Draft for legal review. This document was written by the FASHIONDEALS team and has not yet been reviewed by external counsel. Items in [[brackets]] are to be completed by the company before launch.
Who we are
The controller of your personal data is [[Company legal name]], [[registered address]]. Contact for privacy matters: [email protected]. [[Data protection officer or EU/UK representative, if required]]
What we collect and why
We keep this to what the service needs.
| Data | Why | Basis |
|---|---|---|
| Technical data: IP address, browser, device, pages requested (processed by our hosting provider) | Deliver the site, keep it secure, prevent abuse | Legitimate interests |
| Approximate country from your connection | Suggest country and currency; not stored with your profile | Legitimate interests |
| Messages you send: name, email, country, message, consent, a hashed form of your IP and browser information | Reply to you; limit spam and abuse | Consent; legitimate interests |
| Newsletter: email, language, country, time and wording of consent | Send the newsletter and prove consent | Consent |
| Account (optional): email, name, password hash or passkey, saved items, lists, price alerts, fit profile, optional avatar, session information | Provide your account | Contract |
| Try-on: photos and body measurements | Estimate size and show pieces on you. Processed on your device; not stored on our servers | Consent |
| Analytics (only if you opt in): cookieless visit statistics | Improve the service | Consent |
We do not collect card details. Purchases happen on the store’s own site.
Photos, body scan and biometric-style data
The scan estimates body proportions from images. This runs in your browser on your device. We do not store your photos or measurements on our servers. If you choose the optional photoreal render, your photo and the garment image are sent to our rendering provider ([[rendering provider name and status]]) only for that request. We ask before sending and we do not use your photos to train models. Delete local data any time from your account or by clearing browser storage.
Who we share data with
We use service providers (processors) under contract or standard terms:
- Cloudflare, for hosting, content delivery, security, our database and, if you opt in, Web Analytics.
- Public content delivery networks (for example jsDelivr and Hugging Face) that deliver the open-source libraries and models used by the on-device AI. They can see your IP address when they serve files.
- Google Fonts for some non-Latin typefaces.
- Our rendering provider, only if you choose the photoreal render.
- Email provider, when we send account or newsletter emails ([[email provider name]]).
When you click through to a store, that store and its affiliate network receive your visit and their own privacy policy applies. We do not sell personal data and do not use it for cross-context behavioural advertising.
International transfers
Our providers may process data outside your country, including the United States. Where required we rely on adequacy decisions, standard contractual clauses or equivalent safeguards.
How long we keep data
Contact messages: until your request is handled and no longer needed, then deleted ([[retention period]]). Newsletter: until you unsubscribe. Account data: until you delete your account. Local data on your device: until you clear it.
Your rights
Depending on where you live (for example under the GDPR, UK GDPR or CCPA/CPRA) you may ask to access, correct, delete, restrict or receive a copy of your data, object to processing, withdraw consent at any time, and complain to your data protection authority. Email [email protected]; we reply within the time the law requires.
California residents: we do not sell or share personal information as those terms are defined in the CCPA/CPRA. We honour the Global Privacy Control signal as an opt-out of analytics and affiliate/marketing tagging.
Security
Traffic is encrypted with HTTPS. Passwords are stored as salted hashes and session cookies are HttpOnly. No system is perfectly secure; report a vulnerability to [email protected] (see also security.txt).
Children
FASHIONDEALS is not directed at children under 16 and we do not knowingly collect their data. Kids’ fashion is shown for parents and guardians.
Changes and contact
We will update this page and its date when practices change. Questions: [email protected]. See also the cookie policy.
Last updated October 27, 2026.