Privacy policy

Controller

the Vibing Company (Sole proprietorship (Einzelunternehmen)), Jonathan Osburg

Address

Schaffhauser Straße 28, 81476 München, Germany

Privacy contact

jon@vibing.inc

We are not required to appoint a data protection officer. Questions about this policy go to the address above.

• No advertising, no tracking pixels, no analytics scripts, no data sales. There is no cookie banner because we only use what the service needs to run.
• Your data lives in the EU (Frankfurt). Some features call AI and search providers, listed below with what they receive.
• Published outfits, sets, comments and your profile are public. Closets, scans, drafts and your "who you shop for" settings are private.
• You can download everything we hold about you and delete your account, including every file, in Settings.

You can sign in with Google or with an email address and password. We store your user id, email address, the sign-in method, the time of sign-up and sign-ins, and a profile with your username, display name, profile picture (from Google, if you signed in that way), a short bio and your country. Your email address is never shown to other people.

The optional "who you shop for" settings (women or men, age range, skin tone, height, size) are private. They prefill new outfits, steer the "For you" feed and decide who the person in generated photos looks like. Skin tone may say something about ethnic origin, so we only process it with your explicit consent, given by choosing a value; clear it any time in Settings to withdraw that consent. Everything else in this block is optional too.

Legal basis: Art. 6 (1) (b) GDPR (providing the account you asked for); Art. 9 (2) (a) GDPR for the skin tone choice. Sign in with Google is offered by Google under its own policy, listed under processors below.

Outfits, Mix & Match sets, the pieces in them, titles, descriptions, tags, the target audience you set, likes, saves, follows, brand follows, comments and remixes are stored with your user id. Published outfits, sets and comments are visible to everyone, appear in search engines and in our RSS feed and can be shared by link. Drafts and your closet are visible only to you. Counters such as likes and views are stored as numbers on the outfit.

Pasting a product link makes our server read that public product page (title, price, photos, shipping countries) and store the product in the shared catalogue. The product is not tied to you publicly; we keep an internal note of who added it.

Legal basis: Art. 6 (1) (b) GDPR.

Scan finds the pieces in a photo and matches them with products you can buy. The photo is shrunk in your browser to at most 1600 pixels and stored in a private folder that only you and our servers can reach. Public links to it never exist; the app fetches it with your session, and providers that need it get a link that expires within an hour.

Processing steps and who is involved: a vision model (OpenAI, through the Lovable AI gateway) describes each piece and its position; your browser cuts each piece out of the photo; the crops go to the Shopify Global Catalog for image similarity, to Google Lens and Google Shopping through SerpApi for reverse image search and prices, and to an embedding model (Google, through the gateway) and the vision model to rank the candidates. Cropping on our servers happens in our own code. The photo itself is not sent to shops or search engines; only crops of individual pieces are.

Faces are not detected, measured or used to identify anyone; we look at garments. Still, a photo of a person is personal data. Only scan photos of yourself or photos you have permission to use, and do not scan photos of children. Scans and their crops are deleted 90 days after you last touched them, or immediately when you delete the scan or your account.

Legal basis: Art. 6 (1) (b) GDPR, performance of the scan you requested. Where a photo shows other people, Art. 6 (1) (f) GDPR on your side; you are responsible for having the right to use it.

When you paste or share a public Instagram, Pinterest or TikTok post, our server fetches that public page (or its public embed) to read the photo and caption. The address you pasted is the only thing sent. If the platform blocks the direct fetch we ask HikerAPI for the public details of that post. Fetched posts are cached for 24 hours so a second read is instant, then deleted. We never sign in to your social accounts and we cannot read private posts.

The caption's author and their public username may be shown next to the scan so the source is credited (Art. 6 (1) (f) GDPR: attribution and the interests of the author). Authors who prefer not to be shown can use the report form.

The "worn" photo of an outfit is generated by an image model (OpenAI, through the Lovable AI gateway) from the product photos and a short brief: scene, film look, and a description of a fictional person built from the outfit's target audience or your private "who you shop for" settings. No photo of you is used. The person shown does not exist; photos are marked as AI-generated in the interface and in their descriptions. The brief, including the description of the person, is stored with the frame; only the scene and film are shown publicly.

Legal basis: Art. 6 (1) (b) GDPR.

The "For you" feed and suggestions in the builder are ranked with a taste profile: a set of scores about styles, colours, brands and price levels derived from the outfits you liked, saved and published and from your closet. It is refreshed every few hours from that activity, never shared, and has no legal or similarly significant effect on you. Learning about which pieces go well together is aggregated across everyone without user ids.

