Privacy Notice
Last updated / version: 2026-05-22-vcep
1. Who we are (Data Controller)
The data controller for your personal data is
Natis Digital Studio
("we", "us"). You can contact us at
[email protected].
2. What data we process
- Account data: email address, hashed password (held by Firebase Auth), Firebase user ID.
- Profile data: body shape, height, eye / hair / skin colour you choose to provide.
- Biometric data (special category, GDPR Art. 9): the photo (selfie) you upload for look generation.
- Garment images and descriptions you upload or select.
- Generated images produced by the AI on your behalf.
- Render provenance and feedback data: model name, prompt/workflow hashes, garment source references, output image hashes, VCEP render SBOMs, Output Contracts, retry feedback, focused item selections, and Failure Atoms describing what went wrong.
- Technical data: IP address, session cookie, basic request logs (security and abuse-prevention).
3. Why we process it (purposes & legal bases)
- Provide the service (generate, store and display your fashion looks) — Art. 6(1)(b) performance of a contract.
- Process your selfie to generate a look — Art. 9(2)(a) your explicit consent, which you give at sign-up and can withdraw at any time.
- Create VCEP provenance records, render SBOMs, Output Contracts, evidence records and Failure Atoms so we can audit how AI images were produced, improve render quality, troubleshoot bad generations, and build safer AI fashion workflows — Art. 6(1)(f) our legitimate interests, and where your selfie is involved, Art. 9(2)(a) your explicit consent.
- Develop brand, image-generator, and MCP-accessible AI-agent features that use render provenance, consent status, failure categories, garment-source labels, and aggregate performance analytics to identify what works well or badly in AI try-on — Art. 6(1)(f) our legitimate interests, and Art. 9(2)(a) where biometric data is processed.
- Account security, fraud prevention and abuse handling — Art. 6(1)(f) our legitimate interests.
- Comply with legal obligations (e.g. responding to lawful requests) — Art. 6(1)(c).
4. Automated processing & AI
Generated images are produced by an AI model (Google Gemini). They are
watermarked and tagged as AI-generated in line with the EU AI Act (Art. 50). The
service does not use your data to make decisions producing legal or similarly
significant effects on you.
We may attach VCEP records to generated images. A VCEP record can describe the AI model,
workflow, garment sources, source labels, known limitations, feedback, failure categories,
image hashes, and audit metadata used to understand and improve the generation. These records
help us learn which workflows, garment sources, photo conditions, and model versions produce
reliable or poor results.
5. Recipients & processors
- Google LLC / Google Ireland Ltd — Firebase Auth (authentication), Firestore (database), Google Cloud Storage (image storage), and the Gemini API (AI generation).
- Hosting on Google Cloud Run.
- Brand and image-generation partners — where enabled, we may share aggregated, de-identified, or rights-cleared VCEP analytics and provenance information to show which garment sources, workflows, and render conditions performed well or failed. We do not allow partners to use identifiable photos or generated images containing you for marketing unless you give separate permission for that use.
- We do not sell your data and do not share it with advertising networks.
6. Cookies & local storage
We use a small number of cookies and browser-storage entries. We do not
use advertising, marketing, or cross-site tracking cookies.
| Name | Type | Purpose | Retention |
|---|
| Firebase Auth / session |
Strictly necessary |
Keeps you signed in and secures your session. |
Session / until sign-out. |
| Antiforgery token |
Strictly necessary |
Protects forms against cross-site request forgery (CSRF). |
Session. |
ndsCookieConsent |
Strictly necessary |
Remembers your cookie choice so we don't ask again. |
6 months. |
ndsPaletteSelection |
Functional (consent) |
Remembers the colour-palette swatches you selected so they persist between visits. Only set if you choose "Accept all". |
12 months. |
voxCreateLookFormState |
Functional (local storage) |
Remembers in-progress Create Look form entries on your device. Stored in your browser, not sent to us automatically. |
Until cleared by you. |
Strictly-necessary cookies are required for the service to work and do not need consent.
Functional cookies are only set after you choose Accept all in the cookie banner;
choosing Necessary only leaves them off (and removes the palette cookie). You can
also clear cookies at any time through your browser settings.
7. International transfers
Some processing takes place in the United States. Transfers rely on the
EU Standard Contractual Clauses and Google's certification under the
EU–US Data Privacy Framework. Contact us for a copy of the safeguards.
8. Retention
- Account, profile and looks: kept for as long as your account exists.
- Generated and uploaded images: kept until you delete the look or your account.
- VCEP render records, evidence records, retry feedback, and Failure Atoms: kept while your account exists, unless retained in de-identified or aggregate form for quality, safety, audit, or model-evaluation analytics.
- Server logs: typically up to 90 days for security purposes.
- Backups: rolling backups overwritten within 30 days.
9. Your rights (GDPR Arts. 15–22)
You can:
- Access, rectify or port your personal data.
- Erase your account and all associated data — use the
Delete my data page.
- Withdraw your biometric-processing consent at any time, without affecting
processing carried out before withdrawal.
- Object to processing based on legitimate interests.
- Lodge a complaint with your national data protection authority.
To exercise any right, email
[email protected].
We respond within one month (Art. 12(3)).
10. Children
The service is not directed to children under 16. Do not create an account or
upload photos if you are under 16.
11. Changes to this notice
If we materially change this notice we will increment the version and ask you to
re-confirm your consent before continuing to generate images.