Privacy Policy

Last Updated: July 25, 2026

AiStyle ("AiStyle", "we", "us") is an AI personal-styling service operated by AiStyle OÜ, a company registered in Estonia (Registry Code 16981017). AiStyle OÜ is the data controller for your personal data. This Privacy Policy explains what personal data we collect, how we use it, and — importantly — the specific third parties with whom we share, transfer, or disclose it, including data obtained through Google APIs. It applies to the AiStyle web application at https://app.theaistyle.com and our website at https://www.theaistyle.com.

1.Data We Collect

We collect only the data needed to provide our styling features:

Account & profile data: your name and email address (obtained when you sign in with Google), plus style preferences you provide.
Photos and imagery: face and body photos you upload for style analysis, and clothing photos you add to your digital wardrobe.
Google Calendar data: read-only event details (titles, start/end times, descriptions) used to suggest event-appropriate outfits.
Approximate location: device-derived coordinates used only to look up local weather for recommendations.
Usage & billing data: product-usage events and, for paid plans, billing information processed by our payment provider.

2.How We Use Your Data

Authenticate your account and keep it secure.
Generate your personal style analysis, outfit recommendations, and outfit imagery.
Provide the Planner (calendar-aware outfit suggestions) and Virtual Try-On.
Process subscription and credit-pack payments.
Understand product usage and improve the service.

We do not sell your personal data, and we do not use Google user data for advertising or to build advertising profiles.

3.Google API Services: Access, Use, and Limited Use

AiStyle uses Google APIs to sign you in and to power context-aware outfit planning. We request the minimum scopes needed for these features.

Google API Limited Use Compliance Statement AiStyle's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use data obtained through Google API scopes to serve advertisements, build marketing profiles, or sell information to third-party data brokers.

Scopes We Request and Why

Google Sign-In (profile, email, openid): used solely to authenticate you and create your account. These are the minimum scopes for secure sign-in.
Google Calendar — read-only (calendar.events.readonly): used to read upcoming event titles, times, and descriptions so the Planner can suggest outfits appropriate to each event. We never create, modify, or delete calendar events.

4.With Whom We Share, Transfer, or Disclose Your Data

We do not sell, rent, or trade your personal data. Except as listed below, we do not share, transfer, or disclose it to any third party. This section names every service provider (sub-processor) that receives your data, and why. Each receives only the data necessary for its stated purpose.

Zeabur (application hosting): runs the AiStyle web application and serves it to your browser. It is hosted in the AWS Asia Pacific (Tokyo, Japan) region.
Supabase (database, authentication & storage): hosts your account, profile, style analysis, wardrobe, and uploaded photos on our behalf. This is where your data is stored and secured — in the AWS Asia Pacific (Mumbai, India) region (see Section 9).
Google Gemini API — Google LLC (AI processing): your uploaded photos, style inputs, wardrobe/outfit context, and Google Calendar event details are sent to Google Gemini (large language and image-generation models provided by Google LLC) to produce your style analysis, outfit recommendations, and generated outfit images.
TheNewBlack (virtual try-on): when you use Virtual Try-On, your photo and the selected product image are sent to TheNewBlack to generate the try-on image.
Airwallex (payments): when you subscribe or buy credits, AiStyle sends Airwallex only an internal order reference; you enter your card details directly on Airwallex's secure payment page. AiStyle never receives or stores your raw card numbers.
Open-Meteo (weather): approximate location coordinates (not your identity) are sent to the keyless Open-Meteo API to retrieve local weather conditions.
PostHog (product analytics, United States): pseudonymous product-usage events help us understand feature usage and improve the service. No Google user data, photos, or calendar content is sent to PostHog.
Legally compelled disclosure: we may disclose data, including Google user data, if required by law, subpoena, or legal process, or to protect the rights, property, or safety of AiStyle, our users, or the public.

How We Handle Google User Data Specifically Google user data — your Google profile and email (from Google Sign-In) and your Google Calendar events — is disclosed only to Supabase (secure storage on our behalf) and Google Gemini (to generate your recommendations). It is never sold, never shared with advertisers, data brokers, or analytics resellers, and never used to serve ads. This is provided in addition to, and consistent with, the Google API Limited Use statement above.

5.AI Processing and AI-Generated Content

AI processing: styling analysis, recommendation text, and outfit images are produced by Google Gemini; virtual try-on images are produced by TheNewBlack. Consistent with the Gemini API data-use terms, your inputs are not used by Google to train its general-purpose models.
AI-generated images: images generated via Google Gemini automatically carry Google's SynthID invisible watermark identifying them as AI-generated. In addition, AiStyle adds a visible "AI Generated by AiStyle" label to the images it produces. Please do not remove, hide, or misrepresent these markers.

6.Biometric and Sensitive Imagery

Face and body photos you upload are treated as sensitive data. We process them only with your consent and solely to generate your style analysis and recommendations. These images and the analysis derived from them are never sold, never used for advertising, and are stored in access-controlled storage (private buckets served via short-lived signed URLs). You can delete them at any time by deleting the relevant item or your account (see Section 8).

