Privacy Policy
Last updated: September 29, 2026
1. WHO WE ARE
Psichologijos mokymų centras, UAB (registration code 305743263) (“we”, “us”, “our”) is the data controller responsible for your personal data.
Address: Gojaus g. 1, Zibalai, Širvintų r., Lithuania
Email: hello@my-look.app
2. THE DATA WE COLLECT
We collect the personal data described in the table below. It includes information you give us directly (your email address, quiz answers, style profile, the photos you upload and the messages you send to the stylists), information created when you use My Look (outfit scores, style insights, daily progress, usage events) and information about payments (payment identifiers and order history).
Quiz photos: some quiz steps let you choose a photo of yourself. That photo stays on your device; it is never uploaded or saved.
Payment card details are entered in our payment provider's form. We never see or store your full card number.
| Category | Fields | Purpose | Legal Basis | Retention |
|---|---|---|---|---|
| Email address | email | Create your account, send your results, sign-in codes and service emails; marketing emails | Contract (Art. 6(1)(b)); marketing: consent (Art. 6(1)(a)) | Account: while your account is open. Quiz without a purchase: 90 days |
| Quiz answers | quiz_answers (age range, eye, hair and skin colouring, skin undertone, body shape, style preferences, goals, style struggles, areas to highlight, occasions, city, budget) | Build your style profile and personalise your result and offer | Contract and steps at your request before a contract (Art. 6(1)(b)) | Account: while your account is open. Quiz without a purchase: 90 days |
| Style profile | colour type, body shape, colouring, age range, style leaning, goals, occasions, city and climate, budget | Personalise daily tasks, recommendations, stylist replies and style tools | Contract (Art. 6(1)(b)) | While your account is open |
| Photos you upload | closet photos, outfit scan photos, photos sent in the stylist chat | Your wardrobe, outfit scans, AI style tools and the stylist chat | Contract (Art. 6(1)(b)) | Until you delete the item or close your account |
| Wardrobe and looks | garment tags, outfit scores and analyses, favourites, style insights | Show your closet, your looks history and your style journey | Contract (Art. 6(1)(b)) | Until you delete the item or close your account |
| Stylist chat | your messages and the stylists' replies | Provide the chat and keep your conversation history | Contract (Art. 6(1)(b)) | While your account is open |
| Daily progress | daily tasks, ticks, the day's picks | Run your daily style ritual and show your progress | Contract (Art. 6(1)(b)) | While your account is open |
| Payment identifiers | solidgate_order_id, subscription_id, card_token, card_brand, card_last4 | Process payments and subscriptions, enable one-tap add-on purchases, handle refunds and disputes | Contract (Art. 6(1)(b)) | Card token: until your subscription ends or you ask us to remove it. Transaction records: 10 years |
| Order history | amount, currency, status, product | Fulfil purchases, issue receipts, resolve disputes and keep accounting records | Contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) | 10 years (accounting obligations) |
| Access rights | product, access level, granted and expiry dates | Grant and check access to what you purchased | Contract (Art. 6(1)(b)) | While your account is open |
| Sign-in security | email, IP address, result and time of each sign-in attempt | Protect accounts against brute-force and unauthorised sign-in | Legitimate interest: security (Art. 6(1)(f)) | 30 days |
| Device and visit data | IP address, browser and device, language, approximate location (country, region, city) derived from your IP address, referral and campaign (UTM) data | Security and fraud prevention, showing the right language and currency, knowing which campaign brought you | Legitimate interest (Art. 6(1)(f)) | Account: while your account is open. Quiz without a purchase: 90 days |
| Usage events | quiz steps, app events, page views, related metadata | Analytics: understand how the quiz and app are used and improve them | Consent (Art. 6(1)(a)) | Without a purchase: 90 days. With a purchase: 2 years |
3. WHY WE PROCESS YOUR DATA
We process your personal data for these purposes:
- Style profile: turn your quiz answers into your style profile, result and plan.
