measure performance;
• measure marketing or referral campaigns;
• attribute affiliate clicks and purchases; and
• provide personalized content where permitted.

Where legally required, non-essential technologies are used only after you consent. You can manage these technologies through the in-app privacy controls where available, a consent banner, your device settings, or your browser settings, and you can contact [email protected] with any question about them.

Blocking these technologies may prevent some features, authentication functions, or purchase attribution from working correctly.

17. Data retention

We keep personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including providing the Service, maintaining security, complying with law, resolving disputes, enforcing agreements, and processing subscriptions and commissions.

How long that is depends on the nature of the information, why it was collected, whether your account is active, legal and tax requirements, fraud and security risks, and whether the information is needed to establish or defend legal claims.

In general: account information and User Content are kept while your account is active or until you delete the relevant content; copies in backups persist until those backups are overwritten in the normal backup cycle; security, authentication, and technical logs are kept for as long as needed for security and investigations; support and complaint records are kept until the matter is resolved and any related limitation period has passed; and subscription, transaction, accounting, and tax records are kept for the period required by applicable law.

Information may remain in content that other users have independently copied, saved, exported, or captured. We may keep aggregated or de-identified information that cannot reasonably be linked to you.

18. Security

We use administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure. These may include access controls, authentication protections, encryption in transit, encryption at rest where appropriate, logging, monitoring, backups, vendor reviews, confidentiality requirements, and incident-response procedures.

No system is completely secure. We cannot guarantee that personal information will never be accessed, disclosed, altered, lost, or destroyed.

You are responsible for securing your devices, authentication methods, one-time codes, connected accounts, and invite codes. If you believe your account or information has been compromised, contact [email protected] promptly.

19. International data transfers

OBRAZ is operated from Poland, and personal information is processed in the European Economic Area. Some of our service providers operate in the United States and other countries, so your personal information may also be processed there.

Those countries may have privacy and data-protection laws that differ from the laws where you live.

Where a transfer outside the European Economic Area or the United Kingdom takes place, we use legally recognized transfer mechanisms and safeguards, such as adequacy decisions, the European Commission's standard contractual clauses, the United Kingdom International Data Transfer Addendum, contractual protections, and supplementary security measures.

Contact [email protected] if you would like more information about the safeguards that apply.

20. Your privacy rights

Depending on where you live, and subject to applicable exceptions, you may have the right to:

• confirm whether we process your personal information;
• access and receive a copy of it;
• correct inaccurate or incomplete information;
• delete personal information;
• receive certain information in a portable format;
• restrict or object to certain processing;
• withdraw consent where processing is based on consent;
• opt out of sale, sharing, targeted advertising, or certain profiling where applicable;
• request information about the categories of information collected, their sources, purposes, and recipients;
• limit certain uses or disclosures of sensitive personal information where applicable;
• appeal a decision about a privacy request; and
• complain to a privacy or data-protection authority.

To exercise a right, contact [email protected]. We may need to verify your identity first, which may require information associated with your account or other reasonable evidence. Authorized agents may submit requests where the law permits, and we may require proof of authorization.

If you are in the European Economic Area, you may also lodge a complaint with your local supervisory authority or with the Polish President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).

We will not unlawfully discriminate against you for exercising privacy rights. Some information may be exempt from a request or may need to be retained for security, fraud prevention, legal compliance, transactions, tax, accounting, freedom of expression, protection of other users, or legal claims.

21. Account deletion

You can delete your account in the application, or by contacting [email protected]. We may require authentication or identity verification first.

Deleting your account permanently removes access to your wardrobe, looks, collections, planner entries, followers, saved content, statistics, and other account information.

Account deletion does not cancel subscriptions billed through Apple, Google, or another third party. You must cancel those separately.

We may retain information after deletion where necessary for legal, security, fraud-prevention, transaction, tax, accounting, commission, dispute, or rights-enforcement purposes. Content copied, exported, shared, or captured by other users may remain outside your account.

22. Children and teenagers

OBRAZ is not directed to children under 14, and users must be at least 14 years old to create an account. A higher minimum age may apply where local law requires a person to be older to consent independently to the processing of personal information or to use a social service.

If parental consent is legally required and OBRAZ does not provide an appropriate consent process in your location, you may not use the Service.

If we learn that we collected personal information from a child who does not meet the applicable age requirement, we may restrict the account and delete the information, subject to legal retention requirements.

Parents and guardians may contact [email protected] if they believe a child provided personal information without legally required permission.

Users must not upload images of minors unless they are legally authorized to do so and have obtained any required permission.

23. Marketing communications

We may send marketing emails, SMS messages, or push notifications where permitted by law and consistent with your choices.

You can opt out of marketing emails through the unsubscribe link, manage push notifications in your device or application settings, and manage SMS preferences using the instructions in the message.

We may continue sending non-marketing communications necessary for account security, subscriptions, transactions, legal notices, and operation of the Service.

24. Automated decisions and profiling

We use automated systems to rank content, recommend looks and pieces, identify suspected fraud, detect spam, support moderation, and determine whether activity requires additional review.

We do not intend to make decisions based solely on automated processing that produce legal or similarly significant effects for ordinary users. Account-safety, fraud, and moderation decisions may use automated indicators, and significant adverse actions may be subject to human review where required by law.

Contact [email protected] to request information or review where applicable law provides such a right.

25. Third-party links and services

OBRAZ contains links to retailers, brands, social networks, payment providers, application stores, affiliate partners, and other third-party services.

When you leave OBRAZ or interact directly with a third party, that third party may independently collect and process information under its own privacy policy. We do not control and are not responsible for third-party privacy, security, tracking, or data-retention practices.

Review the third party's privacy policy before providing personal information or completing a transaction.

26. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes to the Service, technology, vendors, subscriptions, legal requirements, or data practices. We will update the "Last updated" date when changes are published.

Where required by law, or where changes materially affect your privacy rights, we will give additional notice through the Service, by email, by push notification, or by another appropriate method. Where legally required, we will obtain consent before applying a materially different use to information already collected.