Privacy Policy

1. Introduction

This Privacy Policy describes how Bumin Studios ("we," "us," or "our") collects, uses, stores, discloses, and protects information when you use the LuxStyle AI mobile application (the "App") and the luxstyleai.com website (together, the "Service").

This Privacy Policy is intended to comply with applicable privacy laws and platform requirements, including the GDPR/UK GDPR, Turkish KVKK, CCPA/CPRA, CalOPPA, COPPA, and the Apple App Store and Google Play policies.

Website: luxstyleai.com  ·  Contact: support@luxstyleai.com

3. Information We Collect

3.1 Information You Provide Directly

• Account information: email address, username, authentication tokens, and related account identifiers.
• User content (photos/media): photos and images you upload to use virtual try-on and AI generation features.
• Purchase-related information: data associated with subscriptions and in-app purchases (purchase status, subscription tier, transaction identifiers, receipt validation data). Payment card details are processed by the app marketplace and are not stored by us.
• Communications: information you provide when contacting support.

3.2 Information Collected Automatically

• Device information: device model, operating system version, language, time zone, app version, and network information.
• Usage and analytics data: feature usage, session duration, screens viewed, crash logs, performance and diagnostic data.

3.3 Information from Third Parties

• Subscription status, purchase confirmations, and related transaction metadata provided by the Apple App Store / Google Play.

3.4 Website Waitlist (Early Access)

When you fill in the early access form on luxstyleai.com, Bumin Studios, as data controller, processes your first name, last name and email address.

• Purpose: to notify you when the app launches and to send you your early access invitation and announcements about the early access program. We do not sell this information and we do not share it with third parties for advertising.
• Method and legal basis: collected electronically through the web form so that we can provide the early access and launch notification you requested (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
• Storage and transfers: stored on the server of our website hosting provider (acting as our processor) in Türkiye, in an area that is not accessible from the web. So that we can manage the list, entries are also transferred to our account on Google LLC's Google Sheets and Gmail services (as a spreadsheet row and a sign-up notification email); Google's servers may be located outside Türkiye (see Section 15). Otherwise it may be disclosed only to competent public authorities where required by law. It is deleted once the early access program is complete and no later than 12 months after the app launches.
• Security processing: to protect the form against spam and automated sign-ups, your IP address is kept for at most 24 hours in an irreversibly hashed form (GDPR Art. 6(1)(f), legitimate interests; KVKK Art. 5(2)(f)).
• Your rights: you can ask us to delete your entry at any time by writing to support@luxstyleai.com, and exercise your other rights described in Section 11.

4. How We Use Information

• Provide and operate the Service: create and manage accounts, enable core functionality, and deliver AI-generated results.
• Process AI generation requests: transmit your uploaded photos to the Google Gemini API solely to generate the output you requested.
• Manage subscriptions and purchases, validate receipts, and prevent fraud.
• Analytics and improvement: understand usage, debug issues, and improve performance.
• Security and integrity: detect and prevent abuse, unauthorized access, and policy violations.
• Provide customer support and comply with legal obligations.

5. Legal Bases for Processing (GDPR / KVKK)

• Performance of a contract: to provide the Service, account functionality, and subscriptions.
• Explicit consent: for transmitting your uploaded photos to the Google Gemini API for AI generation.
• Legitimate interests: to maintain the Service, ensure security, and prevent abuse.
• Legal obligation: to comply with applicable laws and lawful requests.

Explicit consent for photo processing: By uploading photos for virtual try-on or AI scene generation, you provide explicit consent for your images to be transmitted to the Google Gemini API solely to generate the output you requested. You may withdraw consent by discontinuing use of the feature; withdrawal does not affect processing already performed.

6. Your Photos

6.1 How Photos Are Processed

• When you upload photos, the Service transmits those images to the Google Gemini API to generate virtual try-on and AI scene results.
• Our infrastructure operates on Google Cloud.

6.2 Where Your Generated Images Are Stored (Cloud Gallery)

Images you generate are stored in your personal cloud gallery so they remain available when you sign in from another device or reinstall the app. Specifically:

• Generated images are stored in Google Firebase Storage, and their metadata in Google Firestore, under a private location tied to your account.
• Your gallery is private to your account. It is not public, and other users cannot access it.
• Images remain stored until you delete them from your gallery or delete your account. Deleting your account removes your gallery.
• You can delete any individual image from within the app at any time.

