Privacy Policy

Effective date: 1 September 2026
Last reviewed: 1 September 2026
Data controller: Planbase Limited (“FitMatch”, “we”, “us”, or “our”)
Contact: hello@fitmatch.org.uk
Registered address: Flat 6, Chales Street, Newport, United Kingdom

1. About this policy

This Privacy Policy explains how FitMatch collects, uses, stores, shares, and protects personal information when you use the FitMatch mobile app (iOS and Android), the web app at app.fitmatch.org.uk, this marketing site, and related services (together, the “Service”).

FitMatch is a private digital wardrobe and outfit-planning service. We collect only the information needed to run and improve that service, and we tell you when artificial intelligence is being used to process your data.

This policy is written to comply with the UK GDPR, the EU GDPR, the UK Data Protection Act 2018, the EU AI Act (Regulation (EU) 2024/1689), and the ePrivacy Directive as implemented in the UK (PECR) and EU member states.

2. Information we collect

Information you provide

• Account details: name, email address, profile image, sign-in method, and password (handled by our authentication provider Clerk — we never see your raw password).
• Style preferences: preferred styles, colours, occasions, climate, and other choices you set in the app.
• Wardrobe content: clothing photos, categories, colours, brands, materials, patterns, tags, favourites, and notes.
• Outfit information: AI-generated outfit combinations you keep, saved looks, feedback, and preferences.
• Voice recordings: short audio clips you record when using the voice-planning feature. Recordings are sent to a speech-to-text model for transcription and are not stored after the transcript is returned.
• Support messages and requests you send to us.
• Payment information: if you subscribe to FitMatch Pro, your card details are entered into and stored by Stripe (via Clerk Billing). We receive only your subscription status, plan, and renewal date.

Information collected automatically

• Device and app information: operating system, app version, device type, screen size, browser, language preference, and technical diagnostic information.
• Authentication and security records: session identifiers, sign-in events, IP address, and fraud-prevention signals.
• Product analytics: pages viewed, features used, buttons tapped, outfits generated, and similar events. Collected via PostHog to help us understand how the Service is used and to fix problems. Events are attributed to your account after you sign in.
• Session recordings: PostHog Session Replay may record a masked recording of how you use the Service. Text you type into secure fields (passwords, payment details) is masked automatically. You can opt out in Preferences → Notifications and analytics (once enabled).
• Approximate location: when you enable the weather feature, your device gives us a coarse location (city-level) so outfit suggestions match today’s weather. We do not store precise coordinates.
• Push-notification tokens: if you allow notifications, we store the token issued by Apple, Google, or the browser so we can send you daily-plan and reminder pushes.

Information from connected sign-in providers

If you choose Google or Apple sign-in, the provider gives us information you authorise it to share — typically your name, email address, and profile image. The provider handles your password and its own authentication process.

3. How we use your information

We use personal information to:

• Create, authenticate, secure, and maintain your account.
• Store and organise your private wardrobe and saved looks.
• Generate outfit suggestions from your wardrobe and preferences using AI models.
• Analyse clothing photos (category, colour, material, formality, season) to auto-fill wardrobe entries.
• Transcribe voice notes so you can plan by speaking.
• Send push notifications you have opted into.
• Understand feature usage and improve the product through PostHog analytics.
• Process subscription payments and manage your plan via Clerk Billing and Stripe.
• Respond to support requests and account enquiries.
• Prevent abuse, fraud, unauthorised access, and security incidents.
• Meet legal, regulatory, accounting, and enforcement obligations.

We do not use your wardrobe photos, voice recordings, or outfit history to train general-purpose AI models. Third-party AI providers we use are contractually forbidden from using your inputs to train their models.

4. Our lawful bases (UK GDPR / EU GDPR Article 6)

Depending on the purpose, we rely on:

• Contract (Art. 6(1)(b)): processing needed to provide FitMatch after you create an account — storing your wardrobe, generating outfits, running the app, processing payments, sending transactional emails.
• Legitimate interests (Art. 6(1)(f)): operating, securing, debugging, and improving the Service; product analytics via PostHog to understand aggregate feature use; fraud prevention. We balance these against your rights and you can object.
• Consent (Art. 6(1)(a)): where we ask you to opt in — push notifications, camera access, photo-library access, microphone access for voice planning, precise location if we ever add it, marketing emails. You can withdraw consent at any time in Preferences or your device settings.
• Legal obligation (Art. 6(1)(c)): tax and accounting records, responses to lawful requests, safety obligations.

