Privacy Policy
This Privacy Policy explains what personal data Luvloot ("we", "us", "our") collects, why we collect it, how we use it, and your rights. We operate the Luvloot service at luvloot.app (marketing and account pages) and app.luvloot.app (the main application).
Muhammed Safwan T, a sole proprietor trading as Luvloot in Malappuram, Kerala, India, is the data controller (Data Fiduciary under the DPDP Act) for the personal data described in this policy. Paid subscriptions are sold through our authorised payment partner, which acts as seller and merchant of record for the transaction and is identified at checkout.
For privacy questions or to exercise your rights, contact our data contact at [email protected].
1. Data We Collect
| Category | Data | When collected |
|---|---|---|
| Account | Email address, display name, hashed password | On sign-up |
| Garment and styling content | Garment images, text descriptions, styling instructions, preferences, and generated looks | When you use styling features |
| Optional profile-photo analysis | A full-body photo, and the style details it suggests about your appearance and fit, which you review before saving | Only when you separately consent and upload a profile photo |
| Usage and product analytics | Usage and generation logs, feature interactions, and session identifiers. This includes product-analytics events recording which screens you open and which actions you take — for example starting a styling request, saving a look, refining a look, or reaching a plan limit — together with an account identifier and whether a request succeeded or failed. These events do not contain your garment images, generated looks, styling prompts, edit instructions, or saved profile answers. | Automatically during use |
| Approximate location (derived) | Country, region, and city estimated from your IP address by our hosting, security, and analytics providers. We do not collect GPS or precise device location. | Automatically on each request |
| Payment | Subscription status, credit balance, and purchase history, plus payment metadata from our payment partners (whether a payment succeeded, the amount, the plan, and a reference). Card and bank details are entered directly with our payment partners; we never receive or store your card number, CVV, or bank credentials. | When you buy a subscription |
| Technical | IP address, device type, browser/OS, request and crash logs, security signals | Automatically on each request |
| Communications | Emails and messages you send us | When you contact us |
Account data is required to create an account. A garment image is required only for image-based styling; text-based styling does not require one. Profile-photo analysis is optional, requires separate consent, and has a questionnaire alternative.
We collect only what you give us or what your use of Luvloot generates. We do not buy personal data, we do not enrich your profile with data from data brokers or third-party sources, and we do not combine your data with information bought from anyone else.
2. How We Use Your Data
- Providing the Service: analyzing garment inputs, isolating the selected garment, generating styling suggestions, managing credits, and delivering outputs.
- Optional personalization: suggesting visible style-profile attributes from a consented profile photo and applying only the profile choices you choose to keep.
- Account and payment management: authentication, account security, subscriptions, purchases, and refunds.
- Improving Luvloot: fixing errors, measuring quality, understanding which features are used and where people get stuck or hit failures, and improving and training the models behind the Service, as described in Section 5.
- Communications: support and transactional messages. We do not send marketing email without opt-in.
- Legal, security, and abuse prevention: complying with law, enforcing our Terms, moderating prohibited content, and preventing fraud and unauthorized access.
3. Legal Basis for Processing
EEA / UK users (GDPR / UK GDPR):
- Contract performance: account management, ordinary garment styling, delivery, and billing needed to provide the Service you request.
- Legitimate interests: security, abuse prevention, service reliability, debugging, and improving and training the Service as described in Section 5, balanced against your rights.
- Legal obligation: transaction records and responses to valid legal process.
- Consent and explicit consent where required: optional profile-photo analysis and any other optional processing identified at collection. You may refuse and use the questionnaire instead, or withdraw consent for future analysis.
India users (DPDP Act 2023): We process personal data on the basis of notice and consent for account, styling, billing, and optional profile-photo analysis, and on applicable legitimate uses recognized by law. You may withdraw consent; see Section 7.
4. Data Sharing
We do not sell personal data or use it for targeted advertising. We share data only with providers needed to operate Luvloot:
| Provider | Purpose | Data shared |
|---|---|---|
| Payment partner | Checkout, payment processing, tax handling, receipts, and refunds. Our payment partner acts as an independent controller of the payment details you enter with it, for regulatory reasons. It is identified at checkout, together with a link to its own privacy notice. | Email, the payment details you enter at checkout, and purchase details |
| Cloudflare | Hosting, CDN, edge compute, security, and Workers AI | Request metadata, usage data, and styling inputs when Workers AI performs processing |
| AI and image processing providers | Garment analysis, profile-photo analysis, image isolation, generation, and safety checking | The image and prompt needed for the requested operation. Providers may change as the Service develops; email us for the current list. |
| Resend | Transactional email | Email address and message content |
| PostHog | Product and web analytics, and error monitoring, so we can see which features are used, where people abandon a task, and what is failing | Product-analytics events, an internal account identifier, device and browser type, referring and current page address, approximate location derived from IP address, and error diagnostics. Not your garment images, generated looks, styling prompts, saved profile answers, email address, name, or payment details. Processed on PostHog's United States infrastructure. |
These providers process data under their service terms and data-protection commitments. We may also disclose data when required by law or valid legal process and will notify you where legally permitted.
5. Images, Face-Related Processing, and AI
Garment images: A garment photo may incidentally include a person. Our styling process works from the garment itself rather than from the person in the photo, and the generated look shows a synthetic wearer rather than the person you uploaded.
Optional profile photos: If you consent to profile-photo analysis, the photo is sent to an analysis provider to suggest style details about your appearance and fit. We do not keep the photo itself in your account or history. Results may be cached briefly to avoid repeating the analysis, and the details you choose to save stay in your account until you change or delete them.
