Draft for legal review. This document was written by the FASHIONDEALS team to describe how the service actually works. It has not yet been reviewed by external counsel and is not legal advice. We recommend that a qualified lawyer in your jurisdiction review it, and that the items in [[brackets]] (company details and points marked [[Confirm with FASHN]]) are completed before launch.
Who we are and how to reach us
The controller of your personal data is [[Company legal name]], [[Registered address]], company number [[Company registration number]] ([[Jurisdiction]]). Contact for privacy: [[Contact email]]. Data Protection Officer (where required): [[DPO email]]. EU/UK representative (where required): [[EU / UK representative name and address]].
This policy applies to the FASHIONDEALS website, apps and related services. It is written for shoppers worldwide and explains your rights in the main regimes that apply to us. Where a local law gives you more rights than described here, those rights apply to you.
The short version
- We compare prices; we do not sell products and we never see your payment details (you pay the store).
- We do not sell your personal data and do not use it for cross-context behavioural advertising. There are no third-party advertising trackers on the site.
- Optional analytics and affiliate tagging are off until you choose. Personalisation (“For you”, recently viewed, remembered size and country) is off until you allow it and, for anonymous visitors, lives only on your device.
- Try-on photos are not stored by us unless you are signed in and choose to save a result; you can delete them at any time.
- You can clear your history, switch personalisation off, or ask us to delete your data at any time.
What we collect, why, and on what legal basis
The table lists the personal data we handle. “Basis” refers to the GDPR/UK GDPR; equivalent grounds apply under other laws (for example consent and “reasonable purposes” under the DPDP Act and PDPL).
| Data | Why we use it | Basis |
|---|---|---|
| Technical data: IP address, browser and device type, pages requested, timestamps (processed by our hosting provider and in short-lived security logs) | Deliver the site, keep it secure and fast, prevent abuse and fraud | Legitimate interests |
| Approximate country derived from your connection | Suggest country, currency and local stores; not added to a profile unless you save a preference | Legitimate interests |
| Preferences you set: language, currency, country, theme, size system, density | Remember your settings (stored on your device) | Contract / legitimate interests (strictly necessary) |
| Personalisation profile (only if you allow it): brands, categories, colours and price ranges you view or search, sizes you choose, products you view, try-on or click through to a store, filters you use, your country; counts and dates only | Re-rank results and search toward your tastes, show “For you”, deal rails and “Continue where you left off”, and tailor copilot suggestions | Consent |
| Searches you type into search or the copilot, and the voice transcript if you use voice search | Return results. Kept in your device’s recent-searches list; if personalisation is on, used as a signal. Voice audio is handled by your browser’s speech service (see section 6) | Contract / legitimate interests; consent for personalisation |
| Messages you send us (contact, report a price, advertise, careers): name, email, country, message, consent record, a hashed form of your IP address and browser information | Reply to you and limit spam and abuse | Consent; legitimate interests |
| Newsletter (“The Edit”): email, language, country, time and wording of your consent, unsubscribe status | Send the newsletter and prove consent | Consent |
| Account (optional): email, name, password hash or passkey, saved items and lists, price alerts, fit profile (size, height, fit preference), optional avatar/“My model”, sign-in sessions | Provide your account and its features | Contract |
| Synced personalisation (only if you are signed in and opt in): your preference profile, stored in our database under your account | Carry your preferences across devices | Consent |
| Try-on: your photo, body measurements and the garment you choose; results and, if you save them, your wardrobe/“My model” | Show a garment on you and suggest a size. See section 7 and the Virtual try-on and photo policy | Consent (explicit, for biometric-style data) |
| Analytics (only if you opt in): cookieless visit statistics (pages, referrer, country, device class) | Understand what is slow or confusing and improve the service | Consent |
| Outbound clicks to stores: the product, store and time of the click (no account link unless you are signed in and have allowed personalisation) | Send you to the store, measure which links work, and calculate affiliate commission | Legitimate interests; consent for affiliate identifiers |
We do not collect payment card details: purchases happen on the store’s own website. We do not knowingly collect special-category data, except photos and body measurements that you choose to provide for try-on, which may be treated as biometric or sensitive data in some places.