5. Automated decision-making and AI transparency (GDPR Art. 22 + EU AI Act)

FitMatch uses artificial-intelligence systems to generate outfit suggestions, tag your wardrobe items, transcribe voice notes, and synthesise the assistant’s spoken replies. Under the EU AI Act, these features are limited-risk AI systems: they do not make legal or similarly significant decisions about you, they do not use biometric categorisation, and they do not perform emotion recognition.

In line with Article 50 of the EU AI Act, we tell you clearly when AI is producing content. Outfit suggestions in the planner and today’s look are marked as AI-generated. The assistant’s spoken replies are synthetic voice output, not recordings of a real person.

You are not subject to any decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you (GDPR Art. 22). You can always override, edit, or ignore any AI output. If you believe an AI-generated result is wrong, tell us at hello@fitmatch.org.uk and we will review it.

6. Wardrobe photos and voice recordings

Wardrobe photos are stored in private, user-scoped Supabase storage buckets accessible only via short-lived signed URLs generated for you. Voice recordings travel to Cloudflare Workers AI (Whisper) for transcription and are discarded once the transcript is returned; only the transcript may be logged briefly for rate-limiting and safety.

AI outputs (tags, outfits, transcripts) can be inaccurate. You can edit, delete, or correct any of them.

7. Who processes information for us (sub-processors)

Current sub-processors and what they handle:

• Clerk (US): authentication, session management, and subscription billing (via Stripe).
• Stripe (US/IE): payment processing for Pro subscriptions. Card details never touch our servers.
• Supabase (US/EU): Postgres database and private file storage for wardrobe photos.
• Cloudflare (Global): edge hosting for the API gateway (Workers), key-value cache (KV) for AI response caching, D1 for credit records, and Workers AI for image tagging, planning (Llama), speech-to-text (Whisper), and text-to-speech (MeloTTS).
• ElevenLabs (US): optional text-to-speech provider for higher-quality voice output when enabled.
• Pinecone (US): vector search over wardrobe embeddings for “find similar pieces” features.
• Vercel (US/EU): hosting of the marketing site and web app front-end.
• PostHog (US): product analytics, feature flags, session replay, and error tracking. Also mirrors selected wardrobe and outfit metadata from Supabase to compute aggregate cohorts. No wardrobe photos or voice recordings are sent to PostHog.
• OneSignal (US): push-notification delivery on iOS, Android, and web.
• Apple and Google (US/IE): optional sign-in, app-store distribution, and push-notification transport (APNs / FCM).
• Expo / EAS (US): mobile-app build pipeline and over-the-air updates.
• OpenWeather (UK): weather data for the weather-aware outfit feature.

Each sub-processor is bound by a Data Processing Agreement that limits their use of your data to providing the service to us. Any new sub-processor will be added to this policy before it begins handling personal information.

We may also disclose information if required by law, to protect users or the Service, or as part of a merger, financing, acquisition, or sale. We do not sell personal information and we do not share it for cross-context behavioural advertising.

8. International transfers

Several sub-processors listed above (Clerk, Stripe, Cloudflare, PostHog, ElevenLabs, Pinecone, OneSignal, Apple, Google, Expo) process personal data outside the UK and EU, primarily in the United States. Where personal data is transferred outside the UK or EEA, we rely on one or more of these safeguards:

• UK adequacy regulations (including the UK–US Data Bridge extension of the EU–US Data Privacy Framework) where the receiving organisation is self-certified.
• European Commission Standard Contractual Clauses (SCCs) combined with the UK International Data Transfer Addendum for UK personal data.
• The UK International Data Transfer Agreement (IDTA) where the SCCs are not applicable.
• Supplementary technical and organisational measures (encryption in transit and at rest, access controls, minimum necessary data).

You can request a copy of the transfer mechanism used for a specific sub-processor by emailing us.

