1. Controller
The controller of your personal data is [NAZWA FIRMY / IMIĘ I NAZWISKO PRZEDSIĘBIORCY], [ULICA I NUMER, KOD POCZTOWY, MIEJSCOWOŚĆ, POLSKA], Tax ID (NIP) [NIP] (we). For anything relating to your personal data, email us at [kontakt@lookella.com].
2. What data we process and why
Account – email address, first name and password. We store passwords only as a secure hash (scrypt). Purpose: creating and running your Account. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
Style profile – preferred cuts, height, body shape, favourite styles and anything you avoid. Purpose: tailoring advice to you. Providing these details is optional. Legal basis: performance of a contract.
Photos and results – outfit and clothing photos, clothing descriptions, chosen occasions, weather, notes, ratings, looks and saved outfits. Purpose: providing the Service. Legal basis: performance of a contract.
Technical data – IP address, date and time of requests, browser type, server logs. Purpose: keeping the Service secure, preventing abuse (for example login attempt limits) and fixing errors. Legal basis: our legitimate interests (Art. 6(1)(f) GDPR).
Location (optional) – only if you click "Get weather for my location" and allow it in your browser. Your browser sends approximate coordinates (rounded to about 1 km) directly to the Open-Meteo weather service. We do not store your location.
Running the Service – people who administer the Service on our behalf can see, in the admin panel, your Account data (email, first name, language, style profile, sign-up and last-activity dates), how many items you have saved and AI usage statistics (number of requests and tokens used). They cannot see your photos or the content of your analyses. Purpose: running the Service, handling support requests, security and preventing abuse. Legal basis: performance of the contract and our legitimate interest (Art. 6(1)(b) and (f) GDPR). Every access to a specific Account's data is recorded in an audit log.
3. Photos
When a photo is saved we strip its metadata, including GPS coordinates and camera data. Only you can see your photos – we do not publish them or share them with other Users. Only upload photos of other people if they have agreed.
4. Analysis by artificial intelligence
To rate an outfit, recognise a clothing item, build looks or translate a result, we send the photo and the necessary profile, wardrobe and context details to the Claude model provided by Anthropic. For Users in the European Economic Area, our contracting party is Anthropic Ireland, Limited, acting as our processor.
Under Anthropic's commercial terms, data sent through the API is not used to train AI models. Anthropic keeps it for a limited period in line with its data retention policy. Data may also be processed in the United States. Such transfers rely on the safeguards provided for in the GDPR (standard contractual clauses or a European Commission adequacy decision), as set out in Anthropic's data processing addendum.
Analysis results are recommendations. We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you (Art. 22 GDPR).
5. Who receives your data
Your data may be received only by companies that help us provide the Service, under data processing agreements:
- server provider: [NAZWA DOSTAWCY SERWERA VPS, KRAJ CENTRUM DANYCH];
- email provider (password reset emails): [NAZWA DOSTAWCY POCZTY TRANSAKCYJNEJ];
- Anthropic – AI model provider (section 4).
We do not sell your data. When you click a shop link under "Recommended products", you go to the shop's website, which processes data under its own privacy policy. The link may contain an affiliate tag, but it does not include your personal data.
6. How long we keep data
- Account, profile, photos and results – until you delete them or delete your Account; they are removed from backups within 14 days;
- photos uploaded but not saved in the Service – up to 24 hours;
- login session – up to 30 days or until you log out;
- password reset link – 1 hour;
- server logs – up to 30 days.
7. Cookies and browser storage
We use only strictly necessary cookies:
- lk_sess – keeps you logged in (up to 30 days);
- lk_lang – remembers your chosen language (12 months).
We also store your chosen language in your browser's local storage. We do not use analytics or advertising cookies. Fonts are loaded from our own server, not from third parties.
8. Your rights
You have the right to:
- access your data and receive a copy;
- have your data corrected;
- have your data erased;
- restrict processing;
- data portability – under Profile you can download your data as a JSON file;
- object to processing based on our legitimate interests;
- withdraw consent at any time, without affecting the lawfulness of earlier processing.
You can exercise most of these rights yourself under Profile. For anything else, email [kontakt@lookella.com]. You also have the right to lodge a complaint with a data protection authority – in Poland, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl) – or with the authority in your country of residence.
9. Optional data and age
Your email address, first name and password are required to create an Account. Everything else is optional, but without photos the Service cannot prepare analyses. The Service is intended for people aged 16 or over.
10. Security
We use encrypted connections (HTTPS), password hashing, secure cookies, CSRF protection and login attempt limits. Only the Account owner can access their photos. The admin panel is protected by a password and a one-time code (2FA), and every administrator action is logged.
11. Changes to this policy
If we change this policy we will publish the new version in the Service and inform you of significant changes by email.