6.3 We Do Not Train Our Own Models

We do not use your photos or other user media to train our own machine learning models. We use your uploaded photos only to provide the AI generation you requested and related Service functionality.

6.4 Your Responsibilities for Uploaded Content

You represent that you have the right to upload and process the photos you submit, including any necessary permissions from individuals appearing in the images. Please avoid uploading sensitive personal data unless necessary for your intended use of the Service.

7. Data Sharing and Disclosure

• Service providers and processors: vendors that help us operate the Service (hosting, analytics, subscription management, AI processing). They process data on our behalf under contractual obligations.
• Legal and safety: to comply with law, respond to lawful requests, and protect rights and safety.
• Business transfers: in connection with a merger, acquisition, reorganization, or sale of assets, subject to appropriate safeguards.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We do not disclose your photos or generated images to advertisers or data brokers.

8. Third-Party Services

8.1 Firebase (Google)

Purpose: authentication, database, storage, analytics, performance monitoring, and crash reporting. Data processed: device identifiers, app instance identifiers, usage events, diagnostics, plus your account data and cloud gallery.

8.2 Adapty

Purpose: subscription and in-app purchase management, entitlement validation, paywall analytics. Data processed: purchase and subscription events, transaction metadata, device/app identifiers.

8.3 Google Cloud

Purpose: hosting, storage, and infrastructure operations. Data processed: account data, uploaded media (as needed for processing), logs, and operational telemetry.

8.4 Google Gemini API

Purpose: third-party AI processing for virtual try-on and AI scene generation. Data processed: your uploaded photos and the prompts/parameters needed to generate the requested output. By uploading photos, you provide explicit consent for transmission of your images to Gemini solely for AI generation. We do not use your media to train our own models.

9. Cookies and Tracking Technologies

We do not use cookies, pixels, or SDKs for advertising, ad targeting, or cross-app tracking. The technologies we use serve only to operate the Service, maintain sessions, remember preferences, measure performance, and enhance security.

Do Not Track: Because there is no uniform standard for interpreting browser "Do Not Track" signals, we do not respond to them in a standardized way. We do not perform cross-site tracking in any case.

10. Data Retention

• Account data: retained while your account is active and thereafter as needed for legitimate business purposes and legal compliance.
• Photos you upload: retained only as long as needed to generate the requested output.
• Images you generate: stored in your private cloud gallery (see 6.2) until you delete them or delete your account.
• Analytics and diagnostics: retained for a period appropriate to measure performance and maintain security, then deleted or anonymized.
• Purchase records: retained as necessary for entitlement management, accounting, and legal compliance.

11. Your Rights

Under the GDPR (EEA/UK/Switzerland) and KVKK (Türkiye): you have the rights of access, rectification, erasure, restriction of processing, data portability, and objection to processing. You also have the right to lodge a complaint with your local data protection authority. Under KVKK Art. 11 you may also ask whether your data is processed and for what purpose, learn the third parties it is transferred to in Türkiye or abroad, ask that corrections and deletions be notified to those third parties, object to a result against you arising solely from automated analysis, and claim compensation for damage caused by unlawful processing.

Under the CCPA/CPRA (California): you have the right to know, the right to delete, and the right to non-discrimination. Because we do not sell personal information and do not share it for cross-context behavioral advertising, there is no opt-out to provide. If this ever changes, we will update this Privacy Policy and provide a compliant opt-out mechanism before doing so.

To exercise your rights: email support@luxstyleai.com. We may request additional information to verify your identity.

12. Deleting Your Account and Data

You can delete your account directly in the app (Profile → Settings → Delete Account). Account deletion removes your account record, your cloud gallery, and associated user data. Alternatively, you may request deletion by emailing support@luxstyleai.com.

13. Children's Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided personal information, contact us at support@luxstyleai.com and we will take steps to delete it.

14. Data Security

We use industry-standard measures to protect your personal information, including encryption in transit (HTTPS/TLS), encryption at rest for app data on Google infrastructure, authenticated access, and server-side authorization rules. Website waitlist entries are kept in a folder that is not accessible from the web and can only be accessed by the account owner. Please note that no system is 100% secure.

15. International Data Transfers

Your information may be processed and stored on servers located outside your country of residence, notably on Google Cloud infrastructure. Where required, appropriate safeguards are applied to such transfers.

16. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the Effective Date above. If changes are material, we may provide additional notice within the app or by other appropriate means.

17. Contact

If you have questions about this Privacy Policy or your data, contact us:

Email: support@luxstyleai.com

Data controller: Bumin Studios