1. Overview and Core Invariants
This Privacy Policy explains how great.style ("we," "our," or "the Service") collects, uses, retains, and protects personal information and biometric data when you interact with our website at great.style.
We operate on four foundational privacy invariants:
- Strict Age Gate (18+ Only): The Service is exclusively for individuals who are 18 years of age or older. We do not knowingly collect, process, or retain photographs or biometric data of minors under 18.
- Affirmative Informed Consent: You must explicitly opt in and consent to biometric processing before activating our camera or uploading any photograph.
- 90-Day Maximum Retention Schedule: Stored reports and synthetic try-on renderings automatically expire and are permanently purged from our cloud storage (Cloudflare R2) after 90 days.
- No AI Model Training on User Likeness: Your photographs and rendered try-on images are never used to train foundation AI models or public datasets.
2. Biometric Information Privacy Notice (Illinois BIPA § 15 & Texas CUBI § 503.001)
Under the Illinois Biometric Information Privacy Act (740 ILCS 14/1 et seq.) and the Texas Capture or Use of Biometric Identifier Act (Tex. Bus. & Com. Code § 503.001), companies collecting biometric identifiers must provide written notice, publish a retention schedule, and obtain an affirmative written release.
A. Specific Biometric Data Collected
When you use great.style, the following data may be extracted from your uploaded photo or live camera feed:
- Facial Landmark Geometry: 468 client-side 3D facial mesh coordinate points (processed locally in your browser using MediaPipe FaceMesh) to measure jawline framing, cheekbone height, and eye spacing.
- Pose Coordinates: Keypoint landmarks around the collarbones, shoulders, and neckline to calibrate digital fabric draping and silhouette proportions.
- Colorimetric Values: Skin tone undertones (warm, cool, neutral), contrast delta between hair, eyes, and skin, and lip shade values to determine your 12-season color analysis palette.
- Facial Likeness Embeddings: Encoded visual representations passed to our image generation pipeline to preserve your genuine facial identity across synthetic try-on outfits.
B. Purpose of Collection and Processing
Biometric identifiers are collected and processed solely for:
- Determining your personalized color season (e.g., Deep Autumn, Light Spring, Cool Summer);
- Calculating silhouette recommendations, neckline cuts, and architectural tailoring rules tailored to your body geometry;
- Synthesizing personalized virtual try-on images depicting you wearing curated clothing pieces.
C. Retention Schedule and Guidelines for Permanent Destruction
great.style maintains a strict lifecycle retention policy:
- Local In-Memory Processing: Real-time camera frames and webcam video streams are processed entirely in local browser memory and are never transmitted to our servers or recorded.
- User-Initiated Deletion: You may delete any saved style report at any time using the "Delete report" button in your report settings, which immediately deletes the report and all associated image assets from our database and Cloudflare R2 bucket.
- Automated 90-Day Permanent Purge: All generated reports, synthetic try-on images, and uploaded reference portraits stored in our encrypted Cloudflare R2 storage are governed by an automated 90-day lifecycle expiration rule. Exactly 90 days after creation, all assets and associated biometric data are permanently and irreversibly destroyed.
3. Information We Collect and Process
A. Information You Provide Directly
- Photographs: The portrait or selfie you choose to upload or capture via your camera.
- Style Brief & Occasion: Priority occasion selections (e.g., everyday, work, date night, formal event), wardrobe preference (menswear, womenswear, unisex), and optional styling notes.
- Payment Information: When you purchase credit packs, payment card details are collected directly by our payment processor, Stripe, Inc. We never receive or store your raw payment card numbers.
B. Information Collected Automatically
- Session Identifiers & Tokens: Cryptographically generated session identifiers and JSON Web Tokens (JWTs) stored in your browser's local storage to track report access and credit balances.
- Network & Device Data: Client IP address and User-Agent headers, collected transiently to enforce rate limiting, prevent API abuse, and combat fraud.
4. Third-Party Service Providers and Data Disclosures
We transmit your information to third-party vendors strictly to deliver the styling service:
- Cloudflare, Inc.: Hosts our edge network, Cloudflare Workers, encrypted Key-Value stores, and R2 object storage.
- Google Cloud (Gemini API): Provides multimodal language and vision models for color season analysis and photorealistic try-on rendering. Image payloads sent to Gemini are governed by Google's Enterprise Privacy Terms and are not used to train Google models.
- Stripe, Inc.: Processes payments and manages checkout sessions securely.
We do not sell, rent, disclose, or trade your personal or biometric information to data brokers, advertisers, or any unauthorized third parties.
5. Your Rights (GDPR, CCPA/CPRA, and State Privacy Laws)
Depending on your jurisdiction, you have the right to:
- Access & Portability: Request a copy of the personal and biometric data associated with your session.
- Erasure & Deletion: Request immediate destruction of your photographs, biometric landmarks, and reports.
- Withdraw Consent: Revoke consent for biometric processing at any time, terminating future try-on generations.
- Non-Discrimination: We will never deny service, charge different prices, or provide a degraded experience for exercising your privacy rights.
6. Security Measures
We employ robust industry-standard safeguards, including TLS 1.3 encryption in transit, AES-256 encryption at rest in Cloudflare R2, digitally signed JSON Web Tokens (HS256), IP-based rate limiting, and automated 90-day storage purging.
7. Contact & Data Rights Requests
To exercise your data privacy rights, request manual deletion of your images, or submit questions regarding this Biometric Information Notice, please contact our Data Protection Officer:
great.style Privacy Operations
Email: [email protected]
Support: [email protected]
Response Time Commitment: Within 48 hours for biometric deletion requests.