Modello Privacy Policy
Edition of 21 October 2026. Published at https://www.modello.style/en/privacy.
Data controller (operator): Individual Entrepreneur MAKSIM POLIKANOV, identification number 304820433, registered address: Georgia, Tbilisi City 0108, Nino and Ilia Nakashidze Street N 1 (former Avlevi Area), Building N 3, Apartment N 3 (we, us).
Contact for any questions about this policy, your data, and rights requests: hello@modello.style.
Our representative in the European Union under Article 27 GDPR: Prighter EU Rep GmbH, Schellinggasse 3/10, 1010 Vienna, Austria. Our representative in the United Kingdom under Article 27 UK GDPR: Prighter Ltd (UK), 20 Mortlake High Street, London SW14 8JN, United Kingdom. Supervisory authorities and data subjects may contact our representatives instead of us or in addition to us, including via app.prighter.com/portal/11749670888.
1. What this document is about
1.1. Modello is a clothing-advice service. We determine your colour type and body type, show you outfits and try them on your photo. This requires your personal data, and this policy explains which data, why, where it goes and how to take it back.
1.2. Terms used in this policy are defined in section 10.
2. What data we process
2.1. Account data. Email address, the name you entered at registration, the registration date and the date of your last sign-in. The password is stored as an irreversible hash; we cannot see or recover it. If you sign in with Google, we receive your name and email address from Google.
2.2. Figure answers. Gender, the goal you choose, shoulder-to-hip ratio, waist definition, where weight tends to go, torso and leg proportions. These are your own assessments, not measurements. If you choose to refine your body type with measurements, you also provide your height, clothing size and chest, waist and hip girth; we use them only to determine your body type more precisely. We do not ask for your weight.
2.3. Colour questionnaire. If you determine your colour type by answering questions instead of uploading a selfie: how your skin reacts to the sun, which jewellery suits you, and your eye colour.
2.4. Photographs. Several kinds, all uploaded by you:
- (a) Selfie: used once, to determine your colour type from the tone of your skin, eyes and hair. Because these characteristics may be regarded as revealing racial or ethnic origin, we analyse your selfie only with your explicit consent, which you give by a separate tick box before uploading. We do not store the image itself: it is sent for analysis and does not remain in our database. If you withdraw this consent, your colour type is deleted.
- (b) Figure photo: used to show how an outfit looks on you.
- (c) Wardrobe item photos: photos of items you add to your wardrobe, used to suggest a category and colour and to assess the item (section 4).
- (d) Outfit images: images you submit for outfit analysis. They are not stored (section 4.8).
2.5. Try-on results. Try-on images are kept in private file storage. Links used to display them in the app are valid for no longer than one hour; after that, access to the file closes automatically even if the link was saved.
2.6. We do not use photographs to establish your identity. We do not compare them with other images, build biometric templates from them, recognise faces or pass them to anyone for those purposes.
2.7. Stylist chat. Your questions to the AI stylist and its answers (section 4).
2.8. Subscription and payment data. Plan, amount, currency, period, promo code, status. We do not receive or store bank card details; they are handled by the Merchant of Record.
2.9. Usage data. Number of try-ons, their dates, saved results, the remaining try-on allowance.
2.10. Invitation data. If you arrived via someone's link: the inviter's code and the date of the visit. If you invite others: counters of visits and registrations under your code. Partners receive numbers only: no addresses, no names, no photographs of the people they invited.
2.11. Consent records. Which consents you gave or withdrew, when, and the version of the text you agreed to.
2.12. What we do not collect. When you follow an invitation link, we place no markers in your browser: no cookies and no other identifiers by which you could be recognised on a later visit. We do not store your IP address in our database and do not build a browser fingerprint. Attribution works through the code: you enter it yourself at registration, or it arrives in the address of the link you followed. We determine your location at country level only. Our hosting and delivery providers process IP addresses in their server logs to deliver and protect the Service (section 6). We do not buy data about you from third parties and do not enrich your profile from outside sources.
2.13. Correspondence. Messages you send us and our replies. If you use the contact form on our website, your name, email address and message reach our mailbox as an email and are kept as correspondence; to prevent abuse of the form, we also keep your email address and the time of sending for 30 days.
2.14. City (optional). If you enter your city in your Account, we use it to take today's weather into account in the look of the day. We store the city name and the coordinates of the city centre returned by the geocoding service, not your location, and we do not request your device's location. You can remove your city in your Account at any time.
