Privacy Policy

1. Who we are

This Privacy Policy describes how Odeta ("Odeta", "we", "us") processes personal data when you use the Odeta website, web app, Telegram and VK mini apps, and desktop app (together, the "Service").

The data controller is Odeta [legal entity, country of registration — to be specified before publication]. You can contact us about anything in this policy at hello{'@'}odeta.app.

2. Data we collect

We collect only what is needed to run the Service:

• Account data: your email address and password hash, or identifiers from Google, Apple, Telegram, or VK when you sign in with those.
• Photos you upload: the images you add for try-ons.
• Body measurements you optionally provide: height, weight, chest, waist, and hips.
• Transaction data: credit purchases, subscription status, and payment identifiers. We never see or store full card details.
• Usage and technical data: IP address, device and browser type, pages visited, and log records needed to operate and secure the Service.
• Support correspondence when you contact us.

3. Purposes and legal bases

We process your data on the following grounds:

• Providing the Service — account, try-on generation, history, and wallet (performance of a contract).
• Payments and accounting (performance of a contract and legal obligations).
• Security, fraud and abuse prevention (legitimate interest).
• Service improvement through aggregated, non-identifying statistics (legitimate interest).
• Optional data you choose to provide, such as body measurements (consent; you can withdraw it at any time by deleting the data).

4. How your photos are used

Your photos are used exclusively to render virtual try-ons for you. They are not used to train AI models, and they are never shown to other users.

To render a try-on, your photo and the garment image are transmitted to our AI processing provider (FASHN) over an encrypted connection, where they are processed to produce the result. Try-on results are stored in your account until you delete them.

5. Processors and recipients

We share data only with the providers needed to operate the Service, and only to the extent of their role:

• Cloud hosting and object storage — stores photos and results on our behalf in private buckets.
• FASHN (AI try-on processing) — receives your photos and garment images solely to render results.
• Payment processors — Paddle (USD), ЮKassa (RUB), and Telegram Stars (inside Telegram) — receive the payment and contact details needed to process your purchase; they act as independent controllers for payment data.

Each provider receives only the data needed for its role and is bound by contract to protect it.

6. International transfers

Some processors may be located outside your country, including outside the EU/EEA. Where required, such transfers are covered by appropriate safeguards, such as standard contractual clauses. [Transfer details to be confirmed together with the legal entity and hosting regions before publication.]

7. Retention

Photos and try-on results are kept until you delete them or delete your account. Account data is kept while your account is active.

When you delete your account, photos, results, and personal data are removed within 30 days, except payment and accounting records, which we keep as required by tax and accounting law (typically 5 years). Backups rotate out within 90 days.

8. Your rights

You can exercise the following rights at any time:

• Access — request a copy of your data.
• Rectification — correct inaccurate data.
• Erasure — delete individual photos in the app, or your entire account.
• Restriction and objection — ask us to limit or stop certain processing.
• Portability — receive your data in a machine-readable format.
• Withdrawal of consent — where processing is based on consent.

To exercise any right, write to hello{'@'}odeta.app. You also have the right to lodge a complaint with your local data protection authority (in the EU, your national DPA).

9. Regional notices

Depending on where you live, you may have additional rights:

• EEA and UK (GDPR): the rights described in section 8 are provided under the GDPR and the UK GDPR; our legal bases are listed in section 3. You may lodge a complaint with your local supervisory authority.
• California (CCPA/CPRA): we do not sell or share your personal information for cross-context behavioral advertising. You have the right to know, access, correct, and delete your personal information, and to non-discrimination for exercising these rights. Requests: hello{'@'}odeta.app.
• Russia (152-FZ): personal data of Russian citizens is processed in accordance with Federal Law No. 152-FZ; where required, databases are located on the territory of the Russian Federation. [Hosting localization to be confirmed before publication.]
• China (PIPL): by uploading photos you separately consent to the transfer of your personal information to our AI processing provider outside mainland China, solely to render your try-ons. You may withdraw this consent at any time by deleting your photos, which stops further transfers.
• Other regions: we honor data subject rights under applicable local law (for example, the LGPD in Brazil); contact us to exercise them.

Where local law conflicts with this policy, the mandatory local provision prevails for residents of that region.

10. Cookies

The Service uses a small number of strictly necessary cookies and local-storage entries — for example, to keep you signed in and to remember your language. We do not run third-party advertising or analytics trackers. Details are in our Cookie Policy.

11. Children

The Service is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

12. Security

We protect data in transit with TLS, store passwords as argon2 hashes and sessions as SHA-256 hashes, keep photos in private storage served through short-lived signed URLs, and limit employee access to personal data. No method of transmission or storage is 100% secure, but we work to prevent unauthorized access, loss, or misuse.

13. Changes to this policy

If we change this policy materially, we will notify you on the website or by email before the change takes effect. The "last updated" date above always shows the current version.

14. Contact

Data protection questions, requests, and complaints: hello{'@'}odeta.app. [Postal address of the legal entity — to be added before publication.]