Privacy Policy

This policy explains how CloZ handles personal data when you use CloZ.me. The controller within the meaning of Article 4(7) GDPR is:

To be completed before launch: the operator's legal name, full postal address (a P.O. box is not sufficient), and a contact email address. Once the business is registered, add the commercial register court and number and the VAT identification number. German law (§5 DDG) requires these details for a commercial website.

We have not appointed a data protection officer. If that changes, the contact details will be published here.

Account details. When you register we process your email address and, if you provide them, your first and last name and gender. You can sign in either with a password or with your Google account; if you use Google, we receive your email address and basic profile information from Google.

Avatar attributes. To build and dress your avatar we process the body type, clothing size, height, skin colour and gender you select. These relate to your physical characteristics, so we treat them as personal data even though you choose them yourself.

Face photos (optional). If you use the custom head feature, you take or upload three photos of your face. They are transferred directly from your browser to our storage provider and are used solely to generate a three-dimensional head for your avatar. This feature is entirely optional and the rest of CloZ works without it. We do not use these photos to recognise or identify you, we do not match them against any other person, and we do not use them to train general-purpose models.

Activity in the app. We store the items you save or add to your wishlist and a history of the garments you have tried on, so that your wardrobe is still there when you come back.

Support requests. The support form sends us your message and, optionally, your name and email address so we can reply. The form is protected by Google reCAPTCHA Enterprise, which analyses interaction data to distinguish people from automated abuse.

Analytics. With your consent we use Google Analytics 4 to understand how many people visit CloZ, which pages they land on and which sites or campaigns brought them here. Analytics cookies are only set after you accept; if you decline, Google Analytics stores nothing on your device. You can change your choice at any time in section 8 below.

Some information is kept in your browser rather than on our servers. A sign-in session cookie keeps you logged in. Local storage holds your theme preference, your analytics choice, a cached copy of your wear history so the app works offline, an unsent support message so it is not lost, and a reference to your most recent head scan so it can be reused.

Only the analytics entries require consent. The others are necessary for features you have asked for, and CloZ cannot function correctly without them.

We process your account details, avatar attributes and in-app activity to provide the service you signed up for (Article 6(1)(b) GDPR). We process face photos and analytics data on the basis of your consent (Article 6(1)(a) GDPR), which you may withdraw at any time with effect for the future. We use reCAPTCHA to keep the support form usable and to prevent abuse, which is our legitimate interest (Article 6(1)(f) GDPR).

We use service providers who process personal data only on our instructions: Vercel for hosting the website, Render for our application backend, Cloudflare for delivering images and 3D models, and Google for sign-in, reCAPTCHA and analytics.

Some of these providers are based in the United States or may process data there, which means your data can be transferred outside the European Economic Area. Such transfers are safeguarded by the European Commission's standard contractual clauses or, where applicable, the EU-US Data Privacy Framework.

To be confirmed before launch: the storage provider used for face photos, the hosting region of the backend, and that a data processing agreement is in place with each provider listed above, including Google's Data Processing Terms for Analytics.

We keep your account and the avatars, wishlist and history attached to it for as long as your account exists. If you delete your account, the associated data is deleted with it.

To be completed before launch: how long face photos are retained after a head has been generated, how long support correspondence is kept, and any period for which data is held in backups after deletion.

Under the GDPR you have the right to access your data (Article 15), to have inaccurate data corrected (Article 16), to have data erased (Article 17), to restrict processing (Article 18), to receive your data in a portable format (Article 20), and to object to processing based on legitimate interests (Article 21). Where processing rests on consent, you can withdraw it at any time without affecting the lawfulness of what happened before.

To exercise any of these rights, contact us using the details in section 1 or through our support page. You also have the right to lodge a complaint with a data protection supervisory authority in the EU member state where you live or work.

You can change whether Google Analytics runs at any time. Turning it off takes effect immediately and removes the consent that allows analytics cookies to be set.

We may update this policy as CloZ develops. The date at the top of the page always reflects the current version, and material changes will be highlighted in the app.