How we treat your data.

mysta ("we", "our", "the app") is a personal styling assistant operated by Siar Innovations Inc. It uses artificial intelligence to recommend outfits from your wardrobe. This policy explains what data we collect, how we use it, who we share it with, and the choices you have. Questions? Email us at hello-mysta@siarinnovations.com.

1. Information we collect

Information you give us

• Account information: your email address, display name, and password. Your password is securely managed by our authentication provider (Amazon Web Services) and is never stored in plain text.
• Profile & style preferences: optional details like your gender, age range, profession, lifestyle, and typical week, plus your likes and skips during style discovery (which build your "Style DNA").
• Clothing photos: photos of garments you add to your digital closet.
• Body photo & body profile (sensitive — with your consent): if you choose to use the body analysis feature, you can upload a full-body photo. Our AI uses it to estimate body shape and proportions ("body profile") and to create a styling avatar, so outfit suggestions fit you better. We only do this when you actively choose the feature and confirm. You can skip it entirely, and you can delete your body photo, body profile, and avatar at any time.
• Chat messages: your conversations with the AI stylist.
• Feedback, surveys & interviews (optional): as an early-stage product, we may invite you to share feedback through in-app prompts, surveys, or user interviews. Participation is always voluntary, and we'll only record an interview with your permission.

Information collected automatically

• Approximate location (with your permission): if you allow location access, we use your approximate coordinates (rounded, not your exact address) to fetch local weather so outfit suggestions match the conditions. We do not track or store your movement history. You can decline or revoke this in your device settings — the app still works.
• Activity in the app: outfits you save, wear, and react to, used to improve your recommendations.
• Usage analytics: events like screen views and feature usage, linked to your account ID, collected via PostHog to help us understand what's working and fix what isn't. You can opt out of analytics (see Section 7).

Purchase information

If you purchase a subscription or other paid feature, the payment is processed entirely by Apple through your App Store account. We receive confirmation of your purchase and subscription status — never your card number or billing details.

We do not collect your contacts, precise GPS history, or advertising identifiers.

2. How we use your data

• Outfit recommendations: your closet, style preferences, body profile (if provided), wear history, and local weather are used by our AI to generate personalized suggestions.
• Photo analysis: clothing photos are analyzed by AI to identify category, color, style, and season automatically.
• Body analysis & avatar (optional): your full-body photo is analyzed by AI to build your body profile and styling avatar.
• AI stylist chat: your messages and styling context are processed by AI to answer your questions.
• Account & service emails: your email is used for verification, password resets, and important service updates.
• Purchases: your subscription status is used to unlock paid features and provide support for billing questions.
• Shopping suggestions (planned): we're building a feature that helps you find items to buy that complete your closet. When you search for an item, your search terms and style attributes (for example, "navy linen blazer") may be sent to retail partners to fetch matching products — see Section 3 for what they receive.
• Improving mysta: aggregated usage analytics, plus your survey responses, interview feedback, and feature suggestions, help us prioritize features, fix bugs, and shape the product. When we share learnings (for example, with advisors or in product planning), we use them in aggregated or de-identified form — never your photos or identifiable details.

We do not use your data for third-party advertising, and we do not sell or rent your personal data to anyone. Planned shopping features may earn us affiliate commissions when you buy items we suggest (see Section 3), but that never involves selling your personal data.

3. Who we share data with

We share data only with the service providers needed to run mysta:

Planned: retail partners for shopping features. A future "build your closet" feature will let you shop for items that complete your wardrobe. When you search, we may send your search terms and garment attributes only — such as item type, color, garment size, or garment measurements like sleeve length (for example, "navy linen blazer, size M") — to retail partners or affiliate networks to fetch matching products. These requests will not include your name, email, photos, body data, or account identity. If you buy through one of our links, we may earn a commission — at no extra cost to you, and we'll clearly mark where that's the case. We will name our retail partners here before this feature launches.

We may also disclose data if required by law, or to protect the rights, safety, or security of mysta and its users.

4. Your body photo & body data

Because body-related data is sensitive, we hold it to a higher standard:

• Body analysis is always optional and only happens after you explicitly choose it and confirm.
• Your body photo, body profile, and avatar are stored in your private storage area, accessible only to your account.
• They are used solely to personalize your styling experience — never for advertising, never sold, never shared with retail partners, and never shared beyond the AI processing described above.
• You can delete them at any time from Settings, or delete your entire account, and they are permanently removed.