7.Data Storage, Security, and Retention

Your data is stored in our Supabase project (Postgres, Storage) with row-level security enforced on every table, so records are scoped to your own account.
Google Calendar data: we do not store your calendar. We keep a record only for events you actually plan an outfit for — the event ID, event title, date, and the occasion we derive from it — so your outfit can be shown to you again on any device. Events you never plan an outfit for are never written to our servers. A copy of your planned outfits is also cached locally in your browser so the Planner loads instantly and works offline; signing out or deleting your account clears it. All of it is erased when you delete your account.
Sensitive images (profile photos, try-on results) are kept in private storage buckets and served only through short-lived signed URLs. All traffic is encrypted in transit over HTTPS.
Third-party API keys are held server-side only (in secure edge-function secrets) and are never exposed to your browser.
We retain your data while your account is active. When you delete your account, we delete or anonymize your personal data within 30 days, except where retention is required by law.

8.Your Rights and Choices

Revoke Google access: you can disconnect AiStyle from your Google Account at any time via Google Account → Security → Third-party access. This immediately stops our access to your Google Calendar.
Delete your account and data: request deletion at any time through your account settings or by contacting us at support@theaistyle.com.
Access and correction: you may request a copy of your personal data or ask us to correct it.

If you are located in the European Economic Area, you also have the right to lodge a complaint with your local data protection supervisory authority, or with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), the lead authority for AiStyle OÜ.

9.International Data Transfers

AiStyle OÜ is registered in Estonia (EU). Your data is processed in several locations by the providers named in Section 4:

Application hosting — Japan: our web application runs on Zeabur in the AWS Asia Pacific (Tokyo, Japan) region.
Database & storage — India: your account, profile, wardrobe, and uploaded photos are stored by Supabase in the AWS Asia Pacific (Mumbai, India — ap-south-1) region.
Product analytics — United States: pseudonymous usage events are processed by PostHog.

Japan benefits from a European Commission adequacy decision. India and the United States do not; where we transfer personal data from the EU/EEA to those countries, we rely on the European Commission's Standard Contractual Clauses (SCCs), together with supplementary technical and organizational measures, to ensure your data receives a level of protection consistent with the GDPR. You may request a copy of the relevant safeguards by contacting us at support@theaistyle.com.

10.Contact

AiStyle OÜ
Registry Code: 16981017
Registered Address: Sepapaja tn 6, Lasnamäe linnaosa, Tallinn, Harju maakond, 15551, Estonia

For any privacy question or request, contact us at support@theaistyle.com.

Google OAuth Verification Readiness Statement

This section outlines AiStyle's adherence to Google's OAuth 2.0 Policies and the Google API Services User Data Policy, specifically addressing the requirements for sensitive scope verification.

1. Identity and Intent Representation

AiStyle accurately represents its identity and intent to Google users. Our application name, support email, home page URI (https://www.theaistyle.com), and privacy policy URI are clearly displayed on the OAuth consent screen and accurately reflect our application's identity. We are transparent about the data requested and the purpose for its use, ensuring users can make informed decisions when granting authorization.

2. Transparency and Privacy Disclosures

Our Privacy Policy thoroughly discloses how AiStyle accesses, uses, stores, and shares Google user data, including the specific third parties that receive it (see Section 4, "With Whom We Share, Transfer, or Disclose Your Data"). This policy is publicly accessible, hosted within the same domain as our application's home page, and linked on the OAuth consent screen. We commit to limiting our use of Google user data to the practices explicitly disclosed in our published Privacy Policy.

3. Minimum Relevant Permissions

AiStyle strictly adheres to the principle of requesting the minimum relevant permissions. We only request access to Google user data that is critical and necessary to implement our application's core features. We do not request access to information that is not essential for our application's functionality.

Google Login API (Profile/Email Scopes): We request profile, email, and openid scopes for user authentication and profile linking. These are the narrowest scopes available for secure login and personalized user experience.
Google Calendar API (Read-Only Event Scopes): We request read-only access to calendar events (https://www.googleapis.com/auth/calendar.events.readonly) to provide context-aware outfit recommendations. This scope is essential for our core functionality of integrating with a user's agenda for outfit planning.

4. Data Usage and Limited Use Compliance

AiStyle's use and transfer of information received from Google APIs strictly adheres to the Google API Services User Data Policy, including the Limited Use requirements. We commit to:

Limiting our use of data to providing or improving user-facing features that are prominent in the AiStyle application's user interface.
Prohibiting the transfer or sale of user data to third parties like advertising platforms, data brokers, or any other unauthorized entities. Google user data is disclosed only to our secure storage provider (Supabase) and to Google Gemini to generate your recommendations, as detailed in Section 4.
Ensuring that human access to user data is strictly limited to security purposes (e.g., investigating abuse) or to comply with applicable laws, and only with the user's affirmative agreement for specific data viewing.

5. Secure Operating Environment

AiStyle maintains a secure operating environment to protect all user data in transit and at rest. We implement reasonable and appropriate steps to safeguard applications and systems that utilize Google API Services and derived data against unauthorized access, use, destruction, loss, alteration, or disclosure.

6. Video Demonstration

As part of the verification process for sensitive scopes, AiStyle will provide a video demonstration that fully illustrates:

How a user initiates and grants access to the requested scopes (Google Login and Google Calendar read-only).
The OAuth consent flow, including the correct display of the App Name and the OAuth client ID in the browser address bar.
The detailed usage of the granted sensitive scope (Google Calendar read-only) within the AiStyle application, demonstrating how calendar events are used to generate context-aware outfit suggestions without modifying any user data.