Version 1.0 · Effective: October 11, 2026.
This policy explains how Space Made Code LLC handles personal data when you use Stylium: the Stylium Wardrobe app (wardrobe.stylium.app), the website stylium.app, our sign-in pages (accounts.stylium.app) and, when released, the Stylium mobile apps.
1. Who we are
1.1 Controller: Space Made Code LLC ("SMC", "we"), a Delaware (United States) limited liability company. Stylium is an SMC product, not a separate company.
1.2 Registered agent: Harvard Business Services, Inc., 16192 Coastal Highway, Lewes, Delaware 19958, United States. Business address: [BUSINESS ADDRESS].
1.3 Privacy contact: legal@spacemadecode.com.
1.4 EU representative (GDPR Art. 27): [NAME, ADDRESS, EMAIL]. UK representative: [NAME, ADDRESS, EMAIL]. Türkiye data controller representative (KVKK): [NAME, ADDRESS, EMAIL]; VERBİS registration: [NUMBER].
1.5 Users in Türkiye should also read our KVKK Information Notice.
2. What we collect, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR / KVKK) | Retention |
|---|---|---|---|
| Account: name, email, sign-in identifiers, profile picture if provided by your sign-in method | Create and secure your account | Contract (Art. 6(1)(b) GDPR; KVKK Art. 5(2)(c)) | Until account deletion |
| Wardrobe content: clothing photos; type, colour, pattern, fabric, season, formality, names; wardrobe groups; wear history | Provide the digital wardrobe | Contract | Until you remove it or delete your account |
| Outfits and planning: outfits, plans, trips, events, saved looks, style preferences, notes | Outfit suggestions and planning | Contract | Until removed or account deletion |
| Location: a city with its region and country; your browser location only if you allow it, used once to find the nearest city and not stored | Weather-aware styling | Contract; consent for browser location | City: until account deletion; precise position: not stored |
| Time zone (from your browser) | Show dates and plans correctly | Legitimate interest (Art. 6(1)(f)); KVKK Art. 5(2)(f) | Cookie: 1 year |
| AI processing of photos and wardrobe attributes (see section 3) | AI tagging and AI styling | Explicit consent (Art. 6(1)(a); KVKK Art. 5(1)) | See section 3 |
| Upload safety check (see section 3) | Block nudity and protect users and the Service | Legitimate interest and legal obligation; [counsel to confirm basis under KVKK] | Check record: 24 hours |
| Subscription and billing (web): plan, status, billing period, amounts, taxes, billing address and country, tax ID if you give one, invoice records. Card details are handled by Stripe; we never see your full card number | Sell and bill subscriptions, calculate tax, keep accounting records | Contract; legal obligation (Art. 6(1)(c); KVKK Art. 5(2)(ç)) | 10 years after the transaction year |
| Subscription (App Store / Google Play): transaction and subscription identifiers and status | Give you plan access | Contract | Until account deletion, then anonymised reconciliation records |
| AI usage records: time, feature, model, token counts, status (no photos, prompts or outputs) | Cost control, abuse prevention, reliability | Legitimate interest | 90 days |
| Consent records: AI consent version, date, accept/withdraw | Prove and respect your choice | Legal obligation; legitimate interest | Until account deletion [counsel: consider retaining proof for 3 years] |
| Security and technical data: IP address, device and browser data, request logs, rate-limit counters | Keep the Service secure and working | Legitimate interest | Logs: per hosting provider (typically up to 30 days); rate-limit counters: 24 hours |
| Communications: messages to our support addresses or contact form | Answer you | Legitimate interest; contract | 24 months after the conversation ends |
| Waitlist and marketing: email (and name, if given) | Launch invitations and, with consent, product news | Consent (Art. 6(1)(a); in Türkiye, Law No. 6563) | Until you unsubscribe; proof of consent 3 years after withdrawal |
We do not knowingly collect special categories of data (such as health, religion or biometric data). Photos may unintentionally show a person; we do not use photos to identify anyone. Please photograph clothing on its own.
3. AI processing
3.1 Wardrobe app (Anthropic). With your consent, we send Anthropic PBC only what a task needs:
- AI tagging: a reduced copy of the photo, without location or camera metadata.
- AI styling: the type, colour, fabric, fit, season and formality of your pieces, your city's weather and any note you type (up to 200 characters). We do not send your name, email, piece names or (for styling) photos.
3.2 Mandatory safety check. Every uploaded photo is checked for nudity by the same provider before it is saved, whether or not you have given AI consent. This protects users and is a condition of using uploads.
3.3 Retention by providers. Anthropic deletes API inputs and outputs within 30 days, except content flagged by its safety systems as violating its usage policies, which it may keep for up to 2 years. Anthropic does not use this data to train its models.
3.5 No automated decisions with legal effect. AI suggestions do not produce legal or similarly significant effects on you.
3.6 You can withdraw AI consent at any time in Settings → Privacy. Withdrawal does not affect processing already carried out.
4. Who receives your data
We share personal data only with providers that help us run Stylium (processors), under contracts that limit their use of it:
| Provider | Role | Data | Location |
|---|---|---|---|
| Clerk, Inc. | Sign-in and account management | Account data, sign-in events | United States |
| Supabase, Inc. | Database and file storage | All app data and photos | Ireland (EU), AWS eu-west-1 |
| Vercel, Inc. | Hosting and delivery | Request data, logs | United States and global edge |
| Anthropic PBC | AI tagging, styling, safety check | See section 3 | United States and other regions |
| Stripe, Inc. / Stripe Payments Europe | Web payments, tax calculation, invoices | Billing data | United States / EU |
| Resend, Inc. | Waitlist and contact emails | Email address, name, message | United States |
| Cloudflare, Inc. | Bot protection on forms (Turnstile) | Browser and device signals, IP | Global |
| Open-Meteo | Weather forecasts | City coordinates only (no personal data) | EU [confirm] |
Apple and Google act as independent controllers for purchases made through their stores. We may also disclose data when required by law, to protect rights and safety, or as part of a merger or sale of the business (with notice to you). We do not sell or share personal data for cross-context behavioural advertising.
5. International transfers
SMC is based in the United States and some providers process data outside your country. For transfers from the EU/EEA, UK and Switzerland we rely on the EU-U.S. Data Privacy Framework where the provider is certified, or on Standard Contractual Clauses (and the UK Addendum) with supplementary measures. For transfers from Türkiye we rely on the safeguards in KVKK Article 9, such as standard contracts notified to the Personal Data Protection Authority. [Counsel to confirm the mechanism for each provider; see the processor register in our DPA.]
6. How long we keep data
See the table in section 2 and our Data Retention and Deletion Policy. When you delete your account, we permanently delete your photos, wardrobe, outfits, plans, trips, saved looks, preferences, AI usage records and consent records, and anonymise your account record. Web billing records are kept for 10 years because tax law (including EU VAT rules) requires it. Deleted data disappears from backups within [BACKUP RETENTION, e.g. 7 days].
7. Your rights
Depending on where you live, you may have the right to access, correct, delete or export your data, to restrict or object to processing, to withdraw consent, and not to be subject to solely automated decisions. Residents of some US states (for example California) have similar rights, including the right to know and to delete, and the right not to be discriminated against for exercising them.
- In the app: export your data or delete your account in Settings → General → Your data; withdraw AI consent in Settings → Privacy.
- By email: legal@spacemadecode.com. See our User Rights Request Procedure.
- We reply within 30 days (KVKK: within 30 days; GDPR: within one month, extendable as the law allows).
- You can complain to your data protection authority, for example the authority in your EU country, the UK ICO, or Türkiye's Personal Data Protection Authority (KVKK).
8. Cookies
We use only cookies and similar storage that are needed for the Service to work, (for example your sign-in session and language choice). On the website, the language is chosen from the country our hosting provider reports for your request; your IP address is not sent to anyone else. Details are in our Cookie Policy.
9. Children
Stylium is not for children under 16. See our Children and Minimum Age Policy.
10. Security
Photos are stored in private storage and served only to their owner. Database access is limited to our servers and protected by row-level security. We do not log photo, prompt or AI output content. Connections are encrypted in transit. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.
11. Changes
We will update this policy when our practices or providers change and tell you about material changes before they apply. If the AI consent text changes, we will ask for your consent again.
12. Related documents
Terms of Use · Cookie Policy · AI Usage Policy · AI Consent Notice · Data Retention and Deletion Policy · KVKK Information Notice · Legal Notice