Last updated: October 10, 2026. This English text is a courtesy translation of the Italian original, which prevails in case of discrepancy.
Data controller
K2A S.R.L.S. — Via Alessandro Manzoni 84, Perugia (Italy) · VAT/Tax ID 03655880548 · REA PG-304896. Privacy contact: info@k2-ai.it.
1. What data we collect
- Account: email and credentials (via Clerk).
- Declared profile: display name, gender, age, height and weight (optional), build (in qualitative levels), preferred fit and budget, style preferences (colours, items to avoid or always suggest), occasions of use and language.
- Particular physical needs (optional: e.g. pregnancy, reduced mobility, or free text). They can concern health (a special category of data, Art. 9 GDPR): we process them only with your explicit consent, which you give by ticking the box next to the field, and you can withdraw it at any time by removing the items and saving.
- Photographs you choose to upload (face/body, inspiration photos, wardrobe items) and generated outfit images. Photographs may show the user's face; the application does not create or store biometric templates and does not perform biometric identification. Upload only photos of yourself or of people who have given their consent (see the Terms, art. 5).
- Data derived by AI: colour analysis (undertone, palette), body shape; from inspiration photos, the garments, how they are worn, the cut and, in one neutral sentence, the pose.
- Your interactions: outfit requests (occasion, city, time of day, notes), saved looks, 👍/👎 ratings with any free-text comment, choices made in «Which would you wear?», plans (boards), support requests and the ratings you give the app with any comment.
- Style memory: what we infer from your interactions to personalise suggestions (see §9).
- Technical/operational data: security logs, the cost and error record of every AI call, usage quota, payment data (if you buy).
2. Purposes and legal basis
- Generating outfits and aesthetic analysis, including processing the photographs you upload (also showing the face) → performance of the contract (Art. 6.1.b GDPR). Photographs are objectively necessary: without them the requested service — creating tailor-made outfit images for you — cannot be provided.
- Authentication and security → performance of the contract / legitimate interest in the security of the service (Art. 6.1.f).
- Invoicing and accounting obligations → contract and legal obligations (Art. 6.1.c).
- Personalising suggestions over time (style memory, §9) → performance of the contract: it is part of the service you request, and you can see, correct or pause it.
- Improving the service: the free-text comments you leave on looks and the subjects of support requests may be analysed, without your identifier, also with AI systems of our providers (§4) to spot recurring problems → legitimate interest in improving the product (Art. 6.1.f); they are not used to train models. You can object by writing to info@k2-ai.it.
- Particular physical needs (§1) → explicit consent (Art. 9(2)(a)), optional and revocable; the service works the same without it.
- Optional and possible purposes (e.g. promotional communications, model training) → free, specific and revocable consent (Art. 6.1.a). Today we carry out none of these activities: no data is used for marketing or to train models.
During onboarding we ask you to confirm, in an informed way, that you understand that images showing you will be processed. This tick has the function of transparency and acknowledgement; it is not the legal basis of the processing, which is the performance of the contract. You can stop the processing at any time by deleting your photos or your account from the Profile.
Photos are not used to create biometric templates, facial recognition or authentication, and not to train models.
3. What we do NOT do with photos
We do not infer, store or use ethnicity, religion, sexual orientation, political opinions, health status, disability or the meaning of tattoos. The AI is instructed to ignore such information; it only analyses colour, morphology, hair/features useful for rendering, style and garments (in inspiration photos: garments, how they are worn, cut and pose, never face, body or age). The exception is the physical needs you declare yourself (§1): they reach the AI only as neutral guidance about clothes («soft fit», «comfortable shoes»), never the reason, and free text is not sent to it.
4. Recipients / sub-processors
Data is shared only with the providers strictly necessary to deliver the service.
- Supabase — database and storage, AWS region eu-north-1 (Stockholm, EU).
- OpenAI Ireland Ltd. as contractual counterparty — AI processing: receives photos and minimised profile data (§7) and the free sentences you write in your requests (occasion, notes). Any international transfers are governed by the DPA and the Standard Contractual Clauses (SCC), where applicable.
- Anthropic PBC — only for the internal analysis described in §2 (comments and support-request subjects, without identifiers), where enabled as an alternative to OpenAI.