- Member area: provide your wardrobe, outfit scans, AI stylists, style tools and daily tasks.
- AI features: analyse the photos and text you submit to produce outfit scores, garment tags, outfit ideas and stylist replies.
- Account: create and maintain your account and your access to what you purchased, and send you sign-in codes.
- Payments: process purchases and subscriptions, handle refunds and disputes.
- Communication: send service emails (results, purchases, account) and, with your consent, marketing emails.
- Analytics and improvement: understand how the quiz and app are used and make them better (with your consent).
- Advertising: measure our campaigns and show relevant ads to people who did not finish a purchase (with your consent).
- Security: detect and prevent fraud, abuse and unauthorised sign-in attempts.
- Legal obligations: keep accounting records and respond to lawful requests from authorities.
4. LEGAL BASIS FOR PROCESSING
We rely on the following legal bases under Article 6(1) of the GDPR:
- Contract (Art. 6(1)(b)): to personalise your quiz result at your request, and to run your account, the member area and its AI features, payments and service emails.
- Consent (Art. 6(1)(a)): for analytics and advertising cookies and pixels, and for marketing emails. You can withdraw your consent at any time.
- Legal obligation (Art. 6(1)(c)): to keep transaction and accounting records as tax and accounting laws require.
- Legitimate interest (Art. 6(1)(f)): to keep the service secure, prevent fraud, protect sign-in, and establish or defend legal claims.
- We do not ask for health data. Your colouring, body shape and photos are used only for style advice. We do not use them to identify you, or to infer your racial or ethnic origin, your health or any other special category of personal data.
5. WHO RECEIVES YOUR DATA
We share personal data with the service providers listed in the table below. Unless the table says otherwise, each acts as a processor under a data processing agreement and handles your data only on our instructions.
We do not sell your personal data.
| Service | Role | Data Shared | Location | Transfer Mechanism |
|---|---|---|---|---|
| Supabase | Processor: database, sign-in and file storage | All account data: profile, quiz sessions, orders, photos, chat, events; sends sign-in codes by email | The region of our Supabase project | Depends on the project region; contact us for details |
| Vercel | Processor: hosting, website analytics, performance monitoring, AI gateway | Page URLs, IP address, browser, referrer, performance metrics; requests to the AI features (see OpenAI) | USA (Vercel Inc.) | EU-US Data Privacy Framework + SCCs |
| OpenAI (via Vercel AI Gateway) | Processor: AI model provider | Photos and text you submit to AI features, your style profile and wardrobe tags, a pseudonymous account ID. Not used to train AI models | USA (OpenAI) | EU-US Data Privacy Framework or SCCs |
| Solidgate | Processor: payments | Email, IP address, payment card (tokenised), amounts, order and customer identifiers | EU (Solidgate, Cyprus) | Processing within the EU/EEA |
| Resend | Processor: email delivery | Email address and the content of service emails | USA (Resend) | EU-US Data Privacy Framework or SCCs |
| PostHog | Processor: product analytics | Session ID, email address (once you enter it), events, page URLs, campaign data, quiz result segment | EU (eu.i.posthog.com) | EU data residency |
| Google (Tag Manager, Google Ads, Google Analytics, Google Fonts) | Processor / independent controller: advertising measurement and fonts | Hashed email (SHA-256), session ID, event names; IP address when fonts load | USA (Google LLC) | EU-US Data Privacy Framework + SCCs |
| Meta (Pixel and Conversions API) | Independent / joint controller: advertising measurement and retargeting | Hashed email (SHA-256), hashed session ID and country, IP address, browser, click identifiers, page views and purchase events with their value | Ireland / USA (Meta Platforms) | EU-US Data Privacy Framework + SCCs |
6. INTERNATIONAL TRANSFERS
Some of our providers are in the United States. We protect these transfers as follows:
- EU-US Data Privacy Framework: used where the provider is certified under it.
- Standard Contractual Clauses (SCCs): the European Commission's standard clauses, used where a provider is not certified or as an extra safeguard.
- EU processing: Solidgate processes payments and PostHog processes analytics in the EU, so no international transfer takes place.
- Supabase: the transfer mechanism depends on the region of our project. Contact us for details.
7. HOW LONG WE KEEP YOUR DATA
We keep personal data only as long as the purposes in this policy require. The table above gives the period for each kind of data. In summary:
- Quiz sessions without a purchase: 90 days, then deleted.
- Account data (profile, wardrobe, photos, looks, chat, progress): while your account is open, and deleted within 30 days after you ask us to close it.
- Closet items you delete in the app: removed together with their photo.
- Orders and payment records: 10 years, as accounting law requires.
- Usage events: 90 days without a purchase, 2 years with a purchase.
- Sign-in attempts: 30 days.
8. YOUR RIGHTS UNDER THE GDPR
Under the General Data Protection Regulation you have these rights over your personal data:
- Right of access (Art. 15): get a copy of the personal data we hold about you.
- Right to rectification (Art. 16): correct inaccurate or incomplete data.
- Right to erasure (Art. 17): ask us to delete your personal data ("right to be forgotten").
- Right to restriction (Art. 18): limit how we process your data in certain circumstances.
- Right to data portability (Art. 20): receive your data in a structured, machine-readable format.
- Right to object (Art. 21): object to processing based on legitimate interest, and to direct marketing at any time.
- Right to withdraw consent (Art. 7(3)): withdraw any consent at any time, without affecting processing before the withdrawal.
- Right to complain (Art. 77): lodge a complaint with a data protection authority.
9. HOW TO EXERCISE YOUR RIGHTS
To exercise any of these rights, email us at support@mylook.example, or write to Psichologijos mokymų centras, UAB, Gojaus g. 1, Zibalai, Širvintų r., Lithuania.
To close your account and delete your data, email us from the address you use for My Look. You can delete closet items yourself in the app.
We reply within one month. If your request is complex, or we receive many requests, we may extend this by two further months and will tell you so.
To protect your data, we may ask you to confirm your identity before we act on a request.
Exercising your rights is free. If a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse it.
10. SUPERVISORY AUTHORITY
If you believe we process your personal data in breach of the GDPR, you may complain to the data protection authority of the country where you live, work, or where the alleged breach took place.
Our lead supervisory authority is the State Data Protection Inspectorate of the Republic of Lithuania (Valstybinė duomenų apsaugos inspekcija), vdai.lrv.lt.
11. WHAT YOU MUST PROVIDE
Some personal data is needed for the service; the rest is up to you:
- Email address: required to receive your results and to have an account.
- Quiz answers: needed for a personal result. Where you prefer not to say, answer "not sure".
- Payment data: required to make a purchase. It is handled by our payment provider, Solidgate.
- Photos: optional. Only the features you choose to use with a photo receive one.
- Analytics and marketing: voluntary. My Look works fully without them.
12. AUTOMATED PROCESSING AND PROFILING
My Look uses automated processing to personalise your experience. This is profiling under Article 4(4) of the GDPR.
How it works: your quiz answers place you in a style direction (for example, Classic & Polished or Casual Chic), which chooses the content of your result and offer pages. In the member area, AI analyses the photos and text you submit to give outfit scores, tags, outfit ideas and advice, using your style profile.
None of this has legal or similarly significant effects on you. It does not change your price or limit your access to any part of the service; it only shapes style advice.
You can ask for human review, express your view or contest a result by emailing support@mylook.example.
13. AGE
My Look is intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has given us their data, contact us and we will delete it.
14. SECURITY
We protect your data with encrypted connections, access controls and private storage: your photos are kept in private storage and shown only to you through short-lived links.
15. CHANGES TO THIS POLICY
We may update this policy. The date at the top shows the latest version, and we will tell you about significant changes by email or in the app.