Privacy Policy

1. Who is responsible for your data

Augado EOOD (“Augado”, “we”, “us”), registered in Bulgaria [[TODO: registered address and company number]], is the controller of personal data processed through the Saya app and website. Contact: privacy@saya.ai [[TODO: confirm privacy contact and whether a DPO or EU/UK representative is needed]].

2. What we collect

• Photos for virtual try-on. Images you choose to upload so we can generate try-on previews.
• Onboarding answers and preferences. Your style preferences, answers to the style quiz and similar information you give the stylist.
• Wedding details. Your wedding date and related planning information you enter. [[TODO: list the exact planning fields the app stores]]
• Purchase status. Whether you have an active subscription or trial, managed through RevenueCat and the App Store or Google Play. We do not receive your payment card details.
• Usage analytics. How the app and website are used (screens, features, and events), the app version and device type, collected through PostHog. [[TODO: confirm the exact analytics the mobile app sends, and whether IP addresses are discarded]]
• Contact and support. Your email address and message if you write to us. [[TODO: confirm whether the app has accounts and which sign-in data is stored]]

3. Links, website visits and cookies

The website does not use analytics cookies. Website analytics run without cookies or local storage, so each visit is anonymous and cannot be linked to a previous visit.

When you open one of our short links (for example from a TikTok or Instagram bio), we record that the link was used, the platform (iOS, Android or other), the type of in-app browser, your country (from the hosting provider's location header) and any campaign tags in the link. We do not store your IP address and we do not fingerprint your device. We set one first-party cookie, saya_aid, containing a random identifier for up to 90 days so we can tell how often a link is used. It is not linked to your identity. [[TODO: confirm this cookie is acceptable without a consent banner, or switch it off with SAYA_ANON_COOKIE=0]]

4. Why we use it and our legal bases

• To provide the Service: generate try-on previews and style recommendations, run your subscription (contract).
• To understand and improve the product and measure marketing: analytics and link attribution (legitimate interests; consent where the law requires it).
• To support you and keep the Service secure: replying to messages, preventing abuse (legitimate interests).
• To meet legal obligations such as tax and accounting records.

[[TODO: legal review of lawful bases, in particular for processing photos]]

5. Who we share data with

We do not sell personal data. We use the following service providers (processors):

• PostHog: product and website analytics [[TODO: data region (US or EU)]].
• RevenueCat: subscription and purchase status.
• AI image and language providers: your photos and prompts are sent to generate try-on images and styling replies [[TODO: name the providers actually used by the mobile app and their retention terms]].
• Hosting and storage: where the app and your data are hosted [[TODO: name hosting and database providers and regions]].

Apple and Google process your payments and are independent controllers under their own privacy policies. We may also disclose data where the law requires it.

6. How long we keep it

• Try-on photos and generated images: [[TODO: retention period for photos in the mobile app. The old website policy said 30 days; confirm what is implemented]]
• Account and planning data: until you delete your account, then removed within [[TODO: deletion timeframe]].
• Analytics: [[TODO: PostHog retention setting]]
• Purchase and tax records: as long as the law requires.

7. Deleting your data

You can delete your account and data in the app, or ask us to by email. See Delete your account for the steps.

8. Your rights (UK and EU GDPR)

You can ask us to:

• give you a copy of your data (access) and in a portable format;
• correct inaccurate data;
• delete your data;
• restrict or object to certain processing, including processing based on legitimate interests;
• withdraw consent at any time where we rely on it.

Email privacy@saya.ai. We reply within one month. You can also complain to your data protection authority: in the UK the Information Commissioner's Office (ico.org.uk), and in Bulgaria the Commission for Personal Data Protection (cpdp.bg).

[[TODO: US state privacy rights (for example California) and how they are handled, subject to legal review]]

9. Transfers outside the UK and EU

Some providers process data outside the UK and EEA, including in the United States. Where this happens we rely on an adequacy decision or on standard contractual clauses (and the UK addendum). [[TODO: confirm the transfer mechanism for each provider]]

10. Security and children

We use technical and organisational measures to protect your data, but no system is completely secure. Saya is not directed at anyone under 16 and we do not knowingly collect their data; if you think a child has given us data, contact us and we will delete it. [[TODO: confirm age]]

11. Boutique partners and the website widget

If you use Saya through a boutique's website and book an appointment, the relevant styling preferences and booking details are shared with that boutique so it can serve you.

12. Changes to this policy

We will update the date above when this policy changes and, for material changes, tell you in the app or by email.

13. Contact

Augado EOOD, Bulgaria
Email: privacy@saya.ai