LOOKS

Privacy Policy

Effective 4 November 2026 · Blue Hat FZE LLC

This policy explains what personal data LOOKS collects, why, who receives it and what you can do about it. The controller is Blue Hat FZE LLC, BLA-BR3-923, AMC Boulevard-A Building, Ajman Media City Free Zone, Ajman, United Arab Emirates, support@heylooks.app.

1. What we collect

  • Account: your email address (used for one-time sign-in codes and service emails), a referral code, your language, the name and style preferences you type in.
  • Photos and looks: the photos you upload, the occasion and context you enter, the scores, reviews and conversations the AI produces, wardrobe pieces you save, AI try-on results.
  • Guests: a signed device cookie that identifies this browser for the daily free score, and a one-way hash of your network address used only to limit abuse. Guest photos are stored under that device key until you sign in and claim them.
  • Payments: Stripe processes your card. We store the Stripe customer id, the subscription status and period end, and which pack you bought. We never receive your card number.
  • Usage: which actions you take in the app and when (upload, score, share, open a card, start checkout), to understand what works and to enforce daily limits. No advertising trackers.

2. Why, and on what legal basis

  • To provide the service you asked for: scoring, reviews, sharing, challenges, purchases (performance of a contract).
  • To send your photo to an AI model for a score or a try-on: your consent, given when you upload the photo. You can withdraw it by deleting the look or your account.
  • To keep the service safe and within limits, and to prevent fraud and abuse (legitimate interest).
  • To keep payment and tax records (legal obligation).
  • To improve LOOKS from aggregated usage (legitimate interest). We do not sell personal data and do not use it for third-party advertising.

3. AI processing

Scores and reviews are produced by models from Anthropic; AI try-on images by a model from OpenAI. Your photo and the text you entered are sent to them over their APIs for that purpose only. Under the API terms of these providers, data sent through the API is not used to train their models. We do not train models on your photos either.

4. Who receives your data

Providers that process data for us, under contracts that bind them to our instructions:

  • Vercel — hosting and serving the site.
  • Supabase — database, file storage and sign-in codes.
  • Anthropic — the AI model that writes scores and reviews from your photos.
  • OpenAI — the image model behind AI try-on.
  • Stripe — payments; LOOKS never sees your card number.
  • Resend — transactional email.
  • Cloudflare Turnstile — bot check on the guest form, when enabled.

Beyond that, data is shared only with people you share it with (a published verdict, a duel, a remix, a challenge group), or when the law requires. Some providers are in the United States; transfers rely on their standard contractual clauses or an equivalent adequacy mechanism.

5. What is public

Nothing, unless you publish it. A published verdict page shows the three scores, one line and the photo you chose, never the full review text. A duel, remix or challenge shows the photos entered to anyone with the link; challenge photos are visible to the members of that group. Switching publication off removes the public page; changing the photo removes it too.

6. How long we keep data

  • Account data, photos, looks, reviews and conversations: until you delete the look or the account. Deleting the account removes them from our database and storage.
  • Guest photos and scores: until you claim them by signing in, otherwise until our periodic cleanup of unclaimed guest data.
  • Payment records: for the period required by tax and accounting law.
  • Usage events: in aggregated form; raw events are deleted with the account.

7. Your rights

You can access, correct, export and delete your data, object to processing based on legitimate interest, and withdraw consent at any time. Most of this is in the app: edit your profile, delete a look, or delete the whole account in settings. For anything else, email support@heylooks.app from the address of your account; we answer within 30 days. If you are in the EU or UK you may also complain to your data-protection authority.

8. Cookies

Only strictly necessary cookies: the sign-in session, the guest device key, the referral code that credits a friend who invited you, and your language. No advertising or cross-site tracking cookies, so there is no cookie banner. When the bot check (Cloudflare Turnstile) is enabled on the guest form, it sets its own technical cookie.

9. Security

Data travels over TLS. Photos are stored in a private bucket and served only to their owner or through the pages the owner published. Database access from the browser is blocked; the server acts on your behalf after checking your session. Secrets never reach the browser.

10. Children

LOOKS is not for children under 16, and we do not knowingly collect their data. Do not upload photos of children. If you believe a child’s data reached us, write to us and we will delete it.

11. Changes

The current policy is always at heylooks.app/privacy with its effective date. Material changes are announced by email before they apply.