Privacy Policy

1. Data Controller

Gianni is the Data Controller of your personal data.

Contact: support@giannifit.shop

2. Data We Collect

A. Account Data

• Name
• Email
• Encrypted password
• Subscription tier
• Billing status

B. User Content

• Uploaded images
• Text descriptions
• Style preferences
• Saved outfits
• Wishlist data
• Usage history

C. Payment Data (Stripe)

• Payment method token
• Billing address
• Transaction history
• Subscription status

We do NOT store full card numbers.

D. Technical Data

• IP address
• Device type
• Browser
• Location (approximate via IP)
• Cookies
• Usage logs
• Session duration
• API call frequency

E. Analytics & Marketing Data

• Referral source
• Click behavior
• Engagement metrics

3. Legal Basis for Processing (GDPR)

For EU users, processing is based on:

• Contract performance (providing services)
• Legitimate interests (platform improvement)
• Consent (marketing communications)
• Legal compliance (tax, fraud prevention)

4. Your GDPR Rights (EU/EEA/UK)

You have the right to:

• Access your data
• Rectify inaccuracies
• Erase data ("Right to be Forgotten")
• Restrict processing
• Data portability
• Object to processing
• Withdraw consent
• Lodge complaint with supervisory authority

Contact: support@giannifit.shop

5. CCPA / CPRA Rights (California)

California residents have the right to:

• Know what personal data we collect
• Request deletion
• Request correction
• Opt-out of sale/share of personal data
• Non-discrimination for exercising rights

Gianni does NOT sell personal data.

To exercise rights: support@giannifit.shop

6. Data Transfers (International)

Your data may be processed outside your country.

For EU users, we rely on:

• Standard Contractual Clauses (SCCs)
• Secure cloud providers
• Adequate protection mechanisms

7. AI Data Processing Transparency

User-submitted content is processed by AI systems to:

• Generate outfit insights
• Provide curated suggestions
• Improve algorithms

Where legally required, users may request:

• Human review
• Explanation of processing logic

8. Cookies & Tracking

We use:

• Essential cookies
• Authentication cookies
• Analytics cookies
• Marketing attribution cookies

Users may manage cookies via browser settings.

9. Data Retention

We retain personal data:

• While account remains active
• As required for tax/legal compliance
• Up to 24 months after inactivity (unless deletion requested)

Deleted accounts may have anonymized data retained for analytics.

10. Security Measures

We implement:

• Encryption in transit (TLS)
• Encrypted database storage
• Role-based access controls
• Secure third-party processors
• Monitoring & logging systems

No system is 100% secure.

11. Children's Privacy

We do not knowingly collect data from children under 13.

If discovered, we delete such data promptly.

12. Affiliate & Advertising Transparency

We may receive compensation from third-party retailers.

This does not affect pricing shown to users.

13. Changes to This Policy

We may update this Privacy Policy periodically.

Users will be notified of material changes.