Who we are
Algodón is a personal wardrobe app. It is run by [TODO: company legal name] (company number [TODO: company number]), whose registered address is [TODO: registered address]. In this policy "we", "us" and "our" mean that company. We are the controller of the personal data described here, which means we decide how and why it is used. Our ICO registration number is [TODO: ICO registration number].
If you have any question about this policy or your data, you can write to us at hello@algodon.app. [TODO: confirm privacy contact email].
What we collect
When you create an account we collect your email address. If you sign in with Google or Apple, we receive your email address and, depending on what you allow, your name and profile picture from that provider. We never see your Google or Apple password, and if you sign up with email your password is stored only in hashed form by our database provider.
When you use the app we store the things you add to it. That includes your clothing items and their photos, outfits, planned outfits, wear logs, trips and packing lists, and the outfit suggestions we generate for you. This content is private to your account and other users cannot see it.
We also store your settings, such as your timezone, your email preferences and your subscription plan. If you choose to share your location, we use it to show the local weather. If you don't, we estimate your town from your IP address on our server so we can still show a forecast.
If you send us feedback or answer an in-app survey, we keep what you wrote alongside your account. If you subscribe to Plus, our payment provider Stripe collects your card details. We only receive a customer reference, your plan and its renewal date, never your full card number.
If you accept analytics cookies, we record how the app is used, for example which pages are opened and which features are tapped. These events are linked to your account ID or to a random session ID, never to your name or email address, and they are stored in our own database rather than with a third-party analytics company. If you arrived through one of our campaign links, we also record that visit, the referring page and your browser type.
How we use your data and our lawful bases
UK data protection law requires us to have a lawful basis for each way we use your data. We rely on the following bases.
- We use your account details, wardrobe content and settings to provide the service you signed up for. The lawful basis is the performance of our contract with you.
- We send your item photos and wardrobe details to an AI model so it can identify clothing and suggest outfits. This is part of the service, so the lawful basis is also our contract with you.
- We send account emails such as sign-up confirmation and password resets as part of our contract with you. We send reminders, weekly summaries, product tips and occasional product updates because we have a legitimate interest in helping you get value from Algodón, and you can switch each of these off in your profile.
- We take payments and keep billing records to fulfil your subscription and because tax law requires us to keep those records.
- We collect analytics and error reports only if you accept them in the cookie banner. The lawful basis is your consent, and you can withdraw it at any time.
- We keep basic logs to keep the service secure and to prevent abuse. The lawful basis is our legitimate interest in running a safe service.
We do not sell or rent your personal data, we do not show third-party advertising, and we do not use your data to make decisions that have legal or similarly significant effects on you.
Who processes data for us
We use a small number of service providers, known as processors, to run Algodón. They process your data only on our instructions and under a data processing agreement.
- Supabase stores our database, sign-in system and photo storage. We access it through Lovable Cloud. [TODO: confirm the Supabase project region, ideally an EU or UK region.]
- Lovable provides our hosting platform, our AI gateway and our email delivery service. Our emails are sent from notify.algodon.app through Lovable Emails.
- Google processes your photos and wardrobe details through its Gemini AI models, which we reach through the Lovable AI gateway. Google also provides "Sign in with Google" if you choose to use it, and the web fonts our pages load. [TODO: confirm in writing whether images sent through the gateway are retained or used for model training, and state the answer here.]
- Apple provides "Sign in with Apple" if you choose to use it.
- Cloudflare runs our website and app on its global network and therefore handles your IP address and the requests your browser makes.
- Stripe processes payments for Plus subscriptions.
- Sentry receives error reports from the app, with your account details removed, but only if you accept analytics cookies. [TODO: confirm whether our Sentry project uses its EU (de.sentry.io) or US region.]
- Open-Meteo provides weather forecasts. Your browser sends it approximate coordinates, and it can see your IP address.
- ipapi.co estimates an approximate location from your IP address, and OpenStreetMap's Nominatim service turns coordinates into a town name. Both lookups are made from our server, not from your browser.
Our product analytics are first-party. They are stored in our own Supabase database and are not shared with any analytics or advertising company.
International transfers
Some of our providers, including Google, Cloudflare, Stripe and Apple, are based in the United States or process data there. When your data leaves the UK we make sure it is protected, either because the destination is covered by UK adequacy regulations (such as the UK Extension to the EU-US Data Privacy Framework for certified companies) or because we have the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses in place with the provider. You can ask us for more detail about these safeguards.
How long we keep your data
We keep your account and wardrobe content for as long as your account is open. When you delete your account, we delete your profile, items, photos, outfits, plans, wear logs, feedback and survey answers straight away. Copies in our provider's backups are overwritten on their normal cycle. [TODO: confirm the backup retention period with Supabase and state it here.]
When you delete your account we keep analytics events, but we remove your account ID from them so they can no longer be linked to you. [TODO: set and state a maximum retention period for analytics events, for example 26 months.] We keep records of the emails we sent you and any bounce or complaint for as long as we need them to protect our email delivery. We keep billing records for six years because UK tax law requires it. The campaign cookie described below expires after 30 days.
Cookies and similar storage
We use a few strictly necessary items of browser storage that the app needs to work, and we do not ask for consent for these. They keep you signed in, remember your cookie choice, remember small things such as banners you've dismissed or a packing list you're working on, and let the app load faster and work offline through a service worker.
We also use optional analytics storage, and we only switch it on if you click "Accept" in the cookie banner. Until you do, no analytics events are recorded, no error reports are sent and none of the following is stored on your device.
- The "algodon_campaign" cookie remembers which campaign link first brought you to us, so we can tell which campaigns lead to sign-ups. It lasts 30 days.
- A random session ID in your browser's session storage groups the analytics events from one visit together. It is deleted when you close the tab.
- A small flag in your browser's local storage stops us counting your first saved item more than once.
- Sentry, our error-reporting tool, runs only after you accept.
You can change your mind at any time by choosing at the bottom of our pages or in your profile. If you reject or withdraw consent, we stop collecting analytics and delete the optional storage listed above from your browser.
Your rights
Under UK data protection law you have the following rights over your personal data.
- You can ask for a copy of the data we hold about you.
- You can ask us to correct data that is wrong or incomplete.
- You can ask us to delete your data.
- You can ask us to restrict how we use your data while a concern is looked into.
- You can object to us using your data on the basis of our legitimate interests, including for any product emails.
- You can ask for the data you gave us in a portable, machine-readable format so you can take it elsewhere.
- Where we rely on your consent, you can withdraw it at any time without affecting what we did before.
To use any of these rights, email us at hello@algodon.app. We will reply within one month, and we may ask you to confirm your identity first. There is no charge in most cases.
Deleting your account and getting a copy of your data
You can download a copy of your wardrobe data at any time by opening Profile and choosing "Download my data". If you would like a fuller copy, including your account details, feedback and analytics events, you can email us to request it.
You can delete your account yourself by opening Profile and choosing "I want to delete my account". This removes your wardrobe, photos and sign-in straight away. If you would rather we did it for you, you can email us to request deletion from the address on your account and we will confirm once it is done. If you subscribe to Plus, please ask us to cancel your subscription before you delete your account, because deleting the account does not yet cancel billing automatically.
Complaints
If you are unhappy with how we have handled your data, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk/make-a-complaint or by phone on 0303 123 1113.
Children
Algodón is not intended for children under 13, and we do not knowingly collect data from them. If you believe a child under 13 has created an account, please contact us and we will delete it.
Changes to this policy
We will update this policy when the way we handle data changes. If a change is significant, we will tell you by email or in the app before it takes effect. The date at the top of this page shows when it was last updated.