Privacy Policy
Effective date: 12 October 2026
This policy explains what data LOOM collects, why, who processes it, how long we keep it, and your rights.
1. Who runs LOOM
LOOM is run by Riccardo Pittiglio, Strassergasse 8-12/4/10, 1190 Wien, Austria, as an individual. He decides how your data is used (the "controller"). Contact for anything about your data: [email protected].
2. What we collect
- Account. A random account id. If you sign in with Apple, Google or email: your email address, and the name you share. Google sign-in also gives us the link to your Google profile photo; we store it with your sign-in record and do not show it in LOOM. Your own profile photo is one you choose to add.
- Your closet. Photos of your clothes, the cut-out and display copies we make of them, and what we read from them (type, colour, material, fit).
- Your selfie and Avatar. If you create an Avatar: the selfie you upload and the Avatar made from it. They are used only to make your Avatar and your try-ons. We delete them when you delete them or your account, and automatically after 12 months without using your Avatar.
- Try-on pictures. The pictures made when you try on outfits, and the ones you keep.
- Stylist chats. Your messages to the stylist, photos you send it, and its answers.
- Outfits and wear history. Outfits you plan, wear or save, and the weather and city they were for.
- Location. The city you choose, or your phone's location if you allow it, to get your weather. Before we ask weather services, we round it to about 1 km.
- Purchases. Your subscription and try-on credits: what you bought, when, and how many credits you used.
- Notifications. Your device's notification token, if you allow notifications.
- Usage and errors. Which features you use and when, linked to your account; and crash and error reports, sent without your name or contact details.
- Your two data choices (sections 8 and 9), and when you changed them.
3. Why we use it, and on what legal basis
- To run LOOM for you (Art. 6(1)(b) GDPR, our contract with you): your account, closet, outfits, wear history, location, chats, purchases and notifications. This includes styling you and learning your taste, which is part of the service.
- Your selfie, Avatar and try-ons of your Avatar (Art. 6(1)(a) and Art. 9(2)(a) GDPR, your explicit consent).
- To improve LOOM and fix problems (Art. 6(1)(f) GDPR, our legitimate interest in a working, safe app): usage data and error reports.
- To train AI and to share with brands (Art. 6(1)(a) GDPR, your consent): only if you turn these on (sections 8 and 9).
- To meet legal duties (Art. 6(1)(c) GDPR): for example keeping a record that an account was deleted.
- To tell Apple how a purchase was used when you ask Apple for a refund (Art. 6(1)(b) and (f) GDPR).
4. Where your pictures are kept
Your pictures are stored on Cloudflare R2: the clothes you add and the copies we make of them, your selfie and Avatar, try-on pictures, photos you send the stylist, and your profile photo. Cloudinary holds a few older pictures from before we moved to Cloudflare (garment originals, worn-outfit and try-on pictures and chat thumbnails, about 60 today), and a copy of a new picture only if Cloudflare fails at the moment it is saved. When you delete your account, we delete your pictures from both. Pictures made by FASHN or fal.ai may also stay for a short time on their own servers, which we cannot delete; they expire by themselves.