No face recognition: Luvloot is not a facial-recognition, identity-verification, or surveillance tool. We do not create a faceprint or biometric template to identify you, and we do not match your face against any identity database.
Generated people: Generated looks show a synthetic wearer, not a real person. A generated figure is not intended to depict any real individual, and any resemblance to a real individual is coincidental and unintended. A generated look is not evidence that any real person wore or endorsed it, and must not be used to identify anyone or to make decisions about them.
Improving Luvloot: Garment images and generated looks are stored so you can revisit and restyle them, until you delete them or your account. We may use garment photos, prompts, styling choices, feedback, and generated results to test, evaluate, and improve Luvloot, including training the models that power it. Your optional profile photo is treated differently: we do not use identifiable profile photos to train models unless you separately opt in for that purpose.
6. Data Retention
- Account and saved profile data: while the account is active, then deleted within 30 days of a valid deletion request, subject to legal obligations.
- Garment images and generated styling outputs: until you delete them or delete your account.
- Profile photos: the photo is not retained in your account or history after analysis. Any short-lived processing cache is kept only for as long as that purpose requires.
- Payment records: seven years where required by tax and financial law.
- Usage and security logs: up to 12 months unless a longer period is necessary to investigate abuse or comply with law.
- Product-analytics events and error diagnostics: up to 12 months from collection, after which they are removed by our analytics provider.
7. Your Rights and Choices
Depending on your location, you may have rights to:
- Access and receive information about personal data we hold and how it is used.
- Correct or complete inaccurate, incomplete, or outdated data.
- Delete personal data, subject to legal retention obligations.
- Receive portable data in a structured, machine-readable format where applicable.
- Object to or restrict certain processing where applicable.
- Withdraw consent at any time without affecting processing that occurred lawfully before withdrawal. You can decline profile-photo analysis and use the questionnaire; contact us to withdraw recorded photo-analysis consent or delete saved profile information.
- Nomination (India): appoint a nominee to exercise rights in the event of death or incapacity, as provided by applicable law.
To exercise a right, email [email protected]. We may verify your identity before fulfilling a request and aim to respond within 30 days.
EEA/UK users: You may lodge a complaint with your local data-protection supervisory authority.
India users: You may complain to the Data Protection Board of India.
8. Automated Processing
Luvloot works automatically: analysis, generation, and safety checks all run without a person reviewing each request. These produce styling suggestions only and are not intended to make legal or similarly significant decisions about you.
9. Cookies and Tracking
| Name / type | Purpose | Duration |
|---|---|---|
| Session cookie (auth) | Keeps you logged in | Session or configured authentication duration |
| Preference storage | Remembers your interface settings | Until cleared |
| Security cookies | Protect the Service against attacks and automated abuse | Short-lived |
| Analytics storage (first-party cookie and browser local storage) | Recognises your browser between visits so product-analytics events can be grouped into sessions and returning use can be measured, as described in Sections 1 and 4 | Up to 12 months |
We use one analytics provider, PostHog, for product and web analytics and error monitoring. It is set up as first-party analytics for Luvloot only.
We do not use advertising cookies, ad networks, data brokers, or cross-site and cross-context behavioural tracking, and we do not sell or share your data for advertising. Our analytics tells us how Luvloot itself is used — nothing about your activity elsewhere on the web.
We do not record video-style replays of your screen, and our analytics does not capture your keystrokes or the contents of anything you type.
You can block analytics at any time using your browser's privacy settings or a tracker-blocking extension. Luvloot continues to work normally if you do.
10. Data Security
We use measures designed to protect data, including TLS in transit, access controls, bounded retention, and security reviews. No transmission or storage system is perfectly secure. If you believe your account or data has been compromised, contact us immediately.
If a data breach happens that is likely to affect you, we will tell affected users and any regulator we are required to notify, within the time the law allows, and explain what happened and what we are doing about it.
11. Children’s Privacy
The Service is for adults aged 18 and over. We do not knowingly collect personal data from a minor and prohibit uploading images of minors. If you believe a minor’s data has been submitted, contact [email protected] so we can investigate and delete it where appropriate.
12. International Transfers
Luvloot is operated from India. Your data may be processed in India, the United States, and other countries where our providers operate. Where a transfer safeguard is required by law, we put an appropriate one in place. Email us if you would like details about the safeguards that apply to your data.
13. United States State Privacy Rights
If you live in a US state with a comprehensive privacy law — including California, Colorado, Connecticut, Utah and Virginia — you may ask us to give you access to the personal data we hold about you, correct it, or delete it. You may also appeal if we refuse a request, and we will not treat you differently for asking.
We do not sell your personal data and we do not share it for targeted or cross-context behavioural advertising, so there is nothing to opt out of. What we collect, why, who we share it with, and how long we keep it are set out in Sections 1, 2, 4 and 6 above.
To make a request, email [email protected]. We may need to confirm your identity first, and an authorised agent may make a request on your behalf with proof of authority.
14. Changes to This Policy
We may update this Privacy Policy. We will provide reasonable notice of material changes and obtain renewed consent where required. The “Last updated” and “Effective date” above identify the applicable revision.
15. Contact
For privacy questions, data requests, consent withdrawal, or complaints:
Muhammed Safwan T
Sole proprietor trading as Luvloot
Malappuram, Kerala, India
Email: [email protected]
Phone: +91 90614 66446
Contact page
We aim to respond to data requests within 30 days.