2.15. Morning notification (optional). If you turn on the morning notification in your Account, we store your browser's push subscription (a delivery address and encryption keys), your time zone and your language, to send you the look of the day at 8 am your time. You can turn it off in your Account at any time.
2.16. Where you came from when you registered. If you create an Account after following a link we published (for example, our Pin on Pinterest), we record the channel, the campaign and the card that link came from. We take them only from the address of that link and only from a fixed list of our own values; anything else is recorded as "other". Nothing is stored on your device for this, and the record is made once, when the Account is created. You may object to this processing at any time (section 7).
2.17. Withdrawal and cancellation requests. If you withdraw from a contract using the Withdrawal Function, or cancel your subscription using the "Cancel contracts here" form, we record what you submit: your name, the email address of your Account and the email address for the confirmation, the purchase or subscription concerned, the type of cancellation and any reason you give, the date you request, the refund method you choose, the date and time we received the request, and what we did with it. The cancellation form also works without signing in.
3. What we store on your device (cookies and similar)
3.1. Below is the complete list. We use no analytics, no visitor counters and no advertising or tracking markers.
| What | Method | Why | How long it lives |
|---|---|---|---|
sb-…-auth-token | cookie | Sign-in session: without it you do not stay logged in | Until you sign out |
NEXT_LOCALE | cookie | The interface language you chose | Until you change the language |
modello_install_hint | cookie | A note that the app-install prompt should not be shown again | Until you clear your browser |
modello-share-signed-out | tab storage | A note that you have just signed out, so the sign-in screen clears what you had shared | Until the tab is closed |
modello-share-v1 | browser cache | Whatever you shared into the app via the system share sheet, while the screen opens | No more than 24 hours |
3.2. These items are strictly necessary for the Service you requested yourself: signing in, showing the interface in your language and receiving what you shared. Their use is therefore exempt from consent, and no cookie banner is displayed. None of them is used to recognise you between visits, build a profile or show advertising.
3.3. Any of these entries can be deleted through your browser (clear site data). After that you will need to sign in again and choose your language again.
4. Why we process your data
4.1. We process personal data for the following purposes and on the following legal bases:
| Data | Purpose | Legal basis |
|---|---|---|
| Email, name, password or Google sign-in | Creating and protecting the Account | Performance of the contract |
| Figure answers, height, clothing size and body measurements | Determining body type and tailoring recommendations | Performance of the contract |
| Colour questionnaire answers | Colour type determination | Performance of the contract |
| Selfie (not stored) | Colour type determination | Your explicit consent |
| Figure photo | Outfit try-on | Performance of the contract |
| Wardrobe item photos | Category and colour suggestion, verdict on an item | Performance of the contract |
| Subscription and payments | Providing the paid service, settlements, handling payment disputes | Performance of the contract; compliance with accounting and tax obligations |
| Usage records | Enforcing plan limits, preventing abuse | Performance of the contract; our legitimate interest in protecting the Service |
| Technical data and server logs | Delivering the Service and protecting it against attacks and abuse | Our legitimate interest in the security and operation of the Service |
| Invitation data | Calculating partner rewards | Performance of the contract with the partner |
| Onboarding milestones | Identifying difficult onboarding steps and improving them | Our legitimate interest in improving the Service |
| Answer to "How did you hear about us?" | Understanding which channels bring users to the Service | Our legitimate interest in directing our marketing |
| Where you came from when you registered | Understanding which channels bring users who stay and pay | Our legitimate interest in directing our marketing |
| Withdrawal and cancellation requests | Processing your withdrawal or cancellation and any refund, and proving that the request was received | Performance of the contract; compliance with legal obligations |
| Correspondence, including messages sent through the contact form | Answering your requests; preventing abuse of the form | Performance of the contract or steps prior to entering into it; our legitimate interest in answering requests and protecting the form |
| Clicks through to shops from the "Find similar" block | Understanding which selections and shops are useful to users | Our legitimate interest in developing the Service |
| Stylist chat conversation | Answering your questions about clothing | Performance of the contract |
| Consent records | Demonstrating that consent was obtained | Compliance with legal obligations; our legitimate interest in demonstrating compliance |
| City (optional) | Taking today's weather into account in the look of the day | Performance of the contract |
| Morning notification (optional) | Sending the look of the day at 8 am | Your consent |
4.2. Onboarding measurement. We record which onboarding steps you have reached: started, reached your portrait, entered the colour questionnaire, completed it. Each record contains only the step, your identifier and the time, without your IP address, device information or cookies. The records are kept for a limited period and are deleted when you delete your Account. You may object to this processing at any time (section 7).