Personalisation: what it is and how it is controlled
When you allow Personalisation in the cookie preferences (a separate switch from analytics and marketing), the site learns your tastes from what you do on it and uses that to put more relevant things first. Specifically:
- What is recorded: brands, categories, colours and price bands you search for, open, filter by, try on, or click through to; sizes you pick; your country; the products you viewed (for “Recently viewed”) and where you left off. We keep counts and dates, not a transcript of everything you type.
- Where it is stored: for anonymous visitors, only in your browser’s localStorage on your device (keys such as
fd_pz,fd_recent,fd_pz_resume). It is never sent to our servers or to third parties. - Signed-in users: if you are signed in and additionally opt in under Settings → Personalisation, we copy the profile to your account in our database so it follows you between devices. You can switch the sync off, which deletes the copy.
- What it does: re-ranks listings and search results, builds the homepage “For you” and “Deals on brands you like” rails, shows “Price drops on items you viewed” (only where we hold real price history), remembers your size and country, and shapes copilot suggestions. It never changes the price you pay or the order of price comparisons between stores for the same product.
- Your controls: Settings → Personalisation has an off switch and a Clear my history button; the cookie preferences let you withdraw consent at any time, which stops recording and deletes the local profile. Global Privacy Control does not turn on anything; it will not be used to switch personalisation on.
- No profiling with legal effects: personalisation is not used for automated decisions that significantly affect you.
Who we share data with
We use service providers (processors) under contract or standard terms, only for the purposes above:
| Provider | Purpose | Data involved |
|---|---|---|
| Cloudflare, Inc. | Hosting, content delivery, security (including bot protection on some forms), our database (D1) and, if you opt in, cookieless Web Analytics | Technical data; data you store with us |
| Our try-on provider, FASHN (fashn.ai) | Generates photo-real try-on images, only if you choose it | Your photo and the garment image for that request. [[Confirm with FASHN]] |
| Public content delivery networks (for example jsDelivr and Hugging Face) | Deliver the open-source libraries and models that run on-device AI features | IP address and user-agent when files are served |
| Google Fonts (some non-Latin scripts) | Deliver fonts | IP address and user-agent |
| Email service provider [[provider name]] | Account, newsletter and reply emails | Email address and message content |
| Stores and affiliate networks you click through to | Take you to the store and attribute a sale, if you allowed affiliate tagging | The click and a tracking identifier; their own privacy policy then applies |
| Professional advisers, authorities and acquirers | Legal advice, legal obligations, or a business transfer under confidentiality | As needed |
We do not sell personal data and do not share it for cross-context behavioural advertising (as those terms are used in the CCPA/CPRA). We do not use third-party advertising or social-media tracking pixels.
Voice search and the copilot
If you use voice input, your browser or device sends audio to its own speech-recognition service (for example Google or Apple) to turn it into text; that service’s privacy policy applies and we do not receive the audio. The text you speak or type is processed by our search engine in your browser against our catalogue and pages. Spoken replies use your device’s built-in text-to-speech. See the AI copilot notice.
Photos, body scan and biometric-style data
The on-device body scan estimates body proportions from images and runs in your browser; your photo and measurements stay on your device. If you choose the optional photo-real render, we ask first, then forward your photo and the garment image through our server to our provider (FASHN) for that single request. As built today, we do not store your person photo on our servers; the rendered result is returned to you and a copy is kept for up to 3 days so you can retrieve it, unless you are signed in and save it to your wardrobe or “My model”, in which case it is kept until you delete it. We do not use your photos to train models. Details, including retention at the provider, are in the Virtual try-on and photo policy. [[Confirm with FASHN]] (provider retention and training statements must be confirmed before launch).
