Privacy Notice

Suit AI is a mobile application that lets you virtually “try on” clothing using AI image generation (the “App”).

This Privacy Notice explains how the developer of Suit AI, Ali Kömürcü, an individual developer residing in Austria (“I”, “me”, “my”), collects, uses and protects your personal information, and how you can exercise your privacy rights.

I process personal information in accordance with the General Data Protection Regulation (GDPR) and, where applicable, the California Consumer Privacy Act (CCPA/CPRA) and other relevant data protection laws.

1. Scope

This Privacy Notice applies to personal information processed by me in connection with Suit AI, including the App and any related online or offline features (the “Services”).

2. Changes to This Privacy Notice

I may update this Privacy Notice from time to time. If I make material changes I will update the “Effective as of” date and, where legally required, notify you within the App.

If you continue to use the Services after an updated Privacy Notice takes effect, you are deemed to have accepted it.

3. Personal Information I Collect

I deliberately minimise what I collect. For Suit AI this is authentication data, the images involved in a try-on, your style preferences, your credit and subscription status, and a small amount of advertising and diagnostic data.

3.1 Information You Provide Directly

a) Account and login data

Suit AI supports three ways to sign in, all handled by Firebase Authentication:

• Email and password — I receive your email address and a Firebase-managed password hash. I never see or store your plaintext password.
• Sign in with Google — Google returns your email address, display name and profile photo URL to the App, which are stored in your Suit AI user profile.
• Sign in with Apple — Apple returns an Apple-issued user identifier and, on first sign-in, optionally your name and a private relay email address if you choose to hide your real one.

There is no guest or anonymous mode. An account is required, because everything the App holds for you — your wardrobe, your saved looks, your credit balance and your subscription — belongs to that account.

b) Photos, and what happens to each one

A try-on uses two images: a photo of you, and an image of a garment. They are treated differently, and the difference matters.

• Your photo of yourself is not retained. It is uploaded to my backend (Google Firebase Storage), passed to the generation model, and then deleted from my storage as soon as the job finishes — whether it succeeded or failed. A background task also deletes the photo of any job that never completes. It is not attached to your history and it is not recoverable afterwards.
• Garment images are stored in your wardrobe so you can reuse them, up to a limit of 20 garments per account. They stay until you delete them, and deleting a garment in the App removes both the record and the underlying image file.
• Generated results are stored in your account so you can view, save and share them. You can delete an individual look, or all of them by deleting your account.
• Before any photo leaves your device, the App asks for your explicit consent and names Google as the recipient. If you decline, no photo is transmitted and no generation takes place.
• Images are resized on your device before upload (longest edge 1536 px, maximum 10 MB) so no more data is transmitted or stored than the model needs. EXIF metadata, including any location recorded by your camera, is stripped at the same time and never reaches my backend.
• I do not use your photos to train models, to build advertising profiles, or for any purpose other than producing the try-on you asked for. I do not sell them.

c) Generation processing

Generation runs on Google Cloud Vertex AI (Gemini image models), called from my backend using my own Google Cloud service account. Vertex AI receives the two images and the generation prompt, and returns the resulting image.

Under the Google Cloud terms that apply to Vertex AI, Google processes this data as my processor and does not use it to train its models. Google Cloud's privacy commitments are described at cloud.google.com/terms/cloud-privacy-notice.

d) Style preferences

When you first open the App you may answer a short set of style questions (for example preferred fit or occasion). Your answers are stored on your user profile and used only to shape the generation prompt. You can review and change them at any time in Profile → Style Profile. They are not shared with advertisers.

e) Purchases, subscriptions and credits

Try-ons are paid for with credits. New accounts do not receive free credits. The only way to hold a credit is an auto-renewable subscription — “Plus” or “Pro” — which grants a set allowance of credits for each month of an active subscription. I may also grant promotional credits at my discretion.

Payment is handled entirely by the Apple App Store or Google Play. Subscription state is validated through Adapty (Adapty, Inc.), acting as my processor. Specifically:

• I never receive or store your payment card details. Apple and Google handle the whole payment flow.
• Adapty receives a profile identifier (your Suit AI user ID), the store-issued transaction and receipt data, and basic device information, so it can validate and track your subscription.
• My backend receives the validated subscription status and product identifier from Adapty and grants the corresponding credits. Subscription status is never taken from the app on your device.

f) Advertising identifiers (non-subscribers only)

If you do not have an active subscription, the App shows ads served by Google Mobile Ads (AdMob): a banner on some screens and an occasional full-screen ad between screens. To serve them, the AdMob SDK processes a limited set of data including IP address, coarse location derived from IP, device type and operating system version, language, and ad interaction events such as impressions and clicks.

Suit AI requests non-personalised ads only. The App does not ask for App Tracking Transparency permission and does not use your advertising identifier for ad targeting or cross-app tracking. AdMob never receives your photos, your try-on results, your style profile or your email address. AdMob's own privacy information is at policies.google.com/technologies/ads.

g) Communications with me

If you email me for support, I receive your email address and the content of your message, and use them to reply.

3.2 Information Collected Automatically

Suit AI is built to minimise tracking. The following is processed automatically:

• Try-on job records — a job identifier, your user ID, status and timing information, stored in Firestore so the App can follow a generation in progress and so credits can be held, consumed or refunded correctly.
• Credit ledger — an append-only record of credit grants and consumption, kept so balances can be audited and refunded when a generation fails.
• Server logs — Google Cloud records standard operational logs for my backend functions (timestamps, function name, error traces). These may incidentally contain a user identifier. They are not used for analytics or advertising.
• Advertising data — only for users without a subscription; see Section 3.1(f).

Suit AI does not include an analytics or crash-reporting SDK, and does not track you across other apps or websites.

3.3 Information from Other Sources

I may receive limited information from the app stores (for example subscription status or the aggregate statistics they publish to developers), and from email providers when you contact me. This is used only to operate Suit AI or to answer you.

4. How I Use Your Information

4.1 To Provide and Operate Suit AI

• Create and manage your account.
• Generate virtual try-on results from the images you submit, using Google Cloud Vertex AI.
• Store your wardrobe and the looks you choose to keep.
• Track your credit balance, and hold, consume or refund credits as generations succeed or fail.
• Verify your subscription with the App Store, Google Play and Adapty, and unlock the corresponding features.
• Provide support and answer your questions.

4.2 Administrative and Legal Purposes

• Maintain the stability and security of the App and its backend.
• Detect and prevent misuse, fraud and abuse, including attempts to obtain credits by means other than a subscription.
• Diagnose and fix technical problems.
• Keep records needed for accounting and legal compliance, and respond to lawful requests.

4.3 Advertising

Ads fund the free use of the App. I:

• do not use your photos, results, style profile or email address to target ads;
• request non-personalised ads only, on both platforms;
• do not sell your personal information to advertisers;
• do not show ads to users with an active subscription.

If I ever want to use your information for a purpose not described here, I will tell you in advance and, where the law requires it, ask for your consent.

5. How I Disclose Your Information

I do not sell your personal data. I share it only where necessary to run the Services or to comply with the law.

5.1 Service Providers

Each provider receives only what it needs:

• Google Firebase (Google LLC) — Authentication (accounts and sign-in), Firestore (user profile, style profile, wardrobe records, saved looks, credit balance and ledger, subscription entitlement, try-on job records), Cloud Storage (garment images, try-on results, and your photo of yourself for the short period during which it is being processed) and Cloud Functions (job creation, generation, account deletion).
• Google Cloud Vertex AI (Google LLC / Google Cloud EMEA) — runs the generation model. Receives the two images and the generation prompt for a single request; receives no account email. Does not use the data to train models.
• Adapty (Adapty, Inc., United States) — subscription management and server-side receipt validation. Receives your Suit AI user ID, store transaction and receipt data, and basic device information.
• Google Mobile Ads / AdMob (Google LLC) — serves ads to users without a subscription. Receives IP address, coarse location, device and OS information and ad interaction events. Receives no photos, results, style profile, email address or user ID.
• Apple (Apple Inc.) — Sign in with Apple and App Store subscription billing.
• Google (Google LLC) — Sign in with Google and Google Play subscription billing.
• Telegram (Telegram Messenger Inc.) — I use the Telegram Bot API to receive operational alerts, for example when a subscription is purchased or an account is deleted. An alert contains an event type and a user identifier. It never contains your photos, your results or your email address.
• Email providers — used to send and receive support email.

These providers act on my instructions, or, for limited purposes such as payment processing, as independent controllers. They may use your data only to perform services for me or to meet their own legal obligations.

5.2 Legal and Safety

I may access or disclose information where reasonably necessary to comply with law or legal process, respond to valid requests from authorities, protect the rights, property or safety of myself, users or others, or detect and prevent fraud and security problems.

5.3 Business Changes

If Suit AI or its assets are transferred, for example in a sale or merger, your information may form part of that transfer as permitted by law. You will be informed of any major change to how your data is handled.

6. Your Privacy Choices and Rights

6.1 Your Choices

• Delete your account, in the App: open Profile → Delete Account. This removes your Firebase Auth user, user profile, style profile, wardrobe (records and image files), saved looks, credit balance and ledger, and subscription record, via a server-side function. Subscriptions are billed by Apple or Google and must be cancelled separately in your store settings — deleting your Suit AI account does not cancel an active subscription.
• Delete individual content: you can remove any garment from your wardrobe, or any saved look, at any time. Removing a garment deletes its image file from storage as well as the record.
• AI processing consent: the App asks for your explicit consent before the first photo is sent for generation, and names Google as the recipient. If you decline, nothing is transmitted.
• Advertising: ads are non-personalised regardless of your device settings. You can also reset or limit your device advertising identifier in your device's privacy settings. Subscribing removes ads entirely.
• Subscription: cancel at any time in your App Store or Google Play subscription settings. Cancelling stops future billing; access continues to the end of the current period.
• Your photos: you choose which photos to upload, and your photo of yourself is deleted after the generation regardless. Results you save to your device's photo library are then managed by you.