4.3. "How did you hear about us?". After you receive your style analysis, we ask where you heard about us, offering a closed list of options. The answer is optional and you may skip the question. The record contains only the option selected, your Account identifier and the time, and does not affect the price or content of your recommendations. It is kept for as long as your Account exists. You may object to this processing at any time (section 7).
4.4. Clicks through to shops. When you press a button in the "Find similar" block, we record the shop, the item category and your market, together with your identifier and the time. We do not record your IP address or device information, we do not see what you do in the shop and we do not share any information about you with the shop. The records are kept for the period needed to compare use across seasons and are deleted when you delete your Account. You may object to this processing at any time (section 7).
4.5. Verdict on a wardrobe item. When you ask us to assess an item from your wardrobe, its photo is sent to our AI provider for analysis. The photo is kept until you delete the item or your Account. The result of the analysis is saved only if you choose to save it.
4.6. Category and colour suggestion. When you add an item to your wardrobe, its photo is sent automatically to our AI provider so that a category and colour can be suggested. If a daily limit is reached or the provider is unavailable, you fill in these fields manually. The suggestion is saved together with your choice so that we can measure the quality of automatic detection, on the basis of our legitimate interest in improving the Service.
4.7. Stylist chat. Your questions and the stylist's answers are stored so that the conversation remains coherent. Messages are processed by our AI provider; only text is sent, without photographs. The conversation is kept for a limited period and is deleted immediately when you delete your Account. Answers are generated by artificial intelligence, which is indicated in the Service. Please do not share health data or other sensitive information in the chat.
4.8. Images submitted for outfit analysis may show other people, such as models or content authors. We analyse only the clothing, do not identify or describe the people shown and do not store the images. Any personal data of these people is processed on the basis of our legitimate interest in providing the requested analysis, with safeguards that keep the impact on them to a minimum. As we do not know who they are and cannot inform them individually, this clause serves as public notice of this processing. Anyone who believes their image has been processed may object using the contact details at the beginning of this policy. As the images are not stored, we can delete a stored analysis only if the image is provided to us.
4.9. Account data and figure answers are necessary to use the Service. Without a selfie or the colour questionnaire, colour type determination is not available; without a figure photo, virtual try-on is not available. All other information is optional.
4.10. Where we rely on our legitimate interest, we have assessed that it is not overridden by your interests and rights. Where we rely on consent, you may withdraw it at any time in your Account settings, without affecting the lawfulness of processing carried out before the withdrawal. Where the law of your country requires consent for any processing described in this section, we request it separately.
4.11. For users in the European Economic Area, the legal bases above correspond to Article 6(1)(a), (b), (c) and (f) and, for the selfie, Article 9(2)(a) of the General Data Protection Regulation.
5. Who we share data with
5.1. We do not sell personal data and do not share it for anyone else's advertising. Here are the types of third parties that we may share your personal data with:
(i) Hosting and infrastructure
Supabase Pte. Ltd. (Singapore)
- Type: Database, file storage and authentication provider.
- Role: Processor.
- Data Collected and Purpose: all data stored in the Service, including account data, style profile, photographs, try-on results, wardrobe and stylist chat, for the purpose of storing and securing that data.
- Processing location: Germany (Frankfurt); remote access for support from Singapore and the USA is possible.
- Privacy Policy: Supabase Privacy Policy
Vercel Inc. (USA)
- Type: Application hosting provider.
- Role: Processor.
- Data Collected and Purpose: technical data and data passing through the application, for the purpose of running the Service.
- Processing location: Germany (Frankfurt).
- Privacy Policy: Vercel Privacy Policy
(ii) Artificial intelligence services
Anthropic, PBC (USA)
- Type: Artificial intelligence provider.
- Role: Processor.
- Data Collected and Purpose: selfie, outfit images submitted for analysis, photos of wardrobe items, stylist chat messages and textual profile data, for the purpose of colour type determination, outfit analysis, wardrobe suggestions and the stylist chat.
- Processing location: USA.
- Privacy Policy: Anthropic Privacy Policy
FASHN LTD (United Kingdom)
- Type: Virtual try-on provider.
- Role: Processor.
- Data Collected and Purpose: figure photo, outfit images and photos of wardrobe items, for the purpose of generating try-on images.
- Processing location: USA and South-East Asia.
- Privacy Policy: FASHN Privacy Policy
(iii) Email
Plus Five Five, Inc., trading as Resend (USA)
- Type: Email delivery provider.
- Role: Processor.
- Data Collected and Purpose: email address and email content, for the purpose of sending sign-in links, confirmations and service notices.
