Privacy Policy

• Your private photo library supplies the photo you choose for an outfit preview. PersoPot sends that photo and the clothing reference to its processing providers, without training a personal model. Older paid photo projects and admin experiments have separate trained-model workflows described below.
• We do not sell your photos or personal data. Advertising pixels and cross-site advertising tracking are not active in this release. We send selected photos to the service providers needed to process your requests, as described below. Content you share by link can be viewed by people with that link.
• You control sharing: private originals are not included in a pot unless you explicitly upload a photo to that pot. Pot members and people with an active review link can see shared content and feedback.
• Website card details are handled by Stripe; in-app subscription payments are handled by Apple. We store billing identifiers and subscription status to manage your purchases.
• Request account deletion or a copy of your account data by emailing support@persopot.com.

When you use saved-look offers, we store the looks you choose to watch and your offer preferences. Any retailer email-request records you created before the feature was removed remain private to your account and are removed when your account is deleted.

Live offer alerts are not active in this version. We do not access your inbox or manage a retailer’s mailing list. Links to retailer websites are subject to that retailer’s privacy policy.

Account information. When you sign in with Google we receive your email address, full name, and profile picture URL. Apple sign-in provides an identifier, your email or Apple relay address, and your name when Apple makes it available. Email sign-in provides your email address. We also store profile changes you make and essential authentication records.

Photos and generated images. The private person photos you save, legacy project selfies, the outfit reference images you import, and the AI-generated images we produce for you. Each image is associated with your account. Content you choose to share through pots or review links is accessible to people with those links.

Payment information. If you subscribe or make a purchase, Stripe processes website payments and Apple processes in-app subscriptions. We receive billing identifiers, subscription and payment status, and transaction information needed to support your purchase. Apple purchase verification also uses a PersoPot account identifier to connect the purchase to your account. Card numbers and CVV are handled by the payment provider, not stored by PersoPot.

Usage data. Standard server logs (timestamps, IP addresses, requested URLs, error messages), limited visitor counts on public marketing and policy pages according to the choices explained below, and operational metrics (e.g. how long a generation took, whether it succeeded). We don’t use third-party advertising trackers.

Optional profile details. Older body-profile hints and admin Model Lab measurement profiles are optional. Numeric measurements are not used by the new customer virtual try-on. Its selected person photo supplies visible proportions; it does not measure your body or predict clothing sizes.

To run the service. Your saved person photos are used to check image suitability and produce the previews you request. Gemini checks photo framing, visibility and quality. For a basic try-on, Black Forest Labs receives one selected person photo, the garment reference and your clothing description. Other photos in your library are not sent for that generation. We do not use these photos to train a personal model or for general-purpose model training by PersoPot.

Optional edits. A pose, background or framing change sends the completed try-on to Black Forest Labs, with the garment reference when its pose or background is requested. A clothing/proportion adjustment sends only the selected saved outfit image and edit-region mask to OpenAI. Those edits do not send your original photo library. These are visual previews; body proportions, garment details and unseen anatomy can be inaccurate.

Legacy projects and admin Model Lab. Older paid projects may train a LoRA through fal.ai. Admin tests send selected person, garment and optional body/avatar references to the chosen provider. Measurements are saved only with consent and used as prompt guidance only when enabled for that test. Optional Gemini reviews compare references and outputs without numeric measurements. Lab references and measurement profiles are separate from customer pots.

To communicate with you. We send transactional emails (account verification, one account-ready welcome, payment receipts, trial reminders, subscription updates, refund-request confirmations, and requested service updates) through Resend. Optional follow-up onboarding and activity messages can be stopped using the email preference link or by contacting support. PersoPot tips and trial invitations require a separate email opt-in. We record the wording version, choice, time, source and a fingerprint of the verified email address, and you can withdraw consent through Email preferences or the unsubscribe link. Retailer-offer alert emails are not active. Accepting cookies, creating an account or buying a plan is not an opt-in to promotional emails.

To improve the product. Aggregated, anonymized usage data tells us which features work and which are confusing. We don’t use your photos for product analytics.

On iPhone, you choose whether to allow notifications. If you enable them, we associate a push token and installation identifier with your PersoPot account and store your notification choices and last registration time.

Expo and Apple’s push service deliver generic outfit-ready and friend-feedback updates. The notification payload includes account and outfit identifiers needed to open the right place safely. We do not include photos, email addresses, names, product details or comment text in these notifications.

You can turn notifications or individual categories off in PersoPot’s notification settings, and change Apple’s permission in iPhone Settings. Signing out disconnects that installation after the server confirms it. Disabling notifications does not affect your saved photos, outfits or Pots.

We rely on a small set of well-known providers to run PersoPot. They process information under their terms and our applicable service agreements. Some processing occurs outside Canada and may be subject to the laws and lawful access powers of those jurisdictions. The list below explains the role of each provider; a provider’s own policy also applies to its processing.

Essential storage supports sign-in, security, remembering your choices and guest votes. It is required for those features and is not used to build advertising profiles. Choosing “Necessary only” turns off optional browser analytics without preventing sign-in or purchases.

For visitors identified by our hosting platform as being in Canada, limited cookieless Vercel visit counts and performance measurements are on by default, with a visible notice and opt-out. Elsewhere, or when the region cannot be determined, optional browser measurements wait for a choice. A browser Global Privacy Control or Do Not Track signal disables the default measurements. You can disable them at any time.

These measurements are restricted to public pages. We filter out private app and invitation pages, sign-in callbacks, URL queries and fragments, photos, clothing descriptions and messages. Vercel uses a short-lived request-derived identifier for traffic counts; its analytics does not use a persistent tracking cookie. Optional PostHog page views require an affirmative analytics choice, use in-memory identifiers, and do not use session replay or automatic interaction capture.

