Privacy Policy

Last updated: August 4, 2026

Summary

• Photos are processed only for your closet: the clothing photo you upload is used solely to recognize, tag and cut out the garment; it is not used for anything else.
• Original photos are not stored: your closet keeps only the clothing image prepared for the piece (usually a background-removed cutout) and its tags; no other copy of your photo is saved.
• Virtual try-on (VTON): the photo you use for try-on is not stored — it is processed only for the generation request. If you make the generated image your outfit photo, only that image is kept in your account and you can delete it anytime.
• Analytics: anonymous usage events are collected (PostHog, EU servers); photos and personal content are never sent to analytics.
• Your data is yours: you can permanently delete your account and all your data from settings, and export it (data portability).

Additional information for EU / UK users (GDPR)

Data controller: the operator of Zevela (independent developer). Contact: support@zevela.app

Legal bases

• Performance of a contract (Art. 6(1)(b)): your account, closet, outfit suggestions and purchases — the processing needed to provide the service.
• Explicit consent (Art. 6(1)(a)): uploading clothing photos and processing your photo — including your face — for virtual try-on (VTON). In the consent you declare the photo is yours (or that you have permission) and that you accept responsibility for any unauthorized use of someone else’s photo. You can withdraw consent at any time; withdrawal does not affect the lawfulness of prior processing.
• Consent (cookies/analytics): anonymous usage analytics run only if you accept them in the cookie notice.
• Legitimate interest (Art. 6(1)(f)): service security and debugging (error logs).
• Legitimate interest (Art. 6(1)(f)): abuse prevention — your IP address and browser details from the first time we see your account (sign-up or first login) are stored ONCE to detect fake accounts and referral-reward farming; later logins are not recorded. Only the operator can access this data, no automated decision is made about you, and you can object to this processing at any time (Art. 21).

AI processing (automated processing)

Your clothing images are sent via API to AI providers (Anthropic, Google) for tagging, and your stylist requests for generating suggestions; your try-on photo is first sent to Anthropic for a suitability check and then to Google Gemini for image generation, and is stored by neither. These providers do not use API data to train their models.

No fully automated decisions are made that produce legal effects concerning you or similarly significantly affect you (Art. 22); suggestions are recommendations only.

Retention periods

• Account and closet data: until you delete your account; on deletion all your data is permanently erased — the only exception is the abuse-prevention digest below.
• Virtual try-on photo: not stored (processed only during the generation request). Generated images you make your outfit photo: until you delete them.
• Purchase records: for as long as statutory accounting and tax obligations require.
• Security records (first-seen IP and browser details): 12 months; deleted automatically by a daily job once the period ends.
• Abuse-prevention digest (an irreversible salted digest derived from your email address): 24 months — kept even if you delete your account, then deleted automatically by a daily job.

International transfers

The servers of the providers below may be located outside the EEA/UK (e.g. the USA). In that case transfers rely on European Commission adequacy decisions or appropriate safeguards such as Standard Contractual Clauses (SCCs).

Sub-processors

• Supabase — database, authentication and file storage
• Vercel — web hosting and content delivery
• Anthropic (Claude) — clothing tagging and stylist suggestions (AI)
• Google (Gemini) — image enhancement and virtual try-on images (AI)
• PostHog — anonymous usage analytics (EU servers, consent-based)
• Sentry — error monitoring
• RevenueCat — purchase and subscription management
• cron-job.org — scheduled notification trigger (receives no personal data)

Age limit

Zevela is not directed at children under 16, and a 16+ floor is applied in every market. We do not knowingly collect children's data; if we become aware of any, it is deleted.

Your rights under the GDPR

You have the right of access, rectification, erasure, restriction of processing, objection and data portability, and you can withdraw your consent at any time. From the Account page you can download your data or permanently delete your account with all your data. You also have the right to lodge a complaint with the data protection supervisory authority in your country. Contact: support@zevela.app