Privacy Policy

1. Information We Collect

When you use DressLocked ("the Service"), we collect the following information:

• Account information: Your email address and an encrypted password when you create an account. We do not store your password in plain text.
• Profile information: First name, last name, school name, graduation year, and optionally your Instagram handle, skin tone, height, weight, dress size, budget range, and style preferences.
• Dress claims: Links to dresses you claim, along with associated metadata (image, name, price, color) fetched from retailer websites.
• Event participation: Which events you join and your membership in photo groups.
• Usage data: We may collect basic usage analytics such as pages visited and feature interactions to improve the Service. We do not use third-party advertising trackers.

2. How We Use Your Information

We use your information to:

• Provide, operate, and improve the DressLocked service
• Display your first name and dress claims to other members of your event
• Detect and prevent duplicate or similar dress claims within events
• Send email notifications about your events and dress claims (you can opt out in your profile settings)
• Process dress images and descriptions through AI models to extract attributes, detect visual similarity, and provide styling recommendations
• Generate aggregated, anonymized trend data (no personal information is included)

3. AI Processing

DressLocked uses our proprietary AI technology to:

• Extract dress details from retailer URLs
• Analyze visual similarity between dresses
• Provide personalized styling recommendations
• Detect potentially fraudulent or AI-generated images
• Generate event recaps and trend reports

Dress images and descriptions submitted to the Service may be processed by our AI systems. We do not use your personal information (name, email, school) for AI training purposes.

4. Information Sharing

We do not sell, rent, or trade your personal information. Your information is visible to:

• Event members: Your first name, last initial, and claimed dress are visible to other members of your event. Your full name, email, and personal details are not shared.
• Event creators: The person who created the event can see the same information as other event members.

We do not share your information with third parties for marketing or advertising purposes. We may share information if required by law, legal process, or to protect the rights and safety of DressLocked and its users.

5. Data Storage and Security

Your data is stored securely using our proprietary infrastructure with enterprise-grade security. Data is hosted in the United States. Passwords are hashed and never stored in plain text. We use row-level security policies to ensure users can only access data they are authorized to see. While we take reasonable measures to protect your information, no method of electronic storage is 100% secure.

6. Technology & Infrastructure

DressLocked is built on proprietary technology developed in-house. Our systems handle:

• Authentication & Security: Secure account management and data protection
• AI Analysis: Proprietary AI-powered dress analysis, similarity detection, and styling recommendations
• Communications: Transactional email delivery
• Image Processing: Image optimization and delivery

All data processing is performed in accordance with our security standards and applicable data protection laws.

7. Cookies

We use essential cookies and local storage to maintain your login session. We do not use cookies for advertising or cross-site tracking purposes.

When you click a “Shop” link on the Browse page, you may be redirected through an affiliate network (such as Rakuten, CJ, Impact, or Awin). These networks may set their own cookies to attribute the referral. DressLocked does not control third-party affiliate cookies. Please refer to the respective network's privacy policy for details.

7a. Outbound Click Logging

When you click a “Shop” link to visit a retailer, we log the click (dress URL, store name, and your user ID if you are signed in) to help us understand which dresses are most popular and to improve our product recommendations. This data is stored securely and is not shared with third parties for marketing purposes.

8. Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate information
• Request deletion of your account and all associated data
• Withdraw from events and remove your dress claims at any time
• Opt out of non-essential email communications

To exercise these rights, contact us at our contact page. We will respond to requests within 30 days.

9. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to request deletion, and the right to opt out of the sale of personal information. We do not sell personal information. To exercise your California privacy rights, contact us at our contact page.

10. UK/EU Users — GDPR

If you are located in the United Kingdom, European Economic Area, or European Union, you have rights under the General Data Protection Regulation (GDPR). DressLocked acts as the data controller for your personal data.

What we collect and why:

• Account data (email, password hash): to create and secure your account. Legal basis: contractual necessity.
• Profile data (name, school, optional appearance and sizing info): to provide the dress-locking service and personalised recommendations. Legal basis: contractual necessity and, for optional fields, your consent.
• Dress claim data (image, URL, colour, price): to prevent duplicates at your event. Legal basis: contractual necessity.
• Usage analytics (pages visited, feature interactions): to improve the service. Legal basis: legitimate interest. We use PostHog for analytics; no data is sold or shared with advertisers.

How long we keep it:

• Account and claim data: retained while your account is active and deleted within 30 days of account deletion.
• Usage analytics: retained for up to 24 months in identifiable form, then anonymised.

Your GDPR rights:

• Access: Request a copy of all personal data we hold about you.
• Rectification: Correct inaccurate data via your profile or by contacting us.
• Erasure: Request deletion of your account and all associated data.
• Restriction: Ask us to restrict processing in certain circumstances.
• Data portability: Receive your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interest.
• Withdraw consent: Where processing relies on consent, withdraw it at any time without affecting prior processing.

To exercise any of these rights, email us at talia@dresslocked.com. We will respond within 30 days. If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority.

Data is stored on servers in the United States. By using the Service, data may be transferred outside the UK/EEA. We rely on standard contractual clauses for such transfers.

11. Children's Privacy

DressLocked is intended for use by high school students aged 13 and older. We do not knowingly collect personal information from children under the age of 13 in compliance with the Children's Online Privacy Protection Act (COPPA). If you are a parent or guardian and believe your child under 13 has provided personal information to us, please contact us at our contact page so we can promptly delete it.

12. Data Retention

We retain your account and claim data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where retention is required by law. Anonymized, aggregated data (which cannot identify you) may be retained indefinitely for trend analysis.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes by updating the "Last updated" date at the top of this page. Your continued use of the Service after changes are posted constitutes acceptance of the revised policy.

14. Contact

If you have questions about this Privacy Policy, please contact us at talia@dresslocked.com or visit our contact page.