You can turn personalisation off in Settings; the taste profile is deleted at once and the feed falls back to the general ranking. Legal basis: Art. 6 (1) (f) GDPR (relevant results); the switch is your right to object under Art. 21 GDPR.

We send email only when the service needs it: confirming your address, resetting a password, sign-in codes and answers to your requests. Messages come from notify.outfitlink.co through our hosting provider's email service. There is no newsletter and no marketing email.

Legal basis: Art. 6 (1) (b) GDPR.

Outfitlink exposes its tools to AI assistants you connect yourself (an MCP server and in-page tool descriptions). An agent acts under your account with the permissions you grant during the sign-in prompt and can only see what you can see. Whatever you tell the agent, and whatever it reads from Outfitlink, is also processed by the agent's provider under that provider's terms; we do not control that side. You can revoke an agent's access by signing out of it or contacting us.

Legal basis: Art. 6 (1) (b) GDPR.

When you report content or write to us we keep the report, your message, your name and email address if you gave them, a hashed form of your IP address to stop abuse of the form, and our answer, for as long as needed to handle the case and to prove how it was handled (up to three years after closing it). Legal basis: Art. 6 (1) (c) GDPR (our obligations under the Digital Services Act) and Art. 6 (1) (f) GDPR.

Everything stored in your browser is needed to run the service; nothing is used for tracking, advertising or measurement, so no consent banner is required (§ 25 (2) TDDDG).

• Sign-in session (local storage): your session token so you stay signed in. Kept until you sign out.
• Country (cookie): the country you shop from. Kept for one year.
• Appearance (local storage): light or dark mode, if you chose one.
• Session memory (session storage): which images already loaded and which animations already played, so pages do not flash. Cleared when the tab closes.

Signing in with Google or connecting an AI agent involves cookies set by that provider on its own domain during the sign-in step; those are governed by the provider's policy.

The following companies process personal data on our behalf or, where marked, as independent controllers for their part of the service. Processors are bound by data processing agreements under Art. 28 GDPR. Each entry says when it is involved and what it receives.

• Lovable Cloud

  Processor

  Lovable Labs Incorporated. Stockholm, Sweden (US entity); database and files in the EU (Frankfurt, Germany).

  Purpose

  Hosting and delivery of the app, database, sign-in, file storage, transactional email (sent from notify.outfitlink.co) and the AI gateway that forwards our model requests.

  Receives

  Everything you store with us: account, profile, outfits, closet, scans, uploaded photos, technical logs (IP address, browser, time).

  When

  Always

  Transfer

  Data at rest stays in the EU. Edge delivery and support may involve US-based sub-processors under Standard Contractual Clauses; see Lovable's sub-processor list.

  Privacy policy of Lovable Labs Incorporated

• Google (Sign in with Google)

  Independent controller

  Google Ireland Limited, Dublin, Ireland; Google LLC, USA. Ireland / USA.

  Purpose

  Signing in with your Google account.

  Receives

  Your Google account id, email, name and profile picture are shared with us when you choose Google sign-in. Google processes the sign-in under its own privacy policy.

  When

  When you sign in with Google

  Transfer

  EU-US Data Privacy Framework (Google LLC is certified).

  Privacy policy of Google Ireland Limited

• OpenAI (vision and photo models via the Lovable AI gateway)

  Sub-processor

  OpenAI Ireland Ltd, Dublin, Ireland; OpenAI, L.L.C., USA. Ireland / USA.

  Purpose

  Reading the pieces in a photo you scan, judging how close a shop item looks to it, and rendering the generated on-model photos.

  Receives

  The photo you scan (or a crop of it), product photos and descriptions, and the outfit's brief. No account data. API inputs are not used to train OpenAI models.

  When

  Scan, on-model photos, brand logo checks

  Transfer

  EU-US Data Privacy Framework (OpenAI, L.L.C. is certified) and Standard Contractual Clauses.

  Privacy policy of OpenAI Ireland Ltd

• Google (Gemini embedding model via the Lovable AI gateway)

  Sub-processor

  Google Ireland Limited; Google LLC. Ireland / USA.

  Purpose

  Turning product photos, outfit text and scan crops into vectors so we can find similar pieces.

  Receives

  Product images and text, scan crops. No account data.

  When

  Suggestions, similarity, scan matching

  Transfer

  EU-US Data Privacy Framework and Standard Contractual Clauses.