5. Data storage and security

• Data is encrypted in transit (TLS) and at rest (AES-256).
• Photos are stored in private, per-user storage — other mysta users cannot access your data.
• Access to production systems is restricted and authenticated. If you contact us for support, an authorized team member may access your account data — including relevant photos — solely to resolve your request, under access controls and never for advertising or public sharing.
• No system is 100% secure, but we follow industry-standard practices and will notify you of any breach affecting your data as required by law.

6. Data retention

We keep your account data for as long as your account is active.

Deleting your account erases your app data. When you delete your account, your in-app service data — profile, photos, body data, closet, outfits, chats, and wear history — is permanently deleted from our systems, typically immediately and at most within 30 days. Residual copies in encrypted backups are purged within 90 days. If you simply delete an individual item or photo in the app, it is removed from your storage.

Our AI provider. Under the paid API terms we use, our AI provider may retain prompts and images only transiently for abuse and security monitoring, and then deletes them in accordance with those terms.

Analytics. PostHog analytics events linked to your account are deleted or dissociated from your account within 30 days of account deletion or of your opting out of analytics.

Research materials are separate. Deleting your account does not automatically erase optional product-research materials you chose to share with us — such as survey answers and interview notes or recordings. We may retain these for product analysis, preferably in aggregated or de-identified form, and we do not use them to rebuild your closet or account. You can ask us to delete this material by emailing hello-mysta@siarinnovations.com.

We may also retain limited records where required by law, or for legal, fraud-prevention, or accounting purposes.

7. Your rights and choices

• Access & correction: view and edit your profile and closet in the app, or email us for a copy of your data.
• Deletion: use "Delete Account" in Settings for immediate, permanent erasure of your app data — no email required. (To delete optional research materials, email us — see Section 6.)
• Export: request an export of your data by emailing us.
• Withdraw consent: where we rely on your consent (for example, your body photo, body profile, and avatar), you can withdraw it at any time in Settings, without affecting processing already carried out.
• Location: deny or revoke location access in your device settings at any time.
• Analytics opt-out: you can opt out of usage analytics in the app's settings or by emailing us.
• Restrict or object: where applicable, you can ask us to restrict processing, or object to processing based on our legitimate interests.
• Complain: you can lodge a complaint with your local data protection or privacy supervisory authority.

Legal bases (EEA/UK). If you are in the European Economic Area or the United Kingdom, we process your personal data under the GDPR on these legal bases: performance of our contract with you for account and core service data, so we can provide the app you asked for; your consent or our legitimate interests for optional features like approximate location and product analytics (you can withdraw consent or object at any time, and opt out of analytics); and your explicit consent under Article 9 for your body photo, body profile, and avatar, which involve sensitive data. You can withdraw consent at any time in Settings. You also have the rights listed above, including to withdraw consent, restrict or object to certain processing, and lodge a complaint with a supervisory authority.

California (CCPA/CPRA). If you are a California resident, you have the rights to know, access, correct, and delete your personal information, and to be free from discrimination for exercising them. We treat your body photo and inferred body profile as sensitive personal information, and we use it only to provide the styling features you request — we do not use it for any secondary purpose that would trigger the "Limit the Use of My Sensitive Personal Information" right. We do not "sell" or "share" personal information as those terms are defined under California law. If a future shopping feature would change that, we will update this policy and give you notice and an opt-out before it applies to you.

To exercise any right, use the in-app controls or email hello-mysta@siarinnovations.com — we respond within 30 days.

8. International users

mysta is operated from the United States and your data is stored and processed on servers in the United States. If you use mysta from outside the U.S., you understand your data will be transferred to and processed in the U.S.

When we transfer personal data from the European Economic Area, the United Kingdom, or Switzerland to the United States, we rely on appropriate safeguards under applicable law — including the European Commission's Standard Contractual Clauses (and their UK equivalents) with our service providers, and, where applicable, participation in the EU–US and UK–US Data Privacy Framework. You may request more information about these safeguards by emailing hello-mysta@siarinnovations.com.

9. Children and age requirement

mysta is for adults. You must be 18 or older to create an account. We do not knowingly collect data from anyone under 18; if we learn we have, we will delete it. If you believe a minor is using mysta, please contact us.

10. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top always reflects the current version. For significant changes — especially anything affecting your photos or body data — we will notify you in the app or by email and, where required, ask for your consent again.

11. Contact us

Questions about this policy or your data:

Email: hello-mysta@siarinnovations.com
Operator: Siar Innovations Inc.