Privacy Policy

Vestis Limited ("Vestis", "we", "us", "our") is a company incorporated in New Zealand. We operate the Vestis mobile application, website, AI wardrobe platform, messaging features, and related services (collectively, the "Service").

We are committed to protecting personal information in accordance with applicable data protection laws, including but not limited to:

• The New Zealand Privacy Act 2020
• The General Data Protection Regulation (EU) 2016/679 ("GDPR")
• The UK GDPR
• The California Consumer Privacy Act ("CCPA"), as amended
• Other applicable global data protection laws

This Privacy Policy explains how we collect, use, process, disclose, transfer, and safeguard personal information when you use the Service.

By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy.

1. Data Controller

For the purposes of data protection law, Vestis Limited acts as the data controller of personal information collected through the Service.

If you are located in the European Union or United Kingdom, you may contact us regarding your GDPR rights using the contact details within the app.

2. Scope of This Policy

This Privacy Policy applies to all users worldwide. If you access the Service from outside New Zealand, you acknowledge that your personal information may be transferred to, stored in, and processed in countries where data protection laws may differ from those in your jurisdiction.

Where mandatory local laws apply, those rights are preserved.

3. Categories of Personal Information We Collect

We collect personal information directly from you, automatically through your use of the Service, and in certain cases from third parties.

3.1 Information You Provide Directly

This may include your name, username, email address, password, profile picture, wardrobe images, styling preferences, saved outfits, messaging content, feedback, support requests, and any other information voluntarily submitted through the Service.

3.2 Messaging Data

When you use the messaging feature, we collect the content of messages, timestamps, delivery metadata, and associated identifiers necessary to facilitate communications.

We do not routinely monitor private messages in real time; however, message data may be reviewed where required for moderation, safety enforcement, or legal compliance.

3.3 Wardrobe & Image Data

When you upload clothing images or other photos, we collect the images themselves, embedded metadata, timestamps, and AI-generated categorisation data.

These images may be processed by automated systems for styling analysis and AI improvement.

3.4 Automatically Collected Data

We may automatically collect:

• IP address
• Device identifiers
• Operating system
• App version
• Session data
• Clickstream activity
• Feature usage
• Crash logs
• Approximate geolocation (if enabled)

3.5 Inferred & Derived Data

We may generate inferred data such as style preferences, engagement patterns, interaction behaviours, and algorithmic classifications based on your activity within the Service.

4. Children and Minors

The Service is available to users aged 13 and above.

Where users are under 16 years of age, we may require parental or guardian consent where required by applicable law.

We take children's data protection seriously and:

• Do not knowingly collect more information than reasonably necessary.
• Do not intentionally sell children's personal information.
• Implement additional safeguards for minor accounts.

Parents or guardians may contact us to request access to or deletion of a minor's personal information.

If we become aware that personal information has been collected from a child in violation of applicable law, we will take reasonable steps to delete such data.

5. Purposes of Processing

We process personal information for the following lawful purposes:

• To create and manage user accounts.
• To provide AI-powered outfit recommendations and wardrobe functionality.
• To facilitate messaging and social features.
• To personalise content and recommendations.
• To maintain platform integrity, detect fraud, prevent abuse, and enforce safety policies.
• To improve our algorithms, features, and system performance.
• To conduct internal research and analytics.
• To comply with legal obligations and regulatory requirements.
• To respond to support enquiries and user communications.

6. AI Processing & Machine Learning

Vestis uses artificial intelligence and automated decision-making systems to analyse wardrobe images and generate outfit recommendations.

Uploaded images may be processed for:

• Categorisation
• Style matching
• Pattern recognition
• Algorithm training
• System optimisation

Where feasible, we use anonymisation or aggregation techniques when using data to improve AI systems.

AI outputs are automated suggestions and do not constitute professional advice.

Users may contact us for further information regarding automated processing.

7. Legal Bases for Processing (GDPR)

For users in the European Economic Area and United Kingdom, our legal bases include:

• Performance of a contract, where processing is necessary to provide the Service.
• Compliance with legal obligations.
• Legitimate interests, including platform security, feature development, and fraud prevention.
• Consent, where required for optional features such as location services.

Where consent is relied upon, it may be withdrawn at any time without affecting the lawfulness of processing prior to withdrawal.

8. Sharing and Disclosure

We may share personal information with:

• Service providers assisting with hosting, analytics, messaging infrastructure, AI infrastructure, and security services.
• Legal authorities where required by law, subpoena, court order, or regulatory request.
• Successor entities in the event of merger, acquisition, or restructuring.

We require service providers to process personal information in accordance with applicable data protection laws.

We do not sell personal information in the conventional sense. However, users in certain jurisdictions may have additional rights under broad statutory definitions of "sale."

9. International Data Transfers

Because we operate globally, personal information may be transferred outside your country of residence.

Where data is transferred from the European Union or United Kingdom to countries without adequacy decisions, we implement appropriate safeguards such as:

• Standard Contractual Clauses.
• Contractual data protection commitments.
• Other lawful mechanisms recognised under applicable law.

10. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes described in this Privacy Policy.

When accounts are deleted, we may retain limited information for legal compliance, dispute resolution, fraud prevention, or security purposes.

Backups may persist for limited periods before deletion cycles complete.

11. Data Security

We implement appropriate technical and organisational measures to protect personal information from unauthorised access, loss, misuse, or alteration.

However, no method of electronic transmission or storage is entirely secure. Users acknowledge that data transmission occurs at their own risk.

12. User Rights

Depending on your jurisdiction, you may have rights to:

• Access your personal information.
• Request correction of inaccurate data.
• Request deletion of personal information.
• Object to or restrict certain processing.
• Request data portability.
• Withdraw consent where applicable.
• Lodge complaints with a supervisory authority.

Requests may be submitted through the Help & Feedback section within the app.

We may require identity verification before fulfilling requests.

13. California Privacy Rights

California residents may have additional rights, including:

• The right to know categories of personal information collected.
• The right to request deletion.
• The right to opt out of certain data uses.
• The right not to be discriminated against for exercising privacy rights.

Requests may be submitted through our Help & Feedback section.

14. Cookies and Tracking

Where web functionality exists, we may use cookies, analytics tools, and tracking technologies to:

• Measure engagement.
• Improve performance.
• Diagnose system issues.

Users may adjust browser settings to limit tracking where applicable.

15. Automated Decision-Making

AI-generated recommendations are automated outputs designed to enhance user experience.

They do not constitute legally binding decisions and do not produce significant legal effects under applicable law.

Users may contact us for further clarification regarding automated processing.

16. Third-Party Links

The Service may contain links to third-party websites or services.

We are not responsible for the privacy practices of third parties.

17. Policy Changes

We may update this Privacy Policy from time to time.

Where material changes occur, we may notify users through the Service.

Continued use after updates constitutes acceptance.