  Privacy policy of Google Ireland Limited; Google LLC

• Jev (typed judgment model via the Lovable AI gateway)

  Sub-processor

  Served through Lovable Labs Incorporated's AI gateway. See Lovable's sub-processor list.

  Purpose

  Deterministic categorisation and scoring of pieces and outfits (fit, colour, completeness).

  Receives

  Product attributes and outfit composition. No photos of you and no account data.

  When

  Outfit scoring, suggestions

  Transfer

  As per Lovable's sub-processor list.

  Privacy policy of Served through Lovable Labs Incorporated's AI gateway

• Shopify Global Catalog

  Processor

  Shopify International Limited, Dublin, Ireland; Shopify Inc., Ottawa, Canada. Ireland / Canada.

  Purpose

  Finding purchasable products that look like a piece in your scan, with prices and shipping for your country.

  Receives

  A crop of the piece (not the whole photo where possible), a text description of it and the country you shop from. No account data.

  When

  Scan matching

  Transfer

  Canada holds an EU adequacy decision; Standard Contractual Clauses where needed.

  Privacy policy of Shopify International Limited

• SerpApi (Google Lens and Google Shopping results)

  Processor

  SerpApi, LLC, Austin, Texas, USA. USA.

  Purpose

  Reverse image search for a piece in your scan and price comparison across shops outside the catalog.

  Receives

  A tight crop of the piece, reachable through a link that expires within an hour, plus a text description and your country. No account data. SerpApi passes the image to Google's search.

  When

  Scan matching (when enabled)

  Transfer

  Standard Contractual Clauses (Art. 46(2)(c) GDPR).

  Privacy policy of SerpApi

Our database and files are stored in Frankfurt, Germany. Some providers above are located in, or supported from, the United States or Canada. Where data leaves the EU it is protected by an adequacy decision of the European Commission (Canada; companies certified under the EU-US Data Privacy Framework) or by the Commission's Standard Contractual Clauses with additional safeguards (Art. 46 (2) (c) GDPR). Copies of the clauses are available on request.

Product photos, brand logos and generated photos are copied to our own storage and served from our domain, so viewing an outfit does not contact the shop. Two exceptions: shop thumbnails in scan results are loaded straight from the shop's servers, and profile pictures of people who signed in with Google are loaded from Google. In those cases the other server sees your IP address and browser like any image request. We do not embed social media widgets, videos, maps or fonts from other servers; our font is served by us.

• Account, profile, outfits, sets, closet, likes, saves, follows, comments: until you delete them or your account.
• Scans and their crops: 90 days after the last change, or until you delete them.
• Fetched social posts: 24 hours.
• Taste profile: refreshed continuously; deleted when you turn personalisation off or delete your account.
• Generated photo frames you removed: deleted from storage within a day by a nightly clean-up.
• Server logs: a short period defined by our hosting provider, for security and fault finding.
• Reports and correspondence: up to three years after the case is closed.
• After account deletion: only anonymous aggregates remain (for example how often two kinds of pieces were combined), a record that a deletion took place (hashed id, time, counts), and price history of catalogue products, which is not personal data.

Under the GDPR you have the right to:

• access your data and get a copy (Art. 15): use "Download my data" in Settings; the file is machine-readable JSON, which also covers portability (Art. 20);
• rectification (Art. 16): edit your profile and content directly, or ask us;
• erasure (Art. 17): delete single outfits, scans or comments in the app, or delete your whole account in Settings, which removes your rows and files and your login at once;
• restriction of processing (Art. 18) and objection (Art. 21), including to personalisation via the switch in Settings;
• withdraw consent at any time for the future, for example by clearing the skin tone choice;
• complain to a supervisory authority. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de. You may also contact the authority where you live.

For anything you cannot do in the app write to jon@vibing.inc. We answer within one month. To protect your data we may ask you to write from the email address on your account.

Connections are encrypted (TLS). Access to stored data is restricted by row-level rules so that private content is only readable by its owner and by our server code. Uploaded scan photos live in a private bucket without public links. Secrets for the services above are held on the server only. Nobody can promise perfect security; if a breach affects your rights we will inform you and the authority as the GDPR requires.

Outfitlink is for people aged 16 and over. We do not knowingly collect data from younger children; if you believe a child has created an account, tell us and we will remove it.

We make no automated decisions with legal or similarly significant effects on you (Art. 22 GDPR). Ranking outfits, scoring how complete an outfit is and matching products are suggestions you can ignore.

When features change we update this page and the date at the top. Where a change affects what we do with your data in a way you would not expect, we tell you in the app before it takes effect.