Privacy Policy

1. Controller

The controller responsible for data processing on poseur.ai (the "Site") and our AI-powered personal styling service (the "Service") within the meaning of the EU General Data Protection Regulation (GDPR) is:

Ali Poursotoudeh Tehrani, poseur.ai, Burgfriedenstraße 15, 60489 Frankfurt am Main, Germany — team@poseur.ai

2. Hosting & Server Logs

The Site is hosted on Google Cloud (Cloud Run, Cloud SQL) in the Frankfurt am Main region, Germany (europe-west3). Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We have concluded a data processing agreement with Google.

When you visit the Site, technical access data (IP address, date and time, requested page, browser type) is processed in server logs to deliver the Site securely and to diagnose faults (Art. 6(1)(f) GDPR). Log data is deleted automatically after a short period. Google may transfer data to Google LLC in the USA; such transfers are safeguarded by the EU–US Data Privacy Framework and EU standard contractual clauses.

3. Cookies & Local Storage

We only use cookies and browser storage that are strictly necessary to operate the Service (§ 25 (2) of the German TDDDG). They require no consent. We do not use any analytics, advertising, or tracking cookies.

• locale — remembers your language choice (cookie, 12 months)
• Sign-in cookies (Auth.js) — keep you logged in and protect against cross-site request forgery; deleted at the latest when your session expires
• poseur_cookie_consent — remembers that you dismissed the cookie notice (browser local storage)
• Sidebar state — remembers whether the app sidebar is collapsed (browser local storage)

4. Registration & Sign-in

When you create an account, we process your email address and password (Art. 6(1)(b) GDPR). Your password is stored only as a salted hash (bcrypt) — we cannot read it. We send you a verification email to confirm your address.

You can also sign in with Google. In that case, Google Ireland Limited transmits your email address to us and processes your sign-in data under its own privacy policy (https://policies.google.com/privacy).

5. Style Profile & AI Recommendations

To generate styling recommendations, we process the profile data you provide — for example how you like to dress, clothing and shoe sizes, fit preferences, occasions, budget, and a free-text style description — together with your chat messages (Art. 6(1)(b) GDPR).

Your chat messages and profile are processed by our own backend on Google Cloud in Frankfurt (europe-west3) and passed to Google's Gemini models via the Vertex AI API to generate outfit and product recommendations. Google acts as our processor; under the Google Cloud terms, this data is not used to train Google's models. We do not use your data for advertising and we do not sell it.

6. Transactional Emails

Verification and password-reset emails are delivered via Resend (Resend, Inc., USA). For this purpose, Resend processes your email address and the message content as our processor (Art. 6(1)(b) GDPR). Transfers to the USA are safeguarded by EU standard contractual clauses.

7. Product Images & Retailer Links

Product images are normally served through our own image proxy, so retailers do not see your IP address. In rare fallback cases, your browser may load an image directly from a retailer's content delivery network (e.g. Zalando or Farfetch); the retailer then receives your IP address as with any image request (Art. 6(1)(f) GDPR — reliable product display).

Product recommendations link to third-party retailer websites. Once you follow such a link, the retailer's own privacy policy applies. We currently use no affiliate tracking.

8. Contact Requests

If you contact us — for example via the contact form on the Site or by email — we process your email address and your message to handle your request (Art. 6(1)(b) and (f) GDPR).

9. Data Retention

We store account and profile data until you delete your account or ask us to delete it. Server logs are deleted after a short period. You can request deletion at any time at team@poseur.ai.

10. Your Rights

You have the following rights regarding your personal data:

• Access to the data we hold about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR)
• Withdrawal of any consent, with effect for the future

To exercise any of these rights, email us at team@poseur.ai. You also have the right to lodge a complaint with a data protection supervisory authority; the authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (HBDI), Wiesbaden, Germany.

11. Security

We implement appropriate technical and organizational measures to protect your personal data. However, no method of transmission over the Internet is completely secure, and we cannot guarantee absolute security.

12. Changes to This Policy

We may update this Privacy Policy when the Service or the legal situation changes. The current version is always available on this page; the date of the last update is shown at the top.