Chulair · Legal

Privacy Policy

Last updated: 17 August 2026

In accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD). If you access the Service from outside the European Economic Area, please also read sections 12 and 13.

1. Data controller

2. Personal data we process

We collect and process the following categories of personal data:

• Account data: name and email address, provided by the identity provider you sign up with — Google (Google OAuth) or Apple (Sign in with Apple; if you choose "Hide My Email", we receive the relay address Apple assigns to you) — together with the technical identifier of your account at that provider. If you link both providers from Settings, we store the association between the two identities so that either one opens the same account.
• Look photographs and videos (clothing): images of fashion outfits or garments uploaded voluntarily by the user and, if you choose to, short videos of your own, of which we keep a segment of up to 15 seconds and one frame that serves as the look's image.
• User photographs (selfies): images of the user's body uploaded voluntarily to use the virtual try-on feature. These images may be considered biometric data for the purposes of the GDPR and are processed with special diligence.
• Virtual try-on results: synthetic images generated by AI by combining the user's photograph with selected garments.
• Social activity data: your public username, profile photo, biography, social links and shop link, the looks or try-on results you choose to publish to the showroom (including, where applicable, their videos), your comments, mentions (including other users' posts whose description tags you), likes, saves, follow relationships, the users you block and, if you arrived through another user's invitation, who invited you and how many people you have invited. Published content and your public profile are visible to other users and to visitors without an account. When you share a post or your showroom from the app, the link includes your public username so that the visits it brings can be attributed to you.
• Garment metadata: descriptive tags (type, color, name) generated automatically from look photographs using artificial intelligence.
• "Your look for today" and approximate location: to suggest an outfit from your own garments every day according to the season, temperature and rain forecast where you live, we process your country (the one you choose or the one derived from your IP address) and an approximate location: the city and time zone estimated from your IP address when you sign in (accurate to tens of kilometers) and, only if you share your location from the browser in Settings, coordinates that we round to about 11 km before storing them. We never keep your exact location. We also store each daily suggestion (garments, reasoning, weather report used and the time you want to receive it) as a history you can browse in the app. The feature is on by default and you can turn it off in Settings; withdrawing the location permission deletes the stored city, time zone and coordinates.
• Notifications: if you enable notifications, we store your browser's push subscription (its endpoint and the encryption keys generated by the browser itself) or your iOS device token, in order to deliver alerts such as likes, comments, your look being ready, the look of the day or service announcements. This data is per device and is deleted when you disable notifications or when the notification service tells us the subscription no longer exists.
• Technical access data: IP address and access timestamps, retained for service security purposes, as well as generic categories of the device you browse with (device type, operating system and browser family and major version, whether you use the app or the web and an approximate measure of your connection speed), the country derived from your IP and the domain of the site you arrived from (never the specific page nor your search terms), linked to a session identifier and, if you are signed in, to your username, for usage statistics and to analyse navigation journeys within the service (legal basis: legitimate interest, Art. 6(1)(f) GDPR). You may object by writing to soporte@chulair.com.
• Advertising measurement data: the Google click identifier (gclid) and campaign parameters (UTM) when you arrive from a Google Ads advertisement, together with the fact that you have registered, in order to measure the effectiveness of our campaigns. In the EEA, the United Kingdom and Switzerland this data is only processed if you accept advertising cookies; in other regions this measurement is on by default and you may opt out at any time (see section 11 and the Cookie Policy).
• Country waiting list (including non-users): the email address voluntarily provided by visitors from countries where registration is not yet available, for the sole purpose of notifying them when the service opens in their country (legal basis: consent, Art. 6(1)(a) GDPR). You may request its deletion at any time.
• Abuse reports: the report category, the reported item, the description and, if you choose to provide it, your email address, processed to investigate and handle the report (including child-safety reports).
• Email communications log: type, recipient, subject, language and delivery result of the emails we send you (e.g. welcome, look ready or country-availability notices), for control, security and troubleshooting purposes.
• Store click history: when you open an external store link from the Stores screen, we record which store you opened, the market (country) of the store list shown to you, and the date, linked to your account. We use this history for internal usage statistics and to decide which stores and markets to work with (legal basis: legitimate interest, Art. 6(1)(f) GDPR). We do not share it with the stores, and it is deleted together with your account.
• Feature usage data: counters and records of the features you use (store searches, images created for sharing and their format, posts shared, invitations sent), linked to your account, in order to show you only the contextual tips you have not yet needed, your achievements, and internal usage statistics (legal basis: legitimate interest, Art. 6(1)(f) GDPR).
• Rejected upload photographs: if our automatic filter rejects a photo when uploading a look (for example, because no clothing can be seen in it), we keep a reduced copy for 30 days for the sole purpose of reviewing wrongful rejections and improving the filter (legal basis: legitimate interest, Art. 6(1)(f) GDPR). If the rejection is due to explicit content, the image is not kept. These copies are also deleted together with your account.
• Usage preferences: interface language, chosen country or store market, look-of-the-day time and feature preferences (e.g. animating your posts or receiving notifications), used to personalize the service.

