PRIVACY POLICY

Effective Date: 7 March 2026

Contact: info@velvet-ai.app

1. Introduction

VELVET AI, Inc. ("Velvet", "we", "our") provides an AI-powered fashion assistant and virtual try-on service ("App").

This Privacy Policy explains how we collect, use, and protect your personal data, and your rights regarding your information.

We comply with:

• GDPR (EU/EEA + UK users)
• CCPA/CPRA (California users)
• Delaware privacy and consumer laws
• COPPA (users under 13 not permitted)

By using the App, you agree to this Privacy Policy.

This website and application may participate in affiliate marketing programs and may earn commissions from qualifying purchases.

2. Age Requirement

Velvet is intended for users aged 13 or older (16 or older in the EU/EEA).

We do not knowingly collect data from children under 13.

3. Information We Collect

A. Account Information: Email, password, name (optional), gender (optional), country.

B. AI & Image Processing Data: User-uploaded selfies/photos for avatar creation, images uploaded in chat for fashion search, generated virtual try-on images, and text/chat inputs.

C. Device & Technical Data: Device type, OS, app version, IP address (for security), app performance logs.

D. Analytics: We use PostHog for product analytics. See Section 3.G for details.

E. Payments: Payments processed via secure third-party payment services. Stripe or similar may store billing information as required by law.

F. Face & Photo Data: We collect selfie photos you take during avatar creation. These photos are raw images used solely to generate your Digital Double and personalized outfit try-ons. No facial embeddings, biometric identifiers, or structured face data are extracted. Photos are processed by our third-party AI provider Replicate (replicate.com) and retained on our secure servers until you delete your account or request deletion. Replicate automatically deletes all input and output data within 60 minutes of processing.

Chat / AI fashion search images: Images you upload in chat are used for AI-driven fashion search and recommendations. They are processed by OpenAI (openai.com) and stored securely on our servers. These images are retained until you delete your account. We do not sell your photos.

Important: We do not process biometric identifiers, face embeddings, or use images for AI model training.

G. Analytics & Product Improvement (PostHog): We use PostHog, a privacy-focused analytics platform hosted in the European Union (GDPR-compliant), to understand how you use our app and improve your experience. We collect: usage events (e.g., feature use, screen views), device information (platform, app version), and session data (app launch, session duration). We use session replay technology to record how you interact with the app (e.g., taps, swipes, navigation) to improve usability and fix bugs. No passwords, payment details, or sensitive input fields are recorded. Screens containing your photos or other sensitive content are masked in session replays (displayed as black); only touch interactions and navigation are visible. You can ask us to stop session replay or delete your analytics data by contacting us at info@velvet-ai.app. For more on PostHog's practices, see posthog.com/privacy.

4. How We Use Your Information

• Provide core app functionality (avatars, virtual try-ons)
• Generate AI recommendations
• Personalize your experience
• Operate and secure accounts
• Communicate support or updates
• Prevent fraud and enforce Terms

AI and image processing is performed through contracted third-party AI providers under data processing agreements. We obtain your explicit consent before sharing any photos or personal data with these AI services. Your photos are shared only to the extent necessary to generate your Digital Double and outfit try-ons.

4A. Third-Party AI Services (Replicate)

Velvet uses Replicate as its third-party AI service to provide avatar creation and virtual try-on functionality:

What data we send: Selfie photos (raw images) that you upload during avatar creation, and optionally text/chat inputs for AI styling recommendations. No facial embeddings, biometric identifiers, or structured face data are extracted or sent.

Who receives the data: Replicate, Inc. (replicate.com, San Francisco, CA). Your photos are sent to Replicate solely to process your request.

When we share: We only share your photos and related data after you have given explicit consent. The app will ask for your permission before uploading any photo to our AI provider. You must agree before any personal data is transmitted.

Protection: Replicate is bound by a data processing agreement that requires it to protect your data with the same or equivalent safeguards as we provide, including confidentiality, security measures, and deletion upon completion of processing. Replicate does not use your photos for model training or any purpose other than fulfilling your specific request.

Data retention at providers: Replicate automatically deletes all input parameters, output files, and logs within 60 minutes of each API request.

4B. Third-Party AI Services (OpenAI)

Velvet uses OpenAI for AI-driven fashion search in chat:

What data we send: Images you upload in chat for fashion search, plus related text/chat inputs.

Who receives the data: OpenAI (openai.com). Your images are sent to OpenAI solely to deliver fashion recommendations.

When we share: When you use the chat fashion search feature. Use of the feature constitutes consent to share images with OpenAI for that purpose.

Protection: OpenAI is bound by a data processing agreement and does not use your data for model training by default.

Data retention at OpenAI: Abuse monitoring logs may be retained for up to 30 days. Your content is excluded from model training by default.

5. Legal Basis (GDPR Users)

• Performance of contract
• Consent (when required)
• Legitimate interest (app analytics, security)
• Legal obligations

6. Sharing and International Transfers

Data may be shared with third-party service providers strictly for app operation, AI processing, payments, analytics, and storage.

For AI image generation, we use Replicate (replicate.com). Replicate processes user photos solely to deliver the virtual try-on feature. We obtain your consent before sharing any personal data, and Replicate is contractually required to provide equivalent data protection. See Section 4A for full details.

For AI-driven fashion search in chat, we use OpenAI (openai.com). OpenAI processes images you upload in chat solely to deliver fashion recommendations. See Section 4B for full details.

For analytics and product improvement, we use PostHog (posthog.com), hosted in the EU and GDPR-compliant.

Your data may be transferred outside your country, including to the US, under standard contractual clauses or equivalent safeguards.

7. Data Retention

8. Your Rights

EU/EEA Users: Access, correction, deletion, portability, restrict processing, object to automated decisions.

California Users: Access, deletion, opt-out of data sale (we do not sell data).

Contact: info@velvet-ai.app

9. Data Storage and Security

Data is encrypted in transit and at rest. We use industry-standard measures including access controls and monitoring. Analytics data is retained for up to 1 year (see Section 7). You can request access to your data, deletion, or opt-out of analytics/session replay at any time by contacting us at info@velvet-ai.app. No system is 100% secure.

10. AI Disclaimer

AI outputs may be inaccurate, biased, or approximate. Virtual try-ons are simulations, not exact representations. Users are responsible for decisions made using AI outputs.

11. Account Deletion

Users may delete their account and request data removal at any time.

12. Contact