Privacy Policy

Effective date: 5 October 2026 · Version: 1.1 (5 October 2026)

1. Who is responsible

UFit is operated by Vision Studio, a business based in the United States (contact: support@ufit-ai.us). “UFit,” “we,” “us” and “our” refer to that operator. We decide why and how personal information is processed for UFit and act as its controller where that term applies.

Privacy requests: support@ufit-ai.us. Account and billing support: support@ufit-ai.us. Website: https://ufit-ai.us. We serve users worldwide. We have not yet appointed an EU or UK representative under Article 27, and we have not appointed a Data Protection Officer; contact support@ufit-ai.us for any data-protection request or privacy question.

This notice covers the app, website and related support. Retailers, app stores, identity providers and device services have separate notices for processing they control. Acknowledging this notice is not blanket consent to every use of your information.

2. The essentials

UFit helps you organise clothes, request styling suggestions, find retailer products and generate illustrative virtual try-on images. AI features send relevant inputs to external AI services. A photo leaves your device when submitted for processing even if we do not save the original in our account database.

Different images have different treatment. Profile pictures and wardrobe crops can be stored in your account. A written appearance analysis is stored and reused for later styling. Generated try-on history is saved on your device. AI providers may separately retain submitted content under their service arrangements. Not saving an account-library copy does not mean that no temporary, diagnostic or provider copy exists.

You control optional permissions and whether to submit personal photos. Some features require particular information, a supported region or a subscription. The Photo and AI Notice explains image processing and your choices.

Accounts are for people aged 18 or over. We ask for your age at sign-up, and if we learn an account belongs to someone younger we close it and delete its information. To report one, contact support@ufit-ai.us — please don't send photos as proof.

3. What information we process

We do not receive full payment-card numbers from Apple or Google. SDKs can process technical and purchase information beyond the fields our own code expressly sends. An account identifier can remain personal information even if it does not contain your name.

The app is not designed to collect contacts, microphone recordings, background location or your entire photo library. It submits images you select for a feature. Platform permissions can differ by version; review and change them in device settings.

Do not include identity documents, medical records, intimate images, exact home addresses or other unnecessary sensitive information in photos, prompts or support messages. Do not submit another person's personal photos. Calendar titles can reveal private facts unintentionally; a general occasion gives you more control.

4. Photos, appearance analysis and AI

For personal-photo analysis, selected photos and relevant profile details pass through our backend and the disclosed AI processing chain. The model returns qualitative styling descriptions, which may include body shape, face shape, complexion, undertone, hair, facial hair and clothing suggestions. The analysis can be inaccurate. It is not an assessment of health, identity, worth or attractiveness.

We do not use this feature to authenticate people, match faces against an identity database or identify strangers. Nevertheless, photographs and appearance descriptions are personal information and can be sensitive. Whether a particular operation creates biometric data or involves special-category information depends on its actual processing, purpose and applicable law. We do not assume that every photograph is legally biometric, or that every fashion-related operation is exempt from biometric laws.

Where consent is required or relied on, we obtain it before the operation, explain the purpose and recipients, and provide a genuine choice. Where explicit consent is required, it is separate from accepting the Terms, paying for a subscription or granting operating-system camera permission.

You may withdraw optional consent and request deletion of the resulting profile in the app — Profile → Delete account removes everything, and wardrobe items and bookmarks can be removed individually — or by emailing support@ufit-ai.us. Withdrawal stops future processing based on that consent; it does not make earlier lawful processing unlawful. We explain any effect on the optional feature and any justified retention exception. You do not have to delete your entire account to submit a privacy request.

Training and human access. We never use your photos, measurements or other personal data to train our AI models, and we do not permit our AI providers to use them for training. Your data is sent to our AI providers only to produce your analysis, looks or try-on images, under agreements that prohibit training on it. We do not promise that no authorised human could ever access support, safety or diagnostic records.

If we propose optional training or promotional reuse later, we explain the new purpose separately and obtain the permission required by law before using existing content for it. Continued use after an ordinary policy update is not a substitute for required consent.

5. Location, calendar, reminders and your device

If you enable device location, UFit can receive precise coordinates and send them through the backend to the weather provider. Reverse geocoding also uses device/platform location services. A manually selected city can be used where that option is offered. Coordinates can appear in request paths and operational records; the retention rules below therefore cover logs as well as account tables. Revoking location permission stops new location access but does not automatically erase stored city preferences or existing records.

Calendar styling is off unless enabled. The current feature reads today's non-all-day events, selects up to six titles and times, and limits the summary to 300 characters before including it in a styling request. The summary leaves the phone and goes to the AI processing chain. Disable the feature or revoke the permission to stop future access. A generated suggestion may reflect that context, including when you save the suggestion.

Outfit reminders are local notifications scheduled on your phone; we do not send remote push notifications and the app does not register a push token. You control them in device settings. If we ever add remote notifications we will update this notice first.

The app keeps local preferences and caches, including profile information, location preferences, subscription status and try-on history. Try-on history currently keeps up to 30 records and associated image files. Removing an image, clearing app data or uninstalling may remove local copies. Exported gallery images and device/cloud backups remain subject to their separate controls. We cannot promise to remotely erase every copy you export or back up.

6. Recipients and purposes

This table is the current list of our providers. We update it whenever the chain changes.

Retailers and image hosts can receive IP addresses and ordinary device/browser request information when their images load or you open a link. We do not intentionally append your personal photo or full appearance profile to retailer links. This is not a promise that a retailer receives no information. Any affiliate attribution or purchase reporting we enable must be disclosed accurately.

We may disclose proportionate information to comply with law or valid legal process, investigate misuse, protect safety or establish/exercise legal claims. We assess requests rather than automatically supplying everything requested. Information may also be disclosed under appropriate safeguards during a financing, merger, sale or insolvency; a successor remains subject to applicable obligations. Required notices and restrictions continue to apply.

7. Advertising, sale and marketing

The app contains no advertising or analytics SDK, and the website sets no advertising or analytics pixel. Authentication, billing, hosting and AI providers still process operational information.

We do not sell personal information and do not share it for targeted advertising; the app contains no advertising. We do not disclose personal information for cross-context behavioural advertising. Where an applicable law gives an opt-out right or requires recognition of a universal opt-out signal, we honour it for covered processing. A browser's Do Not Track setting and a legally recognised universal opt-out signal are different mechanisms.

Optional promotional messages require an appropriate legal basis and an effective opt-out. Essential account, billing and security messages are separate. Generating a referral code does not authorise us to access your contacts or send invitations for you.

8. Legal grounds where required

Operating-system permission alone does not establish a lawful basis for every downstream use. We assess necessity and proportionality rather than treating all personalisation as automatically necessary to a contract.

Recommendations are automated and can constitute profiling of preferences. UFit is not intended to make legally or similarly significant decisions about healthcare, employment, insurance or credit. You can challenge, correct or disregard styling advice and ask for help.

9. International processing

Information may be processed outside your country, including in the United States (hosting on Render in Oregon, and our AI, search and payment providers) and Cloudflare's global network for image storage. Remote administrative access from another country is included in that assessment.

Where transfer rules apply, we use an available legal mechanism and required supplementary safeguards, such as applicable adequacy decisions or executed standard contractual clauses and the relevant UK mechanism. The arrangements we rely on are Standard Contractual Clauses (or the UK Addendum) with providers outside your country, and our providers' own data-processing terms. You can request further information or copies subject to appropriate redactions.

10. Retention

A longer period requires a specific justification, restricted access and an end condition. We do not keep everything indefinitely because it might be useful. Removing an identifier does not necessarily anonymise free text, timestamps or linked transaction records. We treat information as personal until the applicable de-identification standard is met.

Backups expire separately from active records. If restored, deletion records must be reapplied before the restored information returns to ordinary use.

11. Deletion and other rights

Start account deletion in Profile → Delete account, at https://ufit-ai.us/deletion.html, or by emailing support@ufit-ai.us, including if you cannot open the app. We may ask for proportionate evidence of ownership or authority. Do not send a password, full payment-card number or personal photo to verify a routine request.

A completed request removes or schedules removal of account-linked content and initiates appropriate provider actions, subject to the retention exceptions above. Your account record, bookmarks, wardrobe items and photos are removed from our live systems when you delete your account; residual copies in backups expire within 30 days. We explain retained categories, reasons and duration. A feedback reason, purchase or marketing permission is not required to request deletion.

Deleting the app or your UFit account does not automatically cancel an Apple or Google subscription. Cancel through the store used for purchase to stop future renewal. Deletion may remove access to this month's remaining allowances and saved content, without removing statutory refund rights. See subscriptions and refunds.

You may request access, correction, deletion and information about processing. Depending on applicable law, you may also have rights to portability, restriction, objection, withdrawal of consent, sale/sharing/advertising opt-outs, limitation of sensitive-data use and appeal of a refused request. We do not unlawfully discriminate against people who exercise rights. Refusing information necessary for a specific feature can affect that feature.

We respond within applicable deadlines and explain permitted extensions. EU/UK access and deletion requests generally have a one-month period; many US state regimes generally use 45 days, with different rules for particular rights. Send an appeal to support@ufit-ai.us. You can complain to the competent regulator without first contacting us where the law allows.

12. Security and changes

We use safeguards appropriate to the information and risks, including secure transmission, access controls and limits on operational access. No service guarantees perfect security. We notify affected people and authorities of personal-data breaches when required by law.

Report security concerns at support@ufit-ai.us, using descriptions or redacted examples where possible. We publish the effective date/version of this notice and explain material changes before they take effect when required. A notice update does not retroactively authorise incompatible processing or replace required fresh consent.

Privacy contact: Vision Studio, United States — support@ufit-ai.us.