Privacy Policy

Last updated: 1 July 2026 · Version: privacy_v2.0

Luvii Privacy Policy. Controller: Luvii Labs Inc., a Delaware corporation. Contact: privacy@luvii.io.

1. Scope

Luvii is an invitation-only platform where creators are styled in AI-generated looks and brands commission creators to wear and post their pieces. This policy covers creators, brand representatives, people who apply for access or are invited to a preview, and visitors to public profiles. Two data types get extra care: (a) biometric data — photos of your face you upload and the AI try-on images generated from them; (b) financial/payout data — bank, SWIFT/BIC, or wallet details used to pay you.

2. Data we collect

Account & identity: email, phone (if given), Google account ID (if you use Google sign-in), username, display name, profile/cover images, bio, social links, country of residence. Biometric & image: selfies and reference photos you upload, AI try-on results and looks generated from them, your today’s look. Preview try-ons: if you are invited to preview before signing up, your uploaded selfie, the generated image, and your IP address are recorded against that invitation. Payout & financial: payout name, bank name and account number and SWIFT/BIC, or wallet address, payout preference, and processor references. We do not store full card numbers — card payments are handled by Stripe. We retain transaction records. Addresses: shipping address(es) where relevant to fulfilment. Commercial & content: commissions, briefs, terms, delivered post links and attached images/captions, in-app assistant messages, support requests. Social-reach: where a social handle is connected or provided, metrics about that account (followers, engagement, audience geography) to evidence reach to brands. Usage & device: pages viewed, referrers, browser/user-agent, link clicks, and security/rate-limit logs. Data about others: if you send a gift or brand invite, we process the recipient’s or applicant’s name, handle, email, and message.

3. Why we use it

To create and run your account (contract); generate AI looks/try-ons (your explicit consent); pay creators (contract; legal obligation); operate the marketplace (contract); show reach to brands (legitimate interests); security and fraud prevention (legitimate interests; legal obligation); service emails (contract); product improvement (legitimate interests). We do not sell or share your personal data.

4. Biometric & facial-image data

To generate looks and try-ons we process photos of your face. We use third-party AI providers (FASHN and Google Gemini); we direct them to use your image solely to generate your result. We process facial images only with your consent; we use them only to generate and display your looks and profile imagery; we do not sell them or use them to identify you elsewhere. Retention: source selfies are kept while your account is active and deleted within 30 days of account closure; generated looks remain until you delete them or close your account. If you withdraw consent we stop generating new looks and delete your source photos on that schedule.

5. Payout & financial data

Used solely to pay you and to meet tax/AML obligations. Your payout details are access-controlled and visible only to the systems and staff who process payouts. We keep transaction and payout records for 7 years to meet tax and anti-money-laundering obligations. Processors: Stripe collects brand payments.

6. Sub-processors

Supabase (database, file storage, authentication), Vercel (hosting), Stripe (payments), Resend (email), FASHN and Google Gemini (AI try-on/image generation — process facial images), Google (sign-in), Shopify/AutoDS (gifting fulfilment where applicable).

7. International transfers

Luvii is operated from the United States; data is hosted in the United States (AWS us-east-1). If you are in the EEA or UK your data is transferred internationally; we rely on Standard Contractual Clauses, the UK IDTA, and the EU-US Data Privacy Framework where applicable.

8. Your rights

Subject to your location, you may access, correct, delete, port, or restrict your data, object to certain processing, and withdraw consent, by contacting privacy@luvii.io. Deletion, honestly: when you delete your account we immediately hide your public profile, sign you out, and start a 30-day recovery window during which you can restore it. After 30 days we anonymise your account rather than erasing the record entirely: we delete your facial images and payout/banking details and permanently disable the login, while retaining limited profile information and your transaction and commission history as required for tax, accounting, and the other party’s records. We never sell or repurpose data left after deletion.

9. Age

Luvii is for adults; you must be 18 or older. We do not knowingly collect data from anyone under 18.

10. Security & changes

We protect data with row-level security, encryption in transit (TLS), and access controls. No system is perfectly secure. For material changes we will ask you to re-accept, and your acceptance is recorded with the policy version.

11. Contact

privacy@luvii.io — Luvii Labs Inc.