International transfers
We and our providers process data in many countries, including the United States, the UAE and the European Union. Where the law requires, we rely on adequacy decisions, standard contractual clauses (SCCs), the UK International Data Transfer Addendum, or other lawful transfer mechanisms. You can ask us for a copy of the safeguards. For the UAE PDPL and India’s DPDP Act, transfers are made only to jurisdictions or recipients permitted under those laws and any notified restrictions.
How long we keep data
| Data | Retention |
|---|---|
| Local device data (preferences, personalisation profile, recent items) | Until you clear it, switch personalisation off, or clear browser storage. The profile ages out old signals automatically. |
| Contact and report messages | Until handled, then up to [[retention period, e.g. 12 months]] |
| Newsletter subscription and consent record | Until you unsubscribe, then the consent record for [[period, e.g. 3 years]] to prove compliance |
| Account data | Until you delete your account; backups expire within [[period, e.g. 35 days]] |
| Synced personalisation profile | Until you switch sync off or delete your account |
| Try-on results (not saved) | 3 days; saved results until you delete them |
| Security and server logs | Short rolling periods set by our hosting provider, typically up to 30 days |
| Analytics | Aggregated, cookieless; no personal profile is created |
Your rights
Depending on where you live you may have the right to: access your data and get a copy; correct it; delete it; restrict or object to processing; data portability; withdraw consent at any time (without affecting earlier processing); not be subject to solely automated decisions with legal effects; and complain to a supervisory authority. To exercise a right, use the controls in Settings and your account, or contact [[Contact email]] (privacy/DPO: [[DPO email]]). We may need to verify your identity and will reply within the time the law requires (usually one month under GDPR/UK GDPR, 45 days under CCPA/CPRA, and as required under the PDPL and DPDP Act).
EEA and UK (GDPR / UK GDPR)
You may lodge a complaint with your local data protection authority (in the UK, the Information Commissioner’s Office).
California (CCPA/CPRA)
You may know, delete and correct personal information, and limit the use of sensitive personal information. We do not sell or share personal information as defined by the CCPA/CPRA, so there is nothing to opt out of; we also honour the Global Privacy Control signal as a refusal of analytics and affiliate tagging. You will not be discriminated against for exercising your rights. An authorised agent may act for you with proof of authority.
United Arab Emirates (PDPL, Federal Decree-Law No. 45 of 2021)
You have the right to information, access, correction, erasure, restriction, portability and objection, and to withdraw consent, subject to the law and its executive regulations. You may complain to the UAE Data Office.
India (Digital Personal Data Protection Act, 2023)
You have the right to access information about your data, to correct and erase it, to grievance redressal, and to nominate another person to exercise rights on your behalf. Our grievance contact is [[DPO email]]; if unresolved you may approach the Data Protection Board of India.
Security
We use HTTPS everywhere, store passwords as salted hashes (or use passkeys), mark session cookies HttpOnly and SameSite, limit who can access production data, and keep personalisation data on your device by default. No system is perfectly secure. Report a vulnerability to [[Contact email]]. If a breach affects you we will notify you and regulators as the law requires.
Children
The Service is not directed to children under 16 and we do not knowingly collect their data. Children’s fashion is shown for parents and guardians. See Children’s privacy.
Cookies and similar technologies
We use localStorage, cookies and IndexedDB as described in the Cookie policy. Essential storage is always on; analytics, affiliate/marketing and personalisation are optional and off by default.
Changes to this policy
We will post updates here with a new effective date and, for material changes, tell you in a reasonable way. The version in force is the one on this page; previous versions are available on request.
Contact
Privacy requests and questions: [[Contact email]]. Data Protection Officer: [[DPO email]]. Postal address: [[Registered address]]. See also Contact for legal and privacy requests.
Effective October 27, 2026 · Version 1.0 (draft for legal review). See all legal documents.