9. How long we keep information

• Active account, wardrobe, and outfit data: while your account is open.
• Voice recordings: not stored — discarded after transcription (seconds).
• TTS audio cache: up to 30 days at Cloudflare’s edge KV, keyed by the exact text and voice, not by user.
• Deleted wardrobe photos and records: removed from active systems immediately and from rolling backups within 30 days.
• Account deletion requests: processed within 30 days from active systems; 90 days from backups.
• Product analytics (PostHog): raw events retained for 7 years by default; aggregated insights indefinitely. You can request deletion of your PostHog data by asking us.
• Session replays: retained for 30 days.
• Security and diagnostic logs: up to 12 months, longer during an active investigation.
• Support tickets: up to 24 months after the request is resolved.
• Legal, tax, fraud-prevention and dispute records: only for the period required by applicable law or a documented legal claim (typically 6 years for financial records).

10. Cookies, local storage, and similar technologies

The Service uses a small number of first-party storage mechanisms:

• Strictly necessary: Clerk session cookie so you stay signed in; theme preference and language stored in localStorage. These do not require consent under PECR / ePrivacy.
• Analytics: PostHog uses a first-party cookie (or, in cookie-less mode, a hashed identifier) to attribute events to a session. This is set only after you sign in and we have a lawful basis for analytics under legitimate interest. You can opt out in Preferences.
• Push notifications: the browser or device stores a push-notification token when you opt in.

We do not use advertising cookies or share data with ad networks. Because we do not set consent-requiring cookies before you sign in, we do not display a cookie banner on the marketing site.

11. Security

We use measures designed to protect personal information, including authenticated access, user-scoped database rules, private storage buckets, encrypted connections (TLS 1.2+), short-lived signed image URLs, restricted server-side credentials, and rate limiting on the API gateway. Voice recordings are not persisted and TTS audio is only cached by content hash (never by user identity).

No service can guarantee absolute security. Keep your device and sign-in credentials secure, and contact us promptly if you suspect unauthorised account access. We will notify you and any competent supervisory authority of a personal-data breach that is likely to result in a risk to your rights and freedoms, within the timeframe required by law (72 hours to the ICO).

12. Your data-protection rights (UK GDPR / EU GDPR)

You have the right to:

• Access a copy of the personal information we hold about you (Art. 15).
• Have inaccurate or incomplete information corrected (Art. 16).
• Ask us to delete your information (Art. 17 — right to erasure).
• Restrict certain processing (Art. 18).
• Object to processing based on legitimate interest, including analytics (Art. 21).
• Receive your data in a portable, machine-readable format (Art. 20).
• Withdraw consent where processing relies on consent (Art. 7).
• Not be subject to solely automated decisions with legal or similarly significant effect (Art. 22).
• Complain to a data-protection authority.

To exercise a right, contact hello@fitmatch.org.uk. We may need to verify your identity and will respond within one month (extendable by two months for complex requests, with reasons given).

UK residents may complain to the Information Commissioner's Office (ICO). EEA residents may complain to their local data-protection authority.

13. Account and photo deletion

You can edit wardrobe details and remove individual pieces in the app at any time. To delete your entire account, visit fitmatch.org.uk/delete-account, use Profile → Delete account in the app, or email hello@fitmatch.org.uk from the address connected to your account. After verification we delete account data from active systems within 30 days and from rolling backups within 90 days.

Deleting the app from your device does not by itself delete your account.

14. Children

FitMatch is intended for users aged 16 or older. We do not knowingly collect personal information from children below that age. If you believe a child has provided us with data, contact us and we will delete it.

15. Device permissions

FitMatch may request the following optional permissions on your device:

• Camera: to photograph new wardrobe pieces.
• Photo library: to pick existing photos of clothing.
• Microphone: to record short voice notes for the planner (Pro).
• Location (approximate): to fetch today’s weather for outfit planning.
• Notifications: to send daily plan and saved-look reminders.

Each permission is requested only when you first use the feature and can be revoked at any time in your device settings. Revoking a permission disables the feature but does not affect the rest of the Service.

16. Changes to this policy

We may update this policy as FitMatch changes or legal requirements develop. We will update the date above and, for changes that materially affect your rights, notify you in-app or by email before the change takes effect.

17. Contact

Planbase Limited
hello@fitmatch.org.uk
Flat 6, Chales Street, Newport, United Kingdom