3. Purposes and legal basis for processing

4. Recipients and data processors

Data is shared with the following service providers, who act as data processors in accordance with Art. 28 GDPR:

• Google LLC (USA): provider of authentication (Google OAuth 2.0), cloud storage (Google Cloud Storage), database (Google Cloud Firestore), automatic image moderation (Google Cloud Vision, which checks the photos you upload, what you publish and the frames of your videos) and artificial intelligence processing (Google Vertex AI / Gemini). User images and data are stored on servers located in the European Union (europe-southwest1 region, Madrid, Spain). AI processing may take place outside the EU: garment analysis and image generation (Gemini) and video generation (Veo) use Vertex AI's global endpoint, so images may be processed transiently on Google servers located outside the EU, and the virtual try-on model processes images temporarily in the USA (us-central1 region). These transfers are covered by the safeguards described in section 5 of this Policy; images are not stored outside the EU. Google (Firebase Cloud Messaging) also provides the push notification delivery service for Chrome-based browsers.
• Google Ireland Ltd. (Ireland): measurement of the effectiveness of our advertising campaigns through Google Ads. In the EEA, the United Kingdom and Switzerland, only if you give your consent to advertising cookies are the click identifier (gclid) and the registration event shared with Google to attribute the conversion to the originating campaign; without your consent, these cookies are not activated and this data is not shared. In other regions this measurement is on by default and you may opt out at any time. In all cases we apply your choice through Google's Consent Mode v2. Details in our Cookie Policy.
• Apple Inc. (USA): identity provider if you sign up with Sign in with Apple and, in the iOS app, delivery of notifications through the Apple Push Notification service (APNs), which receives the device token and the text of the alert.
• Your browser's notification service (Google, Apple or Mozilla, depending on the browser you use): delivers push alerts to your device. The content of the alert travels end-to-end encrypted between our server and your browser; the intermediary service cannot read it.
• ip-api.com: IP geolocation service. We send it only your IP address to determine the country you access from (service availability, stores for your market) and, when "Your look for today" is enabled, the city, time zone and approximate coordinates that we round before storing.
• Open-Meteo (open-meteo.com): weather forecast service. We send it only already-rounded coordinates (about 11 km accuracy) and the time zone, with no identifier of yours; a single query serves every user in the same area.
• IONOS SE (Germany): email provider through which we send you service messages (destination address and content of the email).

When you open an external store link from the Stores screen or from a public post, you leave Chulair: the store will process your data under its own policy. We do not send it any data of yours; some links include an affiliate identifier that only tells the store the visit came from Chulair.

We do not sell personal data. We do not carry out profiling or personalized advertising within the Service. The only disclosure for advertising purposes is the campaign measurement described above, which is governed by the consent or opt-out regime indicated and can be disabled at any time.

