Mobile App Privacy Policy

01Who we are and what this policy covers#

TWIST DIGITAL (PRIVATE) LIMITED, of No. 237/4, Polhengoda Road, Colombo 05, Sri Lanka, decides why and how your personal data is used in the App. In legal terms we are the “controller” of that data. Some laws use a different word, such as “business” or “data fiduciary”; it means the same thing here.

This policy covers the StyleFrame AI mobile app on Android. In the App you upload an image of a garment and a photo of yourself, and we generate a picture showing roughly how that garment might look on you. You do this through a personal account. Your photos and try-ons are not kept in it: they are deleted about one hour after you last use them. This policy also covers the pages of our website that relate to the App, such as the page for deleting your account.

This policy does not cover:

• The in-shop StyleFrame AI try-on that starts from a QR code on a garment tag. That service has its own Privacy Policy.
• Google Play. It delivers the App to your phone, under its own privacy policy.
• The website, shop or person your garment image came from.

02What we collect#

We collect only what is needed to produce your try-on and keep the App working.

What we do not collect

• Any personal details beyond the account details listed above.
• Your payment card details. The App takes no payments.
• Your precise location, your contacts, or any photo other than the one you choose.
• Your phone’s advertising identifier. If advertising is added later, we will ask you first (see section 09).
• Location or camera details stored inside an image file. These are removed before the image is processed or saved.
• Anything from social-media accounts or from data brokers.

03Your photo and your body#

What the AI does with it. To place a garment on you, the AI has to work out where your body is in the picture: its outline, your pose, and what you are already wearing. That working exists only while your picture is being generated, and is then discarded. Only the photo itself is kept, and only until it is deleted about one hour after you last use it.

What we never do with it.

• We do not use it to identify you, verify you or recognise you, and we do not compare it with any other image or database.
• We do not create, store or share a faceprint, a face template, a body template or body measurements.
• We do not use it to infer your age, health, ethnicity, religion or anything else about you.
• We do not use it to build a profile of you.

Why we still ask for explicit consent. Some laws treat any analysis of a face or body as “biometric” or “sensitive” data, even when nobody is being identified. A photo can also reveal sensitive things about a person without anyone looking for them. So we apply the stricter standard to everyone: your explicit permission before the first upload, deletion about one hour after use, deletion of your account whenever you choose, no sale, and no disclosure beyond the providers needed to produce your picture.

The App cannot work without this permission, so you give it before your first upload. You can withdraw it at any time by deleting your account, which also deletes everything stored with it. Section 13 explains how.

04Why we use your data, and our legal basis#

We use each kind of data for the purpose listed beside it and for nothing else.

If you do not give consent, we cannot generate a try-on. Nothing else happens: no image leaves your phone.

We do not use your data for advertising or profiling at present, and we never use it to train or improve any AI model. Section 09 explains what will happen before advertising is added. We do not send news or offers. If we start, we will send them only if you opt in, and every message will let you unsubscribe. If we ever want to use data for a new purpose, we will ask you first.

05How AI is used#

Your try-on is generated by our AI provider, fal (Features & Labels, Inc., United States), not on your phone. Through fal and OpenRouter, Google’s Gemini models check that your images are suitable, and OpenAI’s model generates your try-on. fal passes your images to those companies, so they receive them too. The App asks for your permission before your first photo is sent.

What our AI providers may and may not do. fal handles your images under its own business terms. Those terms rule out using the images we send to create, train or develop fal’s products, including through the partner companies whose models fal provides. We use only models that this promise fully covers. Under their own terms, Google and OpenAI do not use your images to train their AI models, apart from Google’s systems for detecting misuse. Each keeps a copy for a limited time to check for misuse, as section 08 sets out, and their staff may review images that their safety systems flag. These are commitments our providers make in their own terms. We choose only providers and models that make them, and we check them again when a provider changes its terms, but we do not control how those companies run their own systems. If a provider’s terms change in a way that affects your images, we will update this policy and tell you in the App before your next upload.

Every result is AI-generated. It is not a photograph of you wearing the garment. We label each result as AI-generated where you see it. Each picture also carries a visible StyleFrame AI mark. Neither the label nor the mark contains anything about you.

Safety checks. Automated filters may refuse an image, for example one that appears to show a child. If you think a refusal was wrong, email us and a person will look at it.

No decisions about you. We do not use AI or any automated process to make decisions that have a legal or similarly significant effect on you. The only thing the AI produces is a picture.

06Who receives your data#

Your data goes only to the organisations needed to run the App.

The AI, hosting, email and SMS providers above act for us under their business terms or contracts with us. These require them to keep the data secure. Our hosting, email and SMS providers may use it only to provide their service to us. Section 05 covers our AI providers.

07Sending data to other countries#

Your data will usually leave the country you live in. We are based in Sri Lanka, our servers are in Singapore, and our AI providers, fal, OpenRouter, Google and OpenAI, are based in the United States. Google may also process or briefly store images in other countries where it has facilities.

Some of those countries may not protect personal data the way your own country does. Authorities there may be able to demand access to data held by companies. Your photos and try-on pictures are deleted from our servers about one hour after you last use them.

We also rely on these safeguards:

• Your explicit consent. The App asks for your permission before the first upload, and this policy tells you where your images go and the risk above.
• Contracts. We use fal under its business terms and data processing addendum, which bind it to protect your data. Google, OpenAI and OpenRouter receive your images through fal, under fal’s own terms with them.
• Adequacy decisions. Where a government or regulator has formally recognised a destination country as giving adequate protection, we may rely on that instead.