- Open-Meteo — weather forecasts: receives only the name of the city you enter in the request, to obtain the weather.
- Resend — sending of service e-mails, where active: receives your e-mail address and the text of the order confirmation we send you after a purchase.
- Sentry — technical error monitoring, where active: receives the type and message of the error, the technical trace and the request path, not user identifiers or the content of requests.
- Clerk Inc. — authentication, under its Data Processing Addendum.
- Vercel / Render — hosting; possibly Stripe/RevenueCat (payments), Cloudflare (anti-bot).
5. International transfers
Data at rest (photos, database) stays in the EU. Some providers may process data outside the European Economic Area (EEA), with adequate safeguards (Standard Contractual Clauses and the relevant DPAs).
6. Retention
We keep data as long as the account is active. When the account or the photos are deleted, the data is erased from the database and storage. The outfit images generated by the app (image and thumbnail) are deleted automatically 7 days after they are created to save storage: until then you can always download them and the app shows the days left; the outfit (title, items, description) stays in your history. This does not apply to the photos you upload or to the «Garment photos» bought separately, which stay until you delete them. Accounts inactive for a long period (indicatively 24 months) may be deleted; this check is currently done manually, not automatically. Operational logs are kept for about 90 days and deleted automatically. The entries of the style memory (§9) expire on their own unless confirmed by new interactions: after about 180 days those about your tastes (styles, colours, garments) and after about 365 days the lessons drawn from your 👎.
7. Minimisation
We send the AI the minimum necessary. We do not transmit name, email, identifiers or the IP address (except as strictly necessary for the services to work). Age is sent as a band, not the exact number. Height and weight, if you provided them, are sent only as bands (of 10 cm and 10 kg), never the exact values, solely to adapt proportions and fit of the garments. Physical needs, if you consented, are never named: the AI receives only neutral guidance about clothes. The city is used to obtain the weather (Open-Meteo, §4). The free sentences you write in requests (occasion, notes) are instead sent to the AI as they are: avoid including personal or health data in them.
8. Payments
Payment data is handled directly by the payment provider (e.g. Stripe) under its own privacy notice; it is not handled directly by K2A.
9. Automated decisions and artificial intelligence
The service uses artificial intelligence to generate personalised suggestions, solely for creative support and aesthetic personalisation. The processing does not produce automated decisions with legal or similarly significant effects within the meaning of Art. 22 GDPR.
Style memory and profiling. To personalise suggestions over time we record what we infer from your interactions: lessons drawn from your 👎 (also from free-text comments), styles, colours and garments you appear to like (from ♥, inspiration photos and the choices in «Which would you wear?») and the way you wear garments. It is profiling for aesthetic personalisation, with no legal or similarly significant effects on you. We apply a filter that discards inferences resembling special categories of data (health, religion, sexual orientation and the like). In «What StylishAI knows about me» (from the Profile) you can see every entry and where it comes from, correct or delete it, prevent it from being inferred again and pause learning altogether; entries expire on their own (§6).
Artificially generated content. The outfit images produced by the service are synthetic content generated by artificial intelligence: they show your appearance wearing garments you did not actually wear and are not real photographs. For this reason, in accordance with Art. 50 of Regulation (EU) 2024/1689 (AI Act), every generated image is visibly marked “AI-generated”. Please keep this label if you share the images with others.
10. Cookies
For cookies and similar technologies (e.g. those needed for authentication), see the Cookie Policy.
11. Your rights
You can exercise the rights of access, rectification, erasure, restriction, portability and objection, and withdraw consent for any optional purposes that may be activated in the future (§2).
Directly from the Profile, without contacting us, you can:
- Export all your data as readable JSON (Arts. 15 and 20), including account data, the style memory, the record of AI calls and download links for your images;
- Delete photos, analyses and outfit images showing you, keeping the account;
- Delete the account and all associated data (Art. 17).
You may always lodge a complaint with the data protection authority (in Italy, the Garante per la protezione dei dati personali).
12. Minors
The service is reserved for adults (18+).
13. Contact
To exercise your rights or for privacy questions: info@k2-ai.it.