5. International data transfers

Google LLC and Apple Inc. are established in the USA. The transfer of personal data to these entities is based on the Standard Contractual Clauses approved by the European Commission (Implementing Decision 2021/914) and on their adherence to the EU-U.S. Data Privacy Framework, in accordance with the European Commission's Adequacy Decision of July 2023. With the other providers in section 4 only the minimum data indicated in each case is shared (an IP address, rounded coordinates) and, where they are established outside the EEA, the transfer is based on the Standard Contractual Clauses or on an adequacy decision.

Google does not use the data processed through its Vertex AI API to train its AI models, in accordance with its terms of service for enterprise customers.

6. Retention periods

Personal data is retained for as long as the user maintains an active account in the Service. When the user requests the deletion of specific content (looks, garments, selfies) or of their entire account, the corresponding data is deleted from our systems within a maximum of 30 days (storage recovery copies are purged within 7 days of deletion).

Technical access data (security logs) and the log of administrative access to private content (section 9) are retained for a maximum of 12 months, a reasonable period for the detection of and response to security incidents. Photographs rejected by the automatic filter are kept for 30 days. Notification subscriptions are deleted when you disable them. The approximate location is deleted when you withdraw the permission or turn off "Your look for today".

7. Rights of the data subject

Under the GDPR and the LOPDGDD, the user may exercise the following rights against the data controller at any time:

• Access: to obtain confirmation of whether their data is being processed and to access it.
• Rectification: to correct inaccurate or incomplete data.
• Erasure ("right to be forgotten"): to request the deletion of their data when it is no longer necessary for the purposes for which it was collected, or when they withdraw their consent.
• Restriction of processing: to request the suspension of processing in certain circumstances provided for by law.
• Portability: to receive their data in a structured, commonly used and machine-readable format, and to transmit it to another controller.
• Objection: to object to the processing of their data based on legitimate interest.
• Withdrawal of consent: where processing is based on consent, to withdraw it at any time without affecting the lawfulness of the processing carried out prior to withdrawal.

To exercise any of these rights, you may write to: soporte@chulair.com. In addition, from the app itself you can delete your account and all your data (Settings → Delete account), withdraw the location permission, disable notifications and unsubscribe from commercial communications.

You also have the right to lodge a complaint with the Spanish supervisory authority or, if you reside in another State of the European Economic Area, with the supervisory authority of your country of residence:

8. Processing of images using artificial intelligence

Photographs uploaded to the Service are sent to the Google Vertex AI API (Gemini model) for analysis. This processing has the following characteristics:

• Garment analysis: look images are processed to automatically identify, crop and tag the clothing present. This analysis uses Vertex AI's global endpoint: the processing is transient and may take place on Google servers located outside the EU. If you upload a video, frames are extracted from the chosen segment and the first one that passes moderation is analyzed as if it were a photograph.
• Automatic moderation: before accepting a photo or video, and before publishing any content to the showroom, Google Cloud Vision automatically checks that it shows clothing and does not contain explicit content or content inappropriate for a public space. No decision affecting you is based solely on this analysis: a rejection only prevents that specific image from being uploaded or published, and you can write to us if you believe it is wrong.
• Virtual try-on: the user's selfies are combined with garment images to generate a synthetic image that visualizes how the outfit would look. This processing is carried out with Google Vertex AI models (Gemini, global endpoint; or the virtual-try-on-001 model, which operates exclusively in the us-central1 region, USA); images are transferred temporarily and are not stored there once generation is complete.
• Look animation (optional): if you enable the "Animate my posts" preference, the image of the look or try-on result you publish is processed with Google's Veo model (global endpoint, with transient processing that may take place outside the EU) to generate a short video. This feature is optional and off by default.
• "Your look for today": the daily suggestion is produced by a Gemini text model from the tags of your garments (type, color and name), the season, the weather forecast and your preferences; your photographs are not sent to it. The suggestion is validated on our server before being shown to you.
• No model training: Google does not use this data to train or improve its AI models, in accordance with the Vertex AI terms of service.
• Storage: processed images are stored in Google Cloud Storage associated with the user's account. Private images (unpublished looks, selfies and try-on results) are accessible only by their owner and, exceptionally and always logged, by the data controller to handle reports, moderate and check the quality of the AI analysis (see section 9); content published to the showroom is publicly visible until it is unpublished or deleted (see section 2).

9. Security measures

We have adopted the technical and organizational measures necessary to ensure the security of personal data and to prevent its alteration, loss, unauthorized processing or access:

• Encrypted communications using TLS between the browser and the server.
• Data access protected by JWT token authentication with expiration.
• Storage in Google Cloud with service-account access controls.
• Private images are only accessible to the authenticated user to whom they belong. The data controller may access them solely to handle abuse reports, moderate the service or review how the automatic analysis is working; each such access is logged (who, what and when) and that log is kept for 12 months. Content published to the showroom is public until its author unpublishes or deletes it.
• The content of push notifications travels end-to-end encrypted to your browser.

10. Minors

The Service is exclusively for persons aged 18 or over and is not directed at minors. We do not knowingly collect personal data from anyone under 18 years of age.

If the controller becomes aware of having collected data from a minor, it will proceed to delete the account and its data immediately. (Without prejudice to Article 7 of the LOPDGDD, which sets 14 as the minimum age of digital consent in Spain, Chulair's contractual minimum age is 18.)

11. Use of cookies

The Service uses cookies and browser local storage (localStorage) of two types:

• Essential and preferences (no consent required): maintaining the authenticated user's session (JWT and refresh tokens), remembering your decision about cookies and your usage preferences (language, country, tips already seen, garments in the fitting tray), as well as our own aggregated audience measurement without personal data.
• Third-party advertising: Google Ads cookies to measure the effectiveness of our campaigns. In the EEA, the United Kingdom and Switzerland they are off by default and only activated if you accept them in the banner (opt-in); in other regions they are on by default and you may opt out at any time. In both cases we apply your choice through Google's Consent Mode v2.

The full details of the cookies, their purpose and duration, as well as how to manage them, are in our Cookie Policy.

12. Your California Privacy Rights (CCPA/CPRA)

This section applies to residents of California and supplements the rest of this Policy. It is provided under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA).

Voluntary commitment. Chulair may not currently meet the statutory thresholds that make the CCPA/CPRA applicable to a business (annual gross revenues over $25 million; buying, selling or sharing the personal information of 100,000 or more consumers or households; or deriving 50% or more of annual revenue from selling or sharing personal information). We nonetheless voluntarily extend the rights and commitments described in this section to California residents as a matter of good practice. This voluntary extension does not constitute an admission that the CCPA/CPRA applies to Chulair.

Categories of personal information collected. In the preceding 12 months we have collected the following categories of personal information, as described in section 2:

• Identifiers: email address and name (provided via Google or Apple sign-in), and, if you enable notifications, the push subscription or device token.
• Geolocation data: country derived from your IP address and, for "Your look for today", an approximate location (city and time zone from your IP; coordinates rounded to about 11 km if you share your location from the browser). We do not collect precise geolocation.
• Internet or other electronic network activity: IP address and access logs, in-app interaction data such as the external store links you open and the features you use, and generic device and browser categories linked to an ephemeral session identifier.
• Visual information: photographs and videos of looks and garments, selfies uploaded for the virtual try-on feature, AI-generated try-on images and videos, and, for 30 days, reduced copies of photographs rejected by the automatic filter. We do not use photographs to uniquely identify any person; to the extent selfies could be considered biometric or sensitive personal information, we use them solely to provide the try-on feature you request.
• Inferences: AI-generated garment tags (type, color, name) and the daily outfit suggestions built from them.
• Advertising measurement information: Google click identifier (gclid) and campaign parameters (UTM), subject to the consent or opt-out regime described in sections 2, 4 and 11.

