Privacy Policy

1. Introduction

STYLYS ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered outfit recommendation platform and Shopify app.

For store customer data, we act as a data processor on behalf of merchants (data controllers). Merchants are responsible for ensuring they have appropriate legal bases for collecting customer data through our widget.

2. Information We Collect

2.1 Information from Merchants

• Account information (email, business name, contact details)
• Shopify store data (products, inventory, pricing)
• Widget configuration preferences
• Usage analytics and performance metrics

2.2 Information from Store Customers

We do not access Shopify customer records directly. All customer data is collected through our widget interface and includes:

• Email address (voluntarily provided when creating a widget account)
• Name (optional, self-reported)
• Style preferences (colors, fits, occasions)
• Body shape preferences (optional, self-reported)
• Outfit interaction data (views, saves, purchases)
• Quiz responses for personalization

2.3 Automatically Collected Information

• Device and browser information
• IP address and approximate location
• Usage patterns and interaction data
• Cookies and similar tracking technologies

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 Customer Service

• Respond to support inquiries and troubleshoot issues
• Provide customer support via our support chat and ticketing system

3.2 App Functionality

• Authenticate widget accounts (email and password)
• Manage subscription access and feature gating based on your Shopify plan
• Sync product catalogs from your Shopify store
• Ensure security and prevent fraud

3.3 Analytics

• Measure recommendation performance and accuracy
• Track sync history and widget metrics
• Analyze usage patterns to improve our platform

3.4 Personalization

• Generate AI-powered outfit recommendations based on style preferences
• Customize the shopping experience using quiz responses and saved preferences
• Improve our AI algorithms and recommendation accuracy

We do not use customer data for marketing or advertising purposes.

4. Data Sharing and Disclosure

We do not sell your personal information. We may share data with:

• Service Providers: Cloud hosting, analytics, and AI processing services
• Shopify: As required for app functionality and compliance
• Legal Requirements: When required by law or to protect our rights
• Business Transfers: In connection with mergers or acquisitions

5. Data Security

We implement industry-standard security measures to protect your personal information, including:

• Encryption in transit: All data is transmitted using TLS 1.2 or higher
• Encryption at rest: Stored data is encrypted using AES-256
• Multi-tenant isolation: Row-level security (RLS) policies ensure strict data separation between merchants
• Data masking: Masked database views prevent bulk exposure of sensitive information such as email addresses
• Password security: Customer widget passwords are hashed using bcrypt
• Function logging: Backend function activity is captured in Supabase's built-in function logs

While no method of transmission over the Internet is 100% secure, we continuously review and improve our security practices.

6. Data Retention

We retain your information for as long as your account is active or as needed to provide services. Merchants can request data deletion at any time.

Upon app uninstallation, all merchant and associated customer data is permanently deleted in response to Shopify's shop/redact webhook. Individual customer data is deleted upon receiving a customers/redact request from Shopify.

7. Your Rights

Depending on your location, you may have the following rights:

• Access: Request a copy of your personal data
• Correction: Update or correct inaccurate data
• Deletion: Request deletion of your personal data
• Portability: Receive your data in a portable format
• Opt-out: Decline certain data collection practices
• Do Not Sell My Information: Request that we do not sell your personal information (we never do)

8. GDPR Compliance

For users in the European Economic Area (EEA), we process personal data based on legitimate interests, consent, or contractual necessity. You have the right to lodge a complaint with a supervisory authority.

9. CCPA Compliance

California residents have specific rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information is collected, the right to delete personal information, and the right to opt-out of the sale of personal information. We do not sell personal information.

10. Shopify Compliance

We comply with Shopify's mandatory data protection requirements for apps. Specifically:

• We handle customers/data_request webhooks to provide customer data reports within 30 days
• We handle customers/redact webhooks to permanently delete individual customer data upon request
• We handle shop/redact webhooks to purge all merchant and customer data upon app uninstallation

All compliance webhooks are verified using HMAC signatures to ensure request authenticity.

11. No Sale of Personal Information

We never sell, rent, or trade your personal information to third parties for monetary or other valuable consideration. This applies to all users, including merchants, their customers, and visitors.

12. Cookies

We use essential cookies and local storage for authentication and session management.

13. Children's Privacy

Our services are not directed to individuals under 16 years of age. We do not knowingly collect personal information from children.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date.

15. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at: