Privacy Notice

We collect only what we need to run the service. Each type of data below maps to the specific reason we collect it and the legal basis we rely on under GDPR Article 6.

A note on consent tiers. We operate a three-tier consent model. Tier 1 covers the data needed to run your wardrobe. Tier 2 covers deeper StyleSoul personalization. Tier 3 covers brand interaction features. You can change or withdraw any tier at any time from your account settings. Withdrawing consent won't delete your account, but it will limit certain features.

StyleSoul is the AI engine behind The Perfect Add's recommendations. It reads your wardrobe data to identify patterns: what you wear, when you wear it, what stays in the closet, and what tends to go together.

Your wear log — the record of what you wear and how often — is on by default because it's what makes recommendations work. You can turn it off at any time from your account settings. When it's off, StyleSoul still works but recommendations become less personalized over time.

Your wear log does two things. First, it personalizes your own experience. Second, when aggregated and anonymized across many users, it powers in-app community features — things like trending pieces, social proof indicators, and StyleSoul Wrapped comparisons. These signals never identify you individually. They only surface once enough people share a pattern. We enforce a minimum group size before any community signal appears, so no signal can be traced to one person. Your individual wear data is not visible to other users at any time.

This in-app use of aggregated wear data is different from the optional brand data sharing described in the sharing section. Brand sharing is a separate opt-in that sends anonymized data outside the app. Community features stay inside The Perfect Add and use the same wear log you've already enabled. Turning off your wear log stops both uses.

Two things StyleSoul does not do:

• It does not train on your individual data without your explicit opt-in consent. Your wardrobe information is used to generate recommendations for you, not to improve the model for everyone else, unless you've specifically agreed to that.
• It does not make decisions that have legal or equivalent effect on you. StyleSoul's output is always a recommendation. You decide what to do with it.

When we generate aggregate insights for brand partners, those insights are anonymized and represent groups, never people. Every analytics query has to clear a minimum group size before it returns anything. Below that, it returns nothing at all. Your individual data is never passed to a brand.

Security is built into the architecture, not added later. Every user's wardrobe, wear log, and account data is isolated at the database level using row-level security — one user cannot access another's data. Garment photos are stored under access-controlled storage with expiring links. Data moves between your device and our servers over encrypted connections. Access to production systems is restricted to least-privilege credentials, and privileged keys are never exposed to the browser.

If a security incident affects your personal data, we'll notify you within 72 hours of becoming aware of it, as required under GDPR Article 33.

We don't sell your data. We don't share your raw wardrobe data with brand partners. The three situations in which your data leaves our platform are:

• Sub-processors: companies we use to run the technical infrastructure, listed by name in the next section. They process data on our behalf under strict contractual terms.
• Brand analytics (Tier 3 only): if you've opted into brand features, anonymized aggregate data about styling patterns may be shared with brand partners. This is never individual data. It always describes a group large enough that no single person can be picked out of it. You can opt out at any time.
• Legal obligations: if we receive a valid legal request from a law enforcement or government authority, we'll comply with the minimum we're required to disclose. Where the law permits, we'll notify you first.

We don't share your data for advertising, cross-context behavioral targeting, or any purpose outside the three listed above.

These are the companies that process your data as part of delivering The Perfect Add. Each operates under terms that require them to protect your data to at least the same standard we do.

All are US-based. Transfers from the EEA, UK, or Switzerland rely on Standard Contractual Clauses approved by the European Commission.

Providers we're integrating. A few services are built into the product but are not yet processing any of your data: Anthropic (conversational styling), FASHN (virtual try-on), Upstash (rate limiting), and fal.ai (image matting). We list them here so this page stays ahead of the product rather than behind it. When any of them starts processing your data, we'll move it into the table above and update this notice first.

We review this list at least annually, and any time the stack changes.

When you delete your account, we delete your personal data within 30 days. Anonymized aggregate data derived from your wardrobe activity is not deleted, because it can't be traced back to you.

Under GDPR, you have the following rights. We'll respond to any request within 30 days.

• Access. Ask us what personal data we hold about you and get a copy of it.
• Correction. Ask us to fix inaccurate or incomplete data.
• Deletion. Ask us to delete your data. We'll comply unless we have a legal obligation to keep it.
• Portability. Ask for your data in a structured, machine-readable format so you can take it elsewhere.
• Restriction. Ask us to pause processing your data while a dispute is resolved.
• Objection. Object to processing based on legitimate interest. We'll stop unless we have compelling grounds.
• Withdraw consent. Pull back any consent you've given at any time. This won't affect anything we did before you withdrew it.
• Complaint. Lodge a complaint with your local data protection authority if you think we've mishandled your data.

To exercise any of these rights, email privacy@theperfectadd.com. We don't charge for requests and we don't require you to explain why you're making one.

California residents. The CPRA gives you additional rights: the right to correct inaccurate personal information, the right to limit use of sensitive personal information, and the right to opt out of the sale or sharing of personal information. We don't sell or share your personal information.

The Perfect Add is based in the United States, and our sub-processors are also US-based. If you're in the EEA, UK, or Switzerland, your data transfers to the US when you use our service.

We handle these transfers using Standard Contractual Clauses approved by the European Commission (EU SCC 2021/914, Module 2 where we are the controller and the sub-processor is the processor). These contractual protections apply to each of our sub-processors.

For UK users, we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses. For Swiss users, we apply the SCCs with modifications per the Swiss Federal Data Protection and Information Commissioner's requirements.

The Perfect Add is for adults. We don't knowingly collect data from anyone under 18. If you believe a minor has created an account, write to us at privacy@theperfectadd.com and we'll delete the account promptly.

We'll update this notice when our practices change materially. If we make a significant change — adding a new data type, bringing on a new sub-processor, or changing how we use your data — we'll notify you by email before the change takes effect.

The effective date at the top of this page always reflects when the current version took effect. Prior versions are available on request.

The Perfect Add, Inc.

privacy@theperfectadd.com

We respond to all privacy enquiries within 5 business days and to formal data subject requests within 30 days.

If you're not satisfied with our response, you have the right to lodge a complaint with your local supervisory authority. In the EU, that's the data protection authority in your member state. In the UK, it's the Information Commissioner's Office (ico.org.uk). In the US, rights vary by state.