- Processing location: USA and EU.
- Privacy Policy: Resend Privacy Policy
Google Ireland Limited (Ireland), Google Workspace
- Type: Business email provider.
- Role: Processor.
- Data Collected and Purpose: email address and the content of correspondence with us, for the purpose of receiving and answering your messages.
- Processing location: EU and USA.
- Privacy Policy: Google Privacy Policy
(iv) Payments
Freemius, Inc. (USA)
- Type: Merchant of Record.
- Role: Independent controller.
- Data Collected and Purpose: payment and purchase data, for the purpose of selling paid plans, processing payments, issuing invoices, collecting taxes and executing refunds.
- Processing location: USA.
- Privacy Policy: Freemius Privacy Policy
(v) Sign-in
Google LLC (USA) and Google Ireland Limited (Ireland)
- Type: Sign-in provider.
- Role: Independent controller.
- Data Collected and Purpose: platform account credentials for authorisation through Google; we receive your name and email address. Applies only if you choose to sign in with Google.
- Privacy Policy: Google Privacy Policy
(vi) Weather and maps
The Norwegian Meteorological Institute (MET Norway) — receives the coordinates of your city, rounded to about 10 km, to return the weather forecast. OpenStreetMap Foundation (Nominatim) — receives the name of the city you enter when you save it, to find the city on the map. Neither receives your name, email address or any identifier of your Account.
(vii) Notifications
The push service of your browser (Google, Apple or Mozilla, depending on the browser) — receives the delivery address of your browser to deliver the notification. The content of the notification is encrypted for your browser and cannot be read by the push service.
5.2. Recipients acting as processors process personal data only on our instructions under a data processing agreement and may not use it for their own purposes. The Merchant of Record and Google, where you choose to sign in with Google, act as independent controllers under their own privacy policies.
5.3. Where personal data is transferred to a country that does not provide an adequate level of protection, the transfer is based on appropriate safeguards, in particular the Standard Contractual Clauses, or, where the law of your country requires it, on your consent. You may request a copy of the relevant safeguards using the contact details at the beginning of this policy. OpenStreetMap Foundation is located in the United Kingdom. Transfers to the UK rely on the European Commission's adequacy decision for the United Kingdom.
5.4. We may also disclose personal data to public authorities where required by law, to professional advisers bound by confidentiality, where necessary to establish, exercise or defend legal claims, and to a successor in the event of a transfer of the Service.
6. Retention periods
6.1. We keep personal data only for as long as necessary for the purposes for which it was collected (section 4). When the data is no longer needed, we delete or anonymise it. Retention periods are applied automatically.
6.2. The retention period for each category of data is determined by the following criteria:
- (a) Whether the data is needed to provide the Service to you;
- (b) Whether the purpose for which the data was collected has been achieved;
- (c) Our legal obligations, in particular under accounting and tax legislation;
- (d) The need to establish, exercise or defend legal claims or to demonstrate compliance with the law;
- (e) Whether you have withdrawn your consent, objected to the processing or deleted the data or your Account.
6.3. The selfie is not stored: the analysis takes place at the moment of upload, and only the result is written to your profile. Outfit images submitted for analysis are not stored either; we keep only the verdict text and a technical fingerprint of the image, from which the image cannot be reconstructed, for a short period and without a link to your Account.
6.4. Images are not used to train artificial intelligence models. Where its automated safety systems detect possible misuse, our AI provider may retain the materials of the request for a longer period set by that provider in order to investigate the misuse.
6.5. The following table sets out how long each category of data is kept:
| Data | Retention |
|---|---|
| Account data, style profile, figure photo, wardrobe, saved outfits, sign-in data, answer to "How did you hear about us?", where you came from when you registered, usage records | For as long as the Account exists, or until you delete the relevant data |
| Try-on results and related verdicts | For a limited period after the try-on, after which they are deleted or anonymised; in any case deleted when the Account is deleted |
| Stylist chat | For a limited period needed to keep the conversation coherent; deleted when the Account is deleted |
| Onboarding milestones, clicks through to shops and other analytics records | For the period needed to analyse how the Service is used, after which they are deleted |
| Invitation data | Visits for a limited period; attribution for as long as the Account exists, after which it is anonymised |
| Waiting list and closed-beta access | For a limited period after the end of the waiting list or the beta |
| Consent records, records of requests for immediate performance, and withdrawal and cancellation requests | For the limitation period of claims in which they may serve as evidence |
| Subscription, payment and Credit records; partner and payout data | For the period required by accounting and tax legislation |
| Correspondence with us | For as long as necessary to handle your request and any follow-up |
| Contact form usage records (email address and time of sending) | 30 days |
| Server logs | For a limited period needed for the operation and security of the Service |
| Database backups | Overwritten on a regular rotation |
| Images at our try-on provider | Deleted shortly after processing; the provider keeps a technical record of the request without images |
| Data at our AI provider | In accordance with the provider's terms, as described in clause 6.4 |
6.6. When you delete your Account, we delete or anonymise your personal data, except data we are required to keep by law. Deleted data is also removed from backups in the course of their regular rotation.