Email us if you would like a copy of the safeguards that apply to your data.

08How long we keep things#

Your photos and try-on pictures are deleted about one hour after you last use them. Everything else is kept only as long as the table below says.

Deletion is permanent. An account you delete is removed from our live systems at once. It cannot be recovered, by you or by us. Copies that Google and OpenAI keep to check for misuse are deleted on their own schedule, within the periods in the table above; deleting in the App cannot shorten that.

If the law requires us to keep something longer, for example because of a court order, we keep only that item, only for that reason, and only for as long as required.

09Permissions, storage on your phone, and tracking#

The App asks your phone for the least access it can work with.

The App asks for no permission to use your photos, camera or storage. You choose a photo with Android’s own photo picker, which gives the App only the photo you pick. Saving a try-on picture to your gallery, on Android 10 and later, needs no permission either.

The App never asks for your location, contacts, microphone or Bluetooth.

What is stored on your phone. Your sign-in session and your settings, and, while you prepare a try-on, the photos you chose, in the App’s private storage for up to an hour. Deleting the App removes these from your phone. It does not delete your account or anything stored in it; use Settings for that.

Tracking. We do not track you across other companies’ apps or websites. The App does not read your advertising identifier, and it contains no advertising or social-media software.

Before advertising starts. We plan to show ads in the App, and to advertise the App on other apps and websites. Before any advertising or ad-measurement software goes into the App, we will:

• update this policy and the store privacy labels, naming each advertising partner and what it receives;
• ask your permission before reading your advertising identifier or tracking you across other apps and websites: on iPhone through Apple’s tracking prompt, and in the EEA and the United Kingdom through a consent screen;
• let you say no and keep using the App as normal.

Whatever happens, your photos, garment images and try-on results will never be shared with advertisers or used to choose which ads you see.

Store privacy labels. The App Store privacy label and the Google Play Data safety section summarise this policy. If you spot a difference, tell us. This policy is the full statement.

10Security#

We protect your data with measures matched to how sensitive a photo of a person is.

• Images are encrypted while they travel between your phone, our servers and our AI providers.
• Your photos and try-on pictures can be opened only through your account, and only for the hour they are kept. No person at our company looks at them in the normal running of the App.
• Access to our systems is limited to the few people who need it, is logged, and requires strong authentication.
• We check the security of each provider before we use it, and our contracts require them to keep the same standard.

No system is perfectly secure. If a breach of your personal data is likely to put you at risk, we will tell the relevant regulator and tell you, within the time the law sets. We would tell you using your account contact details and a notice in the App.

11Children#

The App is for adults only. You must be 18 or older to use it; our AI providers require this too.

Never upload a photo of a child, whoever the child is.

We do not knowingly collect personal data from children. If we learn that a child’s photo has been uploaded, we delete it at once and may close the account that sent it.

Some laws require app stores to tell app developers a user’s age range. Where Apple or Google sends us that signal, we use it only to stop under-age use. We do not keep it or use it for anything else.

If you are a parent or guardian and believe your child has used the App, email info@styleframe.fit.

12Photos of other people#

Upload only a photo of yourself, or of another adult who knows about it and has agreed.

A garment image sometimes shows a person too, such as a model in a shop photo. Where you can, use an image of the garment on its own. Whatever the garment image shows, it is handled and deleted exactly as your own photo is.

If you believe someone has uploaded a photo of you without your agreement, email info@styleframe.fit. We will look into it, remove the image where the complaint is well founded, and can close the account that uploaded it.

13Your rights, and how to use them#

Wherever you live, you have the rights below. We do not make them depend on which country’s law applies to you.

We will never treat you worse for using any of these rights.

How to use them

• In the App: Settings → Delete account.
• On the web: www.styleframe.fit/delete-account lets you delete your account and everything in it without the App installed.
• By email: info@styleframe.fit.
• Through someone else: a person you authorise can ask for you. We will ask them for proof of that authority.

Checking it is you. A request made from inside your signed-in account needs no further check. For a request by email, we confirm it through the contact details on the account. We will not ask for more than we need.

What deleting your account does. It permanently deletes your account, your sign-in details, your consent record, your credits, your reports and any photo or picture not yet deleted. We keep only the two records set out in section 08.

Timing and cost. We reply without undue delay, and within one month. If a request is complex we may take up to two more months, and we will tell you why within the first month. Requests are free.

If we say no. We give our reasons. We also tell you how to ask us to look again, and how to appeal or complain to a regulator.

14Extra terms for where you live#

These terms add to everything above. They never reduce it.

15Where the App is offered#

The App is offered through Google Play in these South Asian countries: Sri Lanka, India, Pakistan, Bangladesh, Nepal, Bhutan and the Maldives. We do not target it at, or offer it to, people in other countries.

16Changes to this policy#

We may update this policy. The version number and dates at the top tell you which version you are reading and when it took effect.

If a change affects how your photo is used, who receives it or how long it is kept, we tell you in the App before the change takes effect and ask for your consent again. Other changes take effect when the new version is posted. Earlier versions are available on request.

17Contact and complaints#

TWIST DIGITAL (PRIVATE) LIMITED, No. 237/4, Polhengoda Road, Colombo 05, Sri Lanka. Registered in Sri Lanka, company number P V 00310542.

Privacy questions, requests and complaints: info@styleframe.fit.

Please contact us first. Nearly everything is quicker to fix by email than by anything else. We acknowledge every complaint within 7 days, look into it properly, and tell you the outcome without undue delay.

You may also complain to a regulator at any time: