ClothMatics Privacy Policy & DPDP Disclosures

1. Definitions

1.1 “Account” means a registered account through which a User accesses the Services.

1.2 “AI Improvement” means an optional programme, where made available, under which eligible Source Media is processed for evaluating, developing, testing, enhancing, or improving ClothMatics artificial-intelligence and image-processing functionality.

1.3 “Applicable Law” means any law, regulation, binding governmental direction, or enforceable legal requirement applicable to the relevant processing or use of the Services, including applicable Indian data-protection requirements under the Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025.

1.4 “Data Fiduciary” means the operating service (ClothMatics, legal entity incorporation in progress) responsible for determining the purpose and means of personal data processing under Indian law.

1.5 “Data Principal” means the individual to whom the Personal Data relates.

1.6 “Personal Data” means any data about an individual who is identifiable by or in relation to such data, to the extent treated as personal data under Applicable Law.

1.7 “Service Provider” means a third party or Data Processor engaged to process information or perform services as reasonably necessary for the operation, security, support, or provision of the Services.

1.8 “Services” means the ClothMatics mobile application, website, authenticated wardrobe service, support facilities, and related features made available from time to time.

1.9 “Source Media” means a photograph, video, or other eligible media item collected specifically for AI Improvement pursuant to an applicable disclosure and consent process. Source Media does not include ordinary Wardrobe Content solely because it contains an image.

1.10 “User” or “you” means an individual who accesses or uses the Services.

1.11 “User Content” means information, text, images, media, selections, feedback, or other content submitted, selected, generated, or saved by a User through the Services.

1.12 “Wardrobe Content” means User Content intentionally uploaded, selected, extracted, or saved as part of a User's digital wardrobe, including garment images, attributes, outfits, plans, and related records.

2. Scope, Application & DPDP Act Fiduciary Role

2.1 This Privacy Policy applies to Personal Data processed by ClothMatics in connection with the Services. It applies to the mobile application, public website, authenticated web wardrobe, account-deletion and support facilities, and administrative operations relating to the Services.

2.2 ClothMatics processes Personal Data subject to Applicable Law, including mandatory requirements under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 as and when legally effective. For the purposes of Indian law, ClothMatics acts as a Data Fiduciary (non-significant fiduciary classification).

2.3 This Privacy Policy does not govern independent third-party services reached through external links. Such external services are governed by their respective privacy terms.

3. Categories of Personal Data & Minimisation Practices

In accordance with data minimisation principles under Section 6 of the DPDP Act, ClothMatics limits personal data collection strictly to what is necessary for the specified purposes:

3.1 Account and identity data: Sign-in credentials, registered email address, display name, and avatar image URL.

3.2 Profile and preference data: Self-reported styling dimensions including height, weight, body type, gender, profession, city, clothing sizes, style direction, and colour preferences.

3.3 Strict Age Minimisation (Section 9 Compliance): To comply with Section 9 of the DPDP Act prohibiting the processing of children's data without parental consent, the application asks for date of birth solely client-side to calculate whether the user is 18 years of age or older. Your raw date of birth is never transmitted to or stored on our servers. Only an adulthood verification record (isAdult: true) and verification timestamp are recorded.

3.4 Wardrobe and styling data: Garment photographs, derived background-removed cut-outs, clothing category, colour, pattern, material, brand, season, tags, saved outfits, packing lists, wear logs, and style feedback.

3.5 Media and camera data: Photographs intentionally selected from device gallery or captured via device camera for wardrobe digitisation or styling checks. Media not explicitly selected is never accessed or collected.

3.6 Notification data: Device notification push tokens, operating system version, and user notification preference toggles.

3.7 Consent history records: Verifiable consent history records including consent version, unbundled consent choices (core storage, artificial intelligence, marketing communications), IP address at consent, and timestamps required for legal auditability.

4. Collection and Purposes of Processing

4.1 Unbundled Consent: ClothMatics complies with Section 6 of the DPDP Act by offering unbundled, purpose-specific consent choices. Consent for auxiliary purposes is never bundled as a take-it-or-leave-it prerequisite for basic wardrobe functionality.

4.2 Purposes: Personal Data may be processed for the following specified purposes:

1. Core Wardrobe Operations (Required): Authenticating accounts, synchronising wardrobe items across devices, storing garment attributes, generating digital lookbooks, and executing user rights requests.
2. Artificial Intelligence Styling & Scoring (Optional): Providing automated outfit recommendations, styling analysis, colour matching, and garment classification. Users may withdraw this consent at any time without losing basic wardrobe storage.
3. Marketing & Styling Push Notifications (Optional): Sending daily outfit inspirations, seasonal reminders, and promotional announcements. Users can toggle this off independently.
4. Audit & Legal Compliance: Maintaining verifiable consent records, ensuring application security, preventing fraudulent access, and fulfilling statutory requirements under Applicable Law.

5. Device permissions

5.1 Camera. Camera access may be requested when a User chooses to photograph a garment, outfit, possible purchase, or selfie for an applicable feature.

5.2 Photos and media. Photo or video access may be requested to select media, save expressly requested output, or, where separately enabled, identify and process eligible media for a disclosed gallery or AI-related function.

5.3 Location. Foreground location access may be requested to obtain current weather or location-relevant styling information. A User may instead be able to enter location-related information where the relevant feature permits.

5.4 Notifications. Notification permission may be requested for wardrobe reminders, challenge information, service communications, offers, billing-related notices, or other enabled notification categories.

5.5 Permissions remain subject to operating-system controls and User choices and may generally be changed through device settings. Granting a device permission does not by itself constitute consent to a separate or unrelated processing purpose.

6. Artificial-intelligence processing

6.1 ClothMatics may use automated systems and artificial intelligence for garment recognition, garment extraction, classification, wardrobe organisation, outfit generation, styling recommendations, packing assistance, purchase comparison, personalisation, and analysis of User-submitted content.

6.2 An AI request may process the User's prompt, transparent garment cut-out, style profile, relevant Wardrobe Content, occasion, or weather. Where hardware permits, garment background cutting is executed directly on the user's device. When cloud assistance is required, images are transmitted ephemerally to secure computational processors and discarded immediately after processing.

6.3 AI-generated outputs are automated and informational in nature. They may be probabilistic and may contain errors, omissions, or inaccuracies. ClothMatics does not warrant that an AI output will be suitable or appropriate for every circumstance.

7. Optional AI Improvement and Source Media

7.1 Where ClothMatics makes AI Improvement available, participation shall be optional and subject to any consent required under Applicable Law. Ordinary acceptance of the Terms, use of Wardrobe Content, or grant of a device gallery permission shall not by itself constitute blanket consent to AI Improvement.

7.2 Following the applicable disclosure and consent, eligible Source Media may be processed for evaluating, developing, testing, enhancing, and improving garment recognition, classification, extraction, image processing, styling systems, and related ClothMatics artificial-intelligence functionality.

7.3 Subject to Applicable Law and any lawful retention requirement, raw Source Media collected specifically for AI Improvement is scheduled for deletion no later than ninety (90) days following collection and may be deleted earlier where it is no longer reasonably required for the applicable purpose.

7.4 A User may withdraw consent to AI Improvement in accordance with the mechanism made available for that programme or through the contact mechanism in Clause 18. Following effective withdrawal, future collection for that purpose will cease. ClothMatics will initiate the applicable deletion process without undue delay and ordinarily seeks to complete deletion of applicable raw Source Media within seven (7) days following effective withdrawal, subject to technical, legal, and regulatory requirements.

7.5 Withdrawal from AI Improvement does not automatically delete Wardrobe Content independently retained to provide the Services. A User may separately delete applicable Wardrobe Content through available product controls or request Account deletion under Clause 12.

8. User Content and digital wardrobe

8.1 Wardrobe Content intentionally uploaded, selected, extracted, or saved by a User may be stored and processed to provide, maintain, synchronise, secure, and support the relevant Services.

8.2 Wardrobe Content may be retained for so long as reasonably necessary to provide the relevant Services, maintain the Account, comply with Applicable Law, resolve disputes, enforce applicable agreements, or until deletion is initiated by the User, subject to applicable retention requirements.

8.3 The ninety-day period in Clause 7.3 applies only to raw Source Media collected specifically for AI Improvement. It does not apply to ordinary Wardrobe Content, saved garment images, outfits, or media retained at the User's direction as part of the Services.

8.4 Users should not submit images or information concerning another person without lawful authority or any required permission.

9. Disclosure and Service Providers

9.1 Data Processors: ClothMatics engages carefully vetted Service Providers acting strictly as Data Processors under contractual safeguards compliant with Section 8 of the DPDP Act:

9.2 Personal Data may be disclosed where reasonably necessary to comply with Applicable Law, lawful court process, or statutory directions from competent regulatory authorities.

9.3 ClothMatics does not sell Personal Data and does not grant third parties a right to sell Users' private photographs.

10. Retention & Automated Purge Schedules

10.1 Active Account Data: Personal Data, wardrobe items, and photos are retained while your Account remains active to provide continuous synchronisation and styling features.

10.2 Erasure Upon Account Deletion: Upon receiving a validated account deletion request (either in-app or via our grievance channel), all personal profile records, wardrobe items, and uploaded images are permanently deleted within 15 days.

10.3 Security & Processing Logs: Operational audit and security logs (which contain no photos or personal styling content) are retained for 12 months as required under applicable Indian cybersecurity frameworks, and are automatically purged from active databases after 13 months.

11. Consent & Withdrawal

11.1 Under Section 6(4) of the DPDP Act, you have the statutory right to withdraw your consent at any time, with the ease of withdrawal being comparable to the ease of giving consent.

11.2 You may withdraw consent for optional AI styling or marketing push notifications at any time directly through the mobile application under Profile > Settings > Privacy & Data. Withdrawal does not affect the lawfulness of processing undertaken prior to withdrawal.

12. Account and data deletion

12.1 In-App Deletion: Users may initiate permanent account and data deletion at any time within the application via Profile > Settings > Privacy & Data > Delete my account.

12.2 Public Web Deletion Request: If you have uninstalled the application or cannot sign in, you may initiate deletion via the dedicated Account Deletion Page or the public ClothMatics Help and Contact page.

12.3 Deletion Scope: Account erasure permanently deletes authentication credentials, profile data, wardrobe items, clothing photographs, outfits, lookbooks, wear history, and marketing preferences.

13. Security safeguards

13.1 In accordance with Section 8(5) of the DPDP Act, ClothMatics maintains reasonable security safeguards to protect personal data and prevent personal data breaches.

13.2 Technical Safeguards: Measures include HTTPS/TLS transmission encryption, encrypted object storage at rest, automated stripping of camera EXIF/GPS metadata from photos prior to cloud upload, strict user-level access isolation, and token-based API authentication.

13.3 Breach Notification: In the unlikely event of a personal data breach impacting your data, ClothMatics will notify the Data Protection Board of India (DPBI) and affected Data Principals without undue delay in the prescribed statutory form.

14. User rights under the DPDP Act

Under Chapter III of the Digital Personal Data Protection Act, 2023, Data Principals possess the following enforceable statutory rights:

1. Right to Access Information (Section 11): Right to obtain a summary of personal data being processed and the identities of data processors with whom personal data is shared. You can generate a full machine-readable JSON export directly in-app via the "My data" tool.
2. Right to Correction & Updation (Section 12): Right to view, correct, complete, or update personal information at any time in Profile Settings.
3. Right to Erasure (Section 12): Right to request erasure of your personal data when it is no longer necessary for the purpose for which it was processed.
4. Right of Grievance Redressal (Section 13): Right to have grievances redressed by our designated Grievance Redressal Officer within 15 business days.
5. Right to Nominate (Section 14): Right to nominate an individual who, in the event of death or incapacity, may exercise your data rights on your behalf.

15. Children's Personal Data & Age Verification

15.1 In strict compliance with Section 9 of the DPDP Act, 2023, ClothMatics does not knowingly process, track, or retain personal data of individuals under the age of 18 years.

15.2 Age Verification Mechanism: During account onboarding, users must provide their date of birth. The application calculates the user's age locally on the device. Users under 18 years of age are immediately restricted, signed out, and their authentication record is erased. Only verification status (isAdult: true) is recorded for eligible adults; raw birth dates are discarded.

16. Legal disclosures and interpretation

16.1 ClothMatics may preserve or disclose information where required by a valid legal obligation, court order, governmental request having lawful authority, or as otherwise permitted under Clause 9.

16.2 If a provision of this Privacy Policy conflicts with a mandatory requirement of Applicable Law, the mandatory requirement will prevail to the extent of the conflict. Terms used in Applicable Law will have their statutory meaning where required.

17. Changes & Consent Versioning

17.1 Material changes to data processing activities will be accompanied by an incremented consent version (Current Version: 2026-10-v1). Where required under the DPDP Act, users will be presented with a revised consent notice upon next opening the app.