5. Services that process your data
| Service | What it does for LOOM | What it receives | Where | Safeguard for a transfer outside the EU |
|---|---|---|---|---|
| Supabase | Database, sign-in, server code | Everything in section 2 | Database in the EU (Ireland); company in the US | Standard Contractual Clauses (in its data processing agreement) |
| Cloudflare | Stores and delivers pictures; hosts this website | Your pictures | Global | EU-US Data Privacy Framework; Standard Contractual Clauses as fallback |
| Cloudinary | Older pictures and emergency copies (section 4) | Those pictures | US | EU-US Data Privacy Framework |
| Anthropic (Claude) | Reads your clothes photos, reads photos you send the stylist, writes the stylist's answers | Clothes photos, chat messages and photos, your closet and weather | US | Standard Contractual Clauses |
| FASHN | Makes try-on pictures and your Avatar | Your selfie, Avatar and clothes pictures | UK (company in London); processing in the UK, EU and US | UK adequacy decision; Standard Contractual Clauses for the US |
| fal.ai | Removes picture backgrounds, runs AI Cleanup, helps make your Avatar | Clothes pictures, selfie and Avatar pictures | US | Standard Contractual Clauses |
| OpenAI | The image model behind AI Cleanup (run through fal.ai; directly by OpenAI only as a backup) | The clothes photo being cleaned up | US | Through fal.ai (Standard Contractual Clauses); directly: OpenAI's data processing agreement |
| Apple | Weather and weather warnings (WeatherKit), city search (Apple Maps), Sign in with Apple, notifications, purchases; and, when you ask Apple for a refund, how that purchase was used | Location rounded to about 1 km, city names, your sign-in, your device token, purchase use | US | Apple's own data protection terms |
| Sign in with Google | Your Google sign-in | US | EU-US Data Privacy Framework or Standard Contractual Clauses (Google's controller terms) | |
| Open-Meteo | Air quality, pollen and sea levels on the Forecast screen | Location rounded to about 1 km | Switzerland | Adequacy decision (Switzerland) |
| Google Places | Finds places near you when you ask the stylist for one | Your approximate location and the search | US | Google acts as an independent controller here; EU-US Data Privacy Framework or Standard Contractual Clauses |
| RevenueCat | Handles your purchases and subscription | Your LOOM account id and purchases | US | Standard Contractual Clauses |
| Sentry | Crash and error reports | Error details, without your name or contact details | US | EU-US Data Privacy Framework; Standard Contractual Clauses as fallback |
Weather warnings come from the official agency of each country (for example GeoSphere Austria), passed on by Apple.
6. How long we keep it
- Your selfie and Avatar: until you delete them or your account, and automatically after 12 months without using your Avatar.
- Until you delete your account: your account, closet and its pictures, try-on pictures and kept looks, saved chats, outfits and wear history, purchases, notification token, and your data choices. Deleting your account deletes all of it, including your RevenueCat purchase record.
- Chats you do not save: deleted after 24 hours without activity.
- Usage records of the stylist: 180 days. Cost records: 13 months. Security log: 90 days.
- Weather lookups: kept for minutes, by place only, never with your account.
- One record that an account was deleted, without any name or account id, kept as proof that we deleted it.
7. Sharing
We do not sell your personal data. We do not show ads. We do not use advertising trackers. We share data only with the services in section 5, to run LOOM, and as you choose in sections 8 and 9.
8. Your choice: Train AI (off unless you turn it on)
If you turn on Help Train LOOM's AI, your wardrobe and outfit data and the photos of your clothes may be used to train LOOM's own AI models, by LOOM and by the services that work on LOOM's behalf (section 5). Never anyone else's models. Photos of you (your selfie, your Avatar and try-on pictures) are never used for this.
9. Your choice: Share with brands (off unless you turn it on)
If you turn on Share Anonymous Trends with Brands, de-identified or aggregated wardrobe, outfit and weather data may be licensed to fashion brands and retailers, for money. It never includes your name, your contact details, your exact location or any photo of you. Before anything is shared we will tell you who receives it, and we will ask you again wherever the law requires.
Our promise: we will never try to re-identify anyone from de-identified or aggregated data, and every recipient must promise the same in writing.
About both choices. They are separate, both off until you turn them on, and you can change them at any time in Profile. Neither is active yet: we train no model and share nothing with brands today, and we will tell you before anything is first used or shared. Turning a choice off stops any future use. Data already shared cannot be recalled.
10. Your rights
You can: see the data we hold about you; correct it; delete it (Profile, Delete Account, or ask us); get a copy in a common format to take elsewhere (ask us); object to our use based on legitimate interest; withdraw any consent at any time (it does not affect what was done before); and complain to the Austrian Data Protection Authority (Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, dsb.gv.at) or the authority where you live. Write to [email protected]. We answer within one month.
11. Automated decisions
LOOM makes no decision about you by automated means that has a legal or similarly significant effect. Some limits are applied automatically, for example the stylist's monthly message limit, and refusing to try on shoes or accessories.
12. Changes
We will tell you in the app before a material change to this policy takes effect.