Our cookie choice is stored in this browser for 30 days. Clearing browser storage or using another browser requires a new choice. Operational security, payment and failure records are separate and remain necessary to run the service. Withdrawing an analytics choice stops new optional events; it does not erase records already lawfully collected. Contact support for a data request.

Advertising pixels, cross-site tracking and customer matching are off. We will provide a separate choice before enabling advertising measurement. Server-side advertising transfers would follow that choice too. Cookie choices do not subscribe you to emails.

In transit. We use HTTPS for the public service and encryption for supported storage. No internet service can guarantee absolute security; contact us promptly if you suspect unauthorized access.

At rest. New customer person photos and outfit outputs are encrypted by PersoPot before object storage and served through permission-checked routes. An owner can share selected outputs through pots; original person photos remain private to the account. This additional encryption does not apply retroactively to legacy or admin Lab images.

Access controls. Production database access is restricted to authorized operators. Server credentials are used for backend processing. Application permission checks and database Row-Level Security are used to restrict access to account data; shared pots and invite links have separate access rules.

Payment data. Card numbers, CVV codes, and other card details are handled by Stripe for website purchases or Apple for in-app subscriptions. PersoPot stores billing references and subscription status needed to manage your purchases.

• Account information — retained until an account deletion request is completed, subject to any records that must be retained.
• Private person-photo library — photos expire 365 days after upload, last use for a try-on, or choosing “Keep for another year.” Daily cleanup requires an email reminder and allows at least seven days after that reminder before deletion. You can delete photos earlier in My photos; an active generation must finish first. Subscription cancellation does not delete photos. Saved outfit previews and pots are separate.
• New outfit previews and edits — remain until you delete them in My outfits or request account deletion. Deleting an outfit removes its stored outputs and linked wishlist/pot entries. If storage cleanup fails, the item stays marked for retry and is hidden from sharing. Original photos are deleted separately. Minimal request/payment records may remain for billing and support; deletion does not remove provider records, backups or downloaded copies.
• Legacy project selfies and generated images — automatic storage cleanup is scheduled daily. Basic photo projects have 30 days of storage; Pro and Premium photo projects have 365 days, measured from payment (or creation if no payment date is recorded). Completed projects are scheduled for an email reminder seven days before expiry. After expiry, the cleanup removes the project’s photo records and linked PersoPot storage objects, then sends a confirmation email when photos were removed. Download photos you want to keep. For earlier removal or associated data outside this cleanup, contact support.
• Trained AI model (your LoRA) — stored separately from photo records. Request model deletion through support; deleting a lab test does not delete a trained model.
• Payment history — retained for as long as required by tax and accounting law (typically 6–7 years in Canada). Stripe and Apple retain their own payment records under their respective policies.
• Optional push notifications. Background maintenance removes finished delivery records older than 30 days and installations inactive for 90 days. Removing an installation also removes its queued delivery records. Account deletion removes the associated push registration and delivery records; Expo and Apple manage their own service records under their policies.
• Server logs and provider records — retention depends on the service and configured policy. PersoPot’s image deletion controls do not erase provider records, backups, or copies already downloaded by you or others.
• Admin Model Lab — tests, body/avatar references and saved measurements have manual deletion controls. Measurements are optional for all genders and remain private to the lab account. Temporary measurement snapshots are cleared when a test completes or fails; values are omitted from saved prompt history and exports. Deleting the saved measurement profile clears remaining temporary lab copies. No profile change is allowed during an active test. Deleting a test removes its final and first-stage images, where present, from PersoPot’s lab storage and its database record after both steps succeed. Incomplete cleanup remains marked for retry. Source photos must be deleted separately after their tests. There is no automatic retention timer for lab data.
• Occasion pots and real outfit photos — real photos stay until you delete the photo or pot; project expiry and reminder emails do not apply to these uploads. If storage cleanup fails, the photo remains marked for deletion so you can retry. Review links expire after 1, 7 or 30 days and can be revoked earlier. Guest feedback includes a display name, vote and optional note; guest names are unverified. An essential browser cookie remembers guest votes for 30 days. Removing an outfit clears its occasion feedback; deleting the pot removes its plans, links and feedback. Copies already downloaded by others are outside these controls.
• Wishlist and outfit references — removing a wishlist item also removes its pot memberships and related item feedback; it keeps the generated photo in your library. Archiving an outfit reference hides it from the active list and does not itself delete its stored image.

Depending on applicable law, including PIPEDA in Canada, you may request:

• Access — request a copy of the personal data we hold about you.
• Correct — fix anything that’s wrong.
• Delete — request removal of your account and associated data through support or the in-app deletion request where available, subject to legal retention requirements.
• Export — download available photos and ask support for an accessible copy of your account information.
• Object — withdraw optional consent or object to processing where the law provides that right. Withdrawing processing needed for a preview means we cannot create that preview.

To exercise any of these rights, email support@persopot.com. We may need proportionate verification to protect your account. We respond within the applicable legal period, generally 30 days for Canadian access requests, and explain any permitted extension or refusal. You may also complain to the Office of the Privacy Commissioner of Canada or the relevant regulator in your jurisdiction. These choices do not limit rights that apply to you by law.

PersoPot is not intended for users under 18. We don’t knowingly collect data from anyone under 18. If you believe a minor has signed up, email support@persopot.com and we’ll delete the account.

We’ll update this page if our practices change. The “Last updated” date at the top reflects when. If we make a material change (new third party, new data type, new use), we’ll email registered users at least 14 days before it takes effect.

Questions about this policy or how we handle your data? support@persopot.com. Address privacy inquiries to the PersoPot Privacy Officer.

Use the subject “Privacy request” for access, correction, deletion, consent or complaints.