18. Contact & Grievance Redressal Mechanism

For questions, consent withdrawals, data access requests, or privacy grievances, please contact our support team:

Right to Complain to the Data Protection Board: If your grievance is not resolved to your satisfaction by our Grievance Redressal Officer within the 15-day statutory period, you have the legal right under Section 13(4) of the DPDP Act, 2023 to file a formal complaint with the Data Protection Board of India (DPBI).

पात्रता एवं आयु आवश्यकता (Section 9 Compliance)

ClothMatics केवल 18 वर्ष या उससे अधिक आयु के व्यक्तियों के लिए है। भारतीय कानून (DPDP Act धारा 9) के अनुसार हम 18 वर्ष से कम आयु के बच्चों का व्यक्तिगत डेटा संसाधित नहीं करते हैं। सेटअप के दौरान आपकी जन्म तिथि केवल आपकी आयु (18+) सत्यापित करने के लिए उपयोग की जाती है; जन्म तिथि सर्वर पर कभी संग्रहीत नहीं की जाती।

1. एकत्र किया जाने वाला व्यक्तिगत डेटा

• खाता पहचान: गूगल साइन-इन प्रोफ़ाइल (ईमेल, नाम, प्रोफ़ाइल फ़ोटो)।
• स्टाइल प्रोफ़ाइल: ऊंचाई, वजन, शहर, पेशा, लिंग, और बॉडी टाइप।
• वॉर्डरोब फ़ोटो एवं कपड़े: आपके द्वारा अपलोड की गई कपड़ों की तस्वीरें, श्रेणी, रंग, मौसम और अवसर।
• आउटफ़िट और इतिहास: सहेजे गए आउटफ़िट और पहनने का रिकॉर्ड।
• डिवाइस एवं सहमति डेटा: पुश नोटिफिकेशन टोकन, सहमति विकल्प, और ऑडिट लॉग।

2. डेटा प्रोसेसिंग के उद्देश्य

• आपकी डिजिटल अलमारी (वॉर्डरोब) और आउटफ़िट प्लानर सेवा प्रदान करना।
• व्यक्तिगत स्टाइलिंग सुझाव, आउटफ़िट स्कोर और सुझाव तैयार करना।
• दैनिक आउटफ़िट सुझाव और रिमाइंडर भेजना (केवल आपकी वैकल्पिक सहमति से)।
• भारतीय कानून के तहत कानूनी दायित्वों और सहमति रिकॉर्ड का पालन करना।

3. डेटा प्रतिधारण और हटाना (Retention & Erasure)

आपका व्यक्तिगत डेटा और फ़ोटो केवल तब तक रखे जाते हैं जब तक आपका खाता सक्रिय रहता है। खाता हटाने का अनुरोध करने पर क्लाउड स्टोरेज की सभी तस्वीरें, डेटाबेस रिकॉर्ड और खाता 15 दिनों के भीतर हमेशा के लिए मिटा दिए जाते हैं। सुरक्षा ऑडिट लॉग कानूनन 12 महीने तक रखे जाते हैं और 13 महीने बाद स्वतः नष्ट हो जाते हैं।

4. DPDP अधिनियम के तहत आपके कानूनी अधिकार

• पहुंच का अधिकार (Access): ऐप में "My data" टूल द्वारा अपने सभी डेटा की प्रतिलिपि डाउनलोड करें।
• संशोधन का अधिकार (Correction): अपनी प्रोफ़ाइल जानकारी किसी भी समय संपादित करें।
• मिटाने का अधिकार (Erasure): सेटिंग्स > गोपनीयता और डेटा > Delete my account से अपना खाता मिटाएं।
• सहमति वापस लेने का अधिकार (Withdrawal): किसी भी समय वैकल्पिक सहमतियां (AI, मार्केटिंग) बंद करें।
• शिकायत निवारण का अधिकार (Grievance Redressal): हमारे शिकायत अधिकारी से संपर्क करें।
• नामांकन का अधिकार (Nomination): मृत्यु या अक्षमता की स्थिति में अधिकारों के प्रयोग के लिए व्यक्ति नामित करें।

5. शिकायत निवारण एवं संपर्क (Coming Soon)

यदि शिकायत का समाधान 15 दिनों में नहीं होता है, तो DPDP अधिनियम, 2023 की धारा 13(4) के तहत आपको भारतीय डेटा संरक्षण बोर्ड (Data Protection Board of India - DPBI) के समक्ष औपचारिक शिकायत दर्ज करने का कानूनी अधिकार है।