Your rights as a California consumer. Subject to certain exceptions, you have the following rights:

• Right to Know / Access: request that we disclose the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties with whom we share it.
• Right to Delete: request the deletion of personal information we have collected from you.
• Right to Correct: request the correction of inaccurate personal information we hold about you.
• Right to Opt-Out of the Sale or Sharing of Personal Information: direct us not to sell or "share" your personal information for cross-context behavioral advertising.
• Right to Limit the Use of Sensitive Personal Information: direct us to limit the use of your sensitive personal information to what is necessary to provide the Service.
• Right to Non-Discrimination: we will not discriminate against you for exercising any of your CCPA/CPRA rights.

We do NOT sell your personal information, and we do not "share" it for cross-context behavioral advertising as those terms are defined under the CCPA/CPRA. The only advertising-related disclosure is the Google Ads conversion measurement described above in sections 2, 3 and 4, which you may opt out of at any time as described in the Cookie Policy or by writing to us.

"Do Not Sell or Share My Personal Information" and "Limit the Use of My Sensitive Personal Information": because we do not sell or share personal information in that sense, and because we use sensitive personal information only to provide the Service you request, no dedicated opt-out link is required. You may nonetheless exercise any of these rights at any time by writing to soporte@chulair.com.

How to exercise your rights. To submit a request, write to soporte@chulair.com. We will need to verify your identity before processing the request, which may require you to confirm information associated with your account. You may also use an authorized agent to make a request on your behalf, in which case we may ask for proof of the agent's authorization and may verify your identity directly. We will respond within 45 days; this period may be extended by an additional 45 days where reasonably necessary, in which case we will inform you of the extension.

13. Users outside Spain: country commitments

The data controller is established in Spain and all processing is governed by the GDPR and the LOPDGDD, whose level of protection is equal to or higher than that of the laws listed below. Regardless of whether these laws apply to Chulair, we voluntarily extend the rights in section 7 (access, rectification, erasure, restriction, portability, objection and withdrawal of consent) to all users in the countries where the Service is available, and we handle requests through the same channel (soporte@chulair.com) and within the same period (one month, extendable by two further months in complex cases, of which we will inform you). This voluntary extension is offered as good practice and does not constitute an admission that those laws apply. You may also contact the authority of your country:

The data of all users, regardless of their country, is stored in the European Union (see section 4) and processed with the same safeguards.

14. Communications

We send you two kinds of communications. Service communications (welcome email, notice that your look is ready, availability of the service in your country, incidents affecting you, alerts in the app's bell) are necessary to provide the service and you cannot unsubscribe from them without closing your account. Commercial communications about Chulair's news and features (never third parties') are sent under Art. 21.2 of Spanish Law 34/2002 (LSSI-CE) to existing users, at a low frequency and always with an unsubscribe link in the email itself; you may also object by writing to us. Unsubscribing does not affect service communications.

Notifications in the browser or on the device are only sent if you enable them, and you can disable them at any time from Settings or from your browser or system.

15. Changes to this policy

This Privacy Policy may be updated to adapt to regulatory, case-law or Service changes. The current version will always be published on the Service, indicating the date of the last update. Continued use of the Service after the publication of the changes implies acceptance of the new Policy.

16. Contact and exercise of rights

For any inquiry regarding this Privacy Policy or to exercise your rights, you may contact the data controller at: soporte@chulair.com

17. YouTube API Services

Chulair uses the YouTube API Services for a single purpose: to automatically publish, on our own channel @Chulairapp, compilation videos produced by us from the content of our brand account. These videos are declared as content generated with artificial intelligence.

We do not access, collect or process YouTube user data. You are not asked to link your YouTube or Google account to Chulair for this purpose, we do not read or display third-party videos, channels, comments or statistics, and no personal data of Service users is sent to YouTube. Publishing is carried out by our server using the channel owner’s credentials.

By using Chulair you agree to the YouTube Terms of Service. You can review how Google handles information in the Google Privacy Policy.

© Chulair · www.chulair.com