Privacy Policy

Luvii Labs Inc. (Delaware) (“Luvii”) is the data controller for personal data processed on luvii.io. Contact: privacy@luvii.io.

• Account data: name, username, email, phone (verification), language, profile photo and bio.
• Creator imagery: full-body photographs you upload of yourself, uploaded piece/product images, and the AI-generated try-on images derived from them. Facial and body imagery is treated as sensitive; where law defines biometric information more broadly, we treat this imagery to that stricter standard.
• Commission data: mandates, deliverable rows, delivery links, proof screenshots, review decisions and communications on the platform.
• Payment data: handled by Stripe; Luvii stores only tokens, amounts and status — never full card numbers.
• Technical data: device, log and usage data strictly necessary for security and operation. We use only essential cookies; no advertising trackers.

When you use the try-on, your photograph and the piece image are sent to our image-generation processors (FASHN; Replicate for sharpening) to render you wearing the piece. This is done only at your request, on the specific images you choose, under contracts that limit their use of those images to generating your result and running the service: FASHN’s terms state that it does not use your content to train AI models, and Replicate’s licence is scoped to producing your output and providing the service — neither is granted the right to train its own models on your images. Generated drafts are private to you and are published only when you choose. We do not use facial recognition, do not identify people in images, and do not sell or share biometric or facial data with anyone — ever.

We ask for your explicit, informed, written (electronic) consent before processing any photograph of your face or body, stating the purpose (virtual try-on and the platform features you invoke), the processors involved, and the retention schedule below. You may withdraw consent at any time in Settings; withdrawal stops new processing and triggers deletion of stored source imagery per Section 6. We never make consent a condition of unrelated services.

• Providing the platform and executing commissions — performance of a contract.
• Try-on image generation — your explicit consent (Art. 9(2)(a)-standard where applicable).
• Payments, fraud prevention, security, and defending legal claims — legitimate interests and legal obligation.
• Transactional email/notifications about your commissions — performance of a contract; marketing only with separate opt-in consent.

• Source photographs and unkept drafts: deleted when you delete them, when you withdraw consent, or on account deletion — and in any case within 30 days of the earliest of those. This is our published retention schedule; where any law permits longer retention, we still apply this shorter schedule.
• Published looks: retained while published; deleted on unpublish-and-delete or account deletion.
• Commission and payment records: retained as required for tax, accounting and dispute-defence (typically 6–7 years), minimised to what those purposes need.
• Account deletion purges profile, imagery and content; a minimal transactional ledger is retained on the legal-obligation basis above.

We share personal data only with: the counterparty to your commission (what the product shows them — e.g. your profile, deliverables and delivery links); our sub-processors under data-processing agreements (Supabase — database and storage; Vercel — hosting; Stripe — payments; Resend — email; FASHN and Replicate — image AI; Twilio/Meta — verification messages); professional advisers; and authorities where the law compels it. We do not sell personal data, do not “share” it for cross-context behavioural advertising (CCPA), and no data is used to train AI models.

Data is processed in the United States and the regions our sub-processors operate in. For transfers from the EU/UK we rely on Standard Contractual Clauses (and the UK IDTA/Addendum); for the UAE, on PDPL-permitted mechanisms. Copies of safeguards are available on request.

Everyone, regardless of region, may access, correct, download, delete, or object to processing of their data and withdraw consent, via Settings or privacy@luvii.io, without discrimination and free of charge. Regional specifics: EU/UK — all GDPR rights including restriction, portability and complaint to your supervisory authority; California — rights to know, delete, correct and to opt out of sale/sharing (we do neither), with no discrimination; Illinois — the consent, no-sale and retention commitments in Sections 3–6 are made expressly under BIPA; UAE — PDPL access, correction, deletion and objection rights. We respond within the shortest applicable statutory period.

Imagery is stored privately with row-level access controls and served only through publish-gated endpoints; access is least-privilege; money and audit events are logged. No system is perfectly secure; if a breach creates risk to you, we will notify you and regulators as the law requires, without undue delay.

Luvii is strictly 18+. We do not knowingly process data of anyone under 18 and delete any such data on discovery. Content featuring minors is prohibited platform-wide.

We will notify you of material changes in-product or by email before they take effect; continued use after the effective date is acceptance. Prior versions are available on request.