7. Your rights
7.1. You can view and correct your data, withdraw your consents and delete your Account in the Account settings, without contacting us.
7.2. Subject to the conditions and exceptions provided by applicable law, you also have the right:
- (a) To be informed about the processing of your personal data, to access it and to receive a copy of it;
- (b) To have inaccurate or incomplete personal data corrected;
- (c) To have your personal data erased;
- (d) To have the processing of your personal data restricted or blocked;
- (e) To receive the personal data you provided to us in a structured, commonly used and machine-readable format, and to have it transmitted to another provider;
- (f) To object to processing based on our legitimate interest;
- (g) To withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal;
- (h) To obtain an explanation of how an Output was generated and to have it reviewed by a person.
7.3. When you delete your Account, we erase your profile, photographs, try-on results, sign-in methods and other personal data, except data we are required to keep by law and the records referred to in clause 7.6. Where payments or partner rewards passed through your Account, the related settlement records are kept in anonymised form.
7.4. If you withdraw your consent to selfie analysis, your colour type is deleted.
7.5. Deleted data is removed from database backups in the course of their regular rotation. If a backup is ever restored, deletions are applied again.
7.6. Records of the consents you have given are kept for as long as they may be needed as evidence that consent was obtained. They contain no photographs and no descriptions of appearance.
7.7. Requests to exercise your rights may be sent using the contact details at the beginning of this policy. We may ask you to confirm your identity before acting on a request. We respond without undue delay and in any event within one month of receiving the request, unless applicable law requires a shorter period. Where applicable law permits, this period may be extended by up to two further months if a request is complex or we receive a large number of requests; in that case we will inform you of the extension and its reasons within the first month. Requests are free of charge, unless they are manifestly unfounded or excessive.
7.8. You may lodge a complaint with the data protection supervisory authority of the country where you live or work or where the alleged infringement took place, or with the competent supervisory authority of Georgia, where we are registered.
8. Children
8.1. The Service is intended only for persons aged 18 or over, and users confirm that they meet this requirement at registration. We do not knowingly collect personal data of persons under 18.
8.2. If we become aware that an Account belongs to a person under 18, we will close the Account and delete the related personal data without undue delay.
8.3. A parent or legal guardian who believes that a person under 18 has registered may contact us using the contact details at the beginning of this policy.
9. Changes to this policy
9.1. We may update this policy to reflect changes in the Service, in our processing of personal data or in the applicable law. Each new edition is published at the same address, stating its date, and previous editions are available on request.
9.2. We will inform you of material changes by email or in the Service before they take effect.
9.3. Where a change requires your consent, in particular where we intend to process personal data for a new purpose on the basis of consent, the change will apply to you only once you have given that consent.
9.4. We keep a record of the version of each consent you have given, together with the date and time, so that we can demonstrate which edition you agreed to.
10. Definitions
10.1. In this policy, the following terms have the meanings set out below.
- Account means your personal account in the Service.
- Controller means the person who determines the purposes and means of the processing of personal data; for the Service, the operator identified at the beginning of this policy.
- European Economic Area means the Member States of the European Union together with Iceland, Liechtenstein and Norway.
- GDPR means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation).
- Merchant of Record means Freemius, Inc., which sells paid plans for the Service and processes payments.
- Output means any result generated by the Service for you, including colour type, body type, recommendations, verdicts, try-on images and stylist chat answers.
- Personal data means any information relating to an identified or identifiable natural person.
- Processing means any operation performed on personal data, such as collection, storage, use, transfer or erasure.
- Processor means a person that processes personal data on behalf of and on the instructions of the controller.
- Service means the Modello styling service available at www.modello.style, including its web application.
- Special categories of personal data means personal data revealing racial or ethnic origin, health data and other categories listed in Article 9 GDPR.
- Standard Contractual Clauses means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission in Implementing Decision (EU) 2021/914.
- Supervisory authority means an independent public authority responsible for monitoring the application of data protection law.