I do not respond to “Do Not Track” browser signals: Suit AI is a native mobile app and does not use web tracking.

6.2 Your Rights Under GDPR and Similar Laws

If you are in the European Economic Area, Switzerland, the United Kingdom, or another region with comparable law, you may have the right to:

• Access — know whether I process your personal data, and receive a copy.
• Correction — have inaccurate or incomplete data corrected.
• Erasure — have your personal data deleted in certain circumstances.
• Restriction — have processing restricted under certain conditions.
• Objection — object to processing based on legitimate interests, including direct marketing (I do not use your data for direct marketing).
• Portability — receive your data in a structured, commonly used, machine-readable format.
• Withdraw consent — where processing rests on consent, withdraw it at any time, without affecting processing that has already happened.

You may also lodge a complaint with a data protection authority (Section 15). To exercise any right, contact me using the details in Section 16.

7. Security of Your Information

I take reasonable technical and organisational measures to protect your data. In particular:

• Storage and database rules deny access by default; each user can read and write only their own files and records.
• Credit balances, the ledger, subscription entitlements and job records are writable only by my backend, never by the app on your device.
• Your identity is taken from a verified authentication token on every backend call, never from data sent by the client.
• All traffic between the App, my backend and its providers is encrypted in transit.

No system is completely secure, and I cannot guarantee absolute security. If I become aware of a security incident involving your personal data, I will notify you and the relevant authorities where the law requires it.

8. International Data Transfers

I am based in Austria (EU). Depending on the provider, your data may be processed or stored outside the European Economic Area, including in the United States.

Where that happens, I rely on suitable safeguards, such as the EU Commission's Standard Contractual Clauses or another mechanism permitted by data protection law.

9. Retention of Personal Information

I keep personal data only as long as reasonably necessary to provide the Services, maintain your account and subscription, comply with legal obligations, and resolve disputes. In practice:

• Your photo of yourself — deleted as soon as the try-on job finishes, in success and in failure. Jobs that stall are cleaned up automatically and their photo deleted with them. Typical lifetime is under a few minutes.
• Garment images and saved looks — kept until you delete them or delete your account.
• Account data (auth record, user profile, style profile, credit balance and ledger, subscription entitlement, job records) — kept while your account is active.
• Adapty — retains subscription state for the life of the subscription and as needed for refunds, restores and tax or accounting obligations.
• AdMob — retains advertising and aggregate event data under Google's own policies.
• Server logs — retained under Google Cloud Logging's default retention (typically 30 days).

If you delete your account in the App, your auth record, profile, wardrobe, looks, credits and job records are deleted from my backend. I may retain limited information where I am legally required to, for tax, accounting or fraud-prevention reasons.

10. Supplemental Notice for California Residents

To the extent the CCPA/CPRA applies to you:

• I do not sell your personal information.
• I do not share your personal information for cross-context behavioural advertising; ads served in the App are non-personalised.
• You have rights of access, deletion, correction and non-discrimination, as described above and in applicable law.

To exercise a California-specific right, contact me as described in Section 16.

11. Supplemental Notice for Nevada Residents

I do not sell personal information as “sale” is defined under Nevada law. You may still request to opt out of any potential future sale by contacting me with the subject line “Nevada Do Not Sell Request”.

12. Supplemental Notice for Virginia Residents

If the Virginia Consumer Data Protection Act applies: I do not sell your personal data, and I do not use it for targeted advertising. You have rights to access, correct, delete, obtain a copy of your data, and opt out of certain processing. Contact me to exercise them.

13. Children's Information

Suit AI is not directed to children under 16, or a different minimum age where local law requires one, and I do not knowingly process children's personal information. If you believe a child has provided me with personal data without appropriate consent, please contact me and I will delete it promptly where the law requires.

14. Third-Party Websites and Applications

The App and this site may link to third-party services, such as app store pages. I do not control them and am not responsible for their privacy practices. Review their policies before using them.

15. Supervisory Authority

If you are in the European Economic Area, Switzerland or the United Kingdom, you have the right to complain to a data protection authority. As I am based in Austria, my lead supervisory authority is:

Austrian Data Protection Authority (Datenschutzbehörde)
www.dsb.gv.at · dsb@dsb.gv.at

You may also contact the authority in your own country of residence.

16. Contact Me

For any question about this Privacy Notice, or to exercise a privacy right:

Developer: Ali Kömürcü
Email: alikomurcu.dev@gmail.com

Please state clearly what you are asking for — for example an access request, a deletion request, or a general question.