Privacy Policy

1. Controller

The controller responsible for data processing on poseur.ai (the "Site") and our AI-powered personal styling service (the "Service") within the meaning of the EU General Data Protection Regulation (GDPR) is:

Ali Poursotoudeh Tehrani, poseur.ai, Burgfriedenstraße 15, 60489 Frankfurt am Main, Germany — team@poseur.ai

2. Hosting & Server Logs

The Site is hosted on Google Cloud (Cloud Run, Cloud SQL) in the Frankfurt am Main region, Germany (europe-west3). Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We have concluded a data processing agreement with Google.

When you visit the Site, technical access data (IP address, date and time, requested page, browser type) is processed in server logs to deliver the Site securely and to diagnose faults (Art. 6(1)(f) GDPR). Log data is deleted automatically after a short period. Google may transfer data to Google LLC in the USA; such transfers are safeguarded by the EU–US Data Privacy Framework and EU standard contractual clauses.

3. Cookies & Local Storage

We use strictly necessary cookies and browser storage without consent because the Service cannot work without them (§ 25 (2) of the German TDDDG).

We set one optional cookie only if you choose “Accept all” in the cookie notice (§ 25 (1) TDDDG, Art. 6(1)(a) GDPR): poseur_utm remembers for 30 days which link first brought you to us — the channel, medium and campaign from the link (e.g. “pinterest”) or the referring website. If you sign up within that time, we store this information with your account to understand which channels lead to sign-ups. We do not track you across other websites and use no third-party advertising or analytics services.

You can withdraw your consent at any time via “Change cookie settings” at the end of this page; the cookie is then deleted. Withdrawal does not affect the lawfulness of processing carried out before it.

• locale — remembers your language choice (cookie, 12 months)
• Sign-in cookies (Auth.js) — keep you logged in and protect against cross-site request forgery; deleted at the latest when your session expires
• poseur_guest — remembers that you are using Poseur as a guest so your conversation is kept (necessary, cookie, 30 days)
• poseur_consent — remembers your cookie choice (necessary, cookie, 12 months)
• poseur_utm — origin of your first visit (optional, only with consent, cookie, 30 days)
• Sidebar state — remembers whether the app sidebar is collapsed (browser local storage)

4. Registration & Sign-in

When you create an account, we process your email address and password (Art. 6(1)(b) GDPR). Your password is stored only as a salted hash (bcrypt) — we cannot read it. We send you a verification email to confirm your address.

You can also sign in with Google. In that case, Google Ireland Limited transmits your email address to us and processes your sign-in data under its own privacy policy (https://policies.google.com/privacy).

If you accepted the optional cookies, we also store which link brought you to us when you sign up (see section 3; Art. 6(1)(a) GDPR). It stays with your account until you delete it; on request we delete it earlier at any time.

You can also try Poseur without an account. We then store a random guest identifier (cookie poseur_guest), your answers from the short onboarding (who we style for, budget, optionally sizes) and filters you save, your conversations with the stylist and how many messages you sent. To prevent abuse we also count guest messages per network and day under a hash of your IP address (not the address itself); these counters are deleted after two days (Art. 6(1)(f) GDPR). Guest data without an account is deleted after 30 days of inactivity; if you sign up, we move your guest conversations into your account (Art. 6(1)(b) GDPR). Photos you attach as a guest are kept in a private storage area tied only to your guest identifier and are deleted together with the other guest data; voice messages are only converted to text and not stored.

If you leave Poseur as a guest, we ask you once for feedback. Rating, reasons and comment are stored without any link to your guest identifier; answering is voluntary (Art. 6(1)(f) GDPR).

5. Style Profile & AI Recommendations

To generate styling recommendations, we process the profile data you provide — for example how you like to dress, clothing and shoe sizes, fit preferences, occasions, budget, and a free-text style description — together with your chat messages (Art. 6(1)(b) GDPR).

Your chat messages and profile are processed by our own backend on Google Cloud in Frankfurt (europe-west3) and passed to Google's Gemini models via the Vertex AI API, processed within the EU, to generate outfit and product recommendations. Google acts as our processor; under the Google Cloud terms, this data is not used to train Google's models. We do not use your data for advertising and we do not sell it.

6. Photos You Attach

You can attach photos to a chat message — for example an outfit you like or a piece you own. We use them only to answer that request and later messages in the same conversation (Art. 6(1)(b) GDPR): the photo is passed to Google's Gemini models via the Vertex AI API (processed within the EU) as part of your message.

Before upload, your device downscales the photo and removes its metadata, including any location data. The photo is stored in a private Google Cloud Storage bucket in Frankfurt (europe-west3), is visible only to you, and is kept until you ask us to delete it (team@poseur.ai). Under the Google Cloud terms, it is not used to train Google's models.

Please only attach photos you are entitled to share, and avoid photos of other people or photos showing sensitive information.

7. Transactional Emails

Verification and password-reset emails are delivered via Resend (Resend, Inc., USA). For this purpose, Resend processes your email address and the message content as our processor (Art. 6(1)(b) GDPR). Transfers to the USA are safeguarded by EU standard contractual clauses.

8. Product Images & Retailer Links

Product images are normally served through our own image proxy, so retailers do not see your IP address. In rare fallback cases, your browser may load an image directly from a retailer's content delivery network (e.g. Zalando or Farfetch); the retailer then receives your IP address as with any image request (Art. 6(1)(f) GDPR — reliable product display).

Product recommendations link to third-party retailer websites. Once you follow such a link, the retailer's own privacy policy applies. We currently use no affiliate tracking.

9. Contact Requests

If you contact us — for example via the contact form on the Site or by email — we process your email address and your message to handle your request (Art. 6(1)(b) and (f) GDPR).

10. Data Retention

We store account and profile data until you delete your account or ask us to delete it. Server logs are deleted after a short period. You can request deletion at any time at team@poseur.ai. Photos you attach in the chat are kept until you ask us to delete them.

11. Your Rights

You have the following rights regarding your personal data:

• Access to the data we hold about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR)
• Withdrawal of any consent, with effect for the future

To exercise any of these rights, email us at team@poseur.ai. You also have the right to lodge a complaint with a data protection supervisory authority; the authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (HBDI), Wiesbaden, Germany.

12. Security

We implement appropriate technical and organizational measures to protect your personal data. However, no method of transmission over the Internet is completely secure, and we cannot guarantee absolute security.

13. Changes to This Policy

We may update this Privacy Policy when the Service or the legal situation changes. The current version is always available on this page; the date of the last update is shown at the top.