Privacy Policy

Last updated: September 6, 2026

Ustyle SRL ("the Company", "We", "Us", or "Our") operates the Ustyle AI-powered fashion styling platform and the website https://ustyle.it. This Privacy Policy explains what personal data We collect, why and on which legal basis We process it, how long We keep it, with whom We share it, and what rights You have under the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Italian Personal Data Protection Code (Legislative Decree 196/2003, as amended), and other applicable privacy laws.

1. Who We Are and How to Contact Us

The data controller for the processing described in Sections 3, 5, and 6 is Ustyle SRL, c/o I3P, Incubatore del Politecnico di Torino, Corso Castelfidardo 30/A, 10129 Torino TO, Italy. VAT Number: IT13348390017.

For any privacy question or to exercise Your rights, contact Us by email at [email protected] or by post at the address above. We have not appointed a Data Protection Officer, as We are not required to do so.

2. Who this Policy Covers

This Policy covers three groups of people. Please read the section that applies to You.

Merchants and their staff (Section 3): business owners, employees, and representatives who create an Ustyle account, install our app or plugin, or purchase a Subscription. We are the data controller for this data.
Shoppers on Merchant stores ("End Users", Section 4): visitors and customers of an online store that uses the Ustyle widget. For this data, the Merchant is the data controller and We are the data processor acting on the Merchant's instructions.
Website visitors and business contacts (Section 5): people who visit https://ustyle.it, contact Us, or whom We contact for business purposes. We are the data controller for this data.

3. Merchants and Their Staff

3.1 Data We Collect

Identification and contact data: first and last name, business email address, corporate phone number, business name and address, VAT number.
Account data: login credentials (stored in hashed form), Platform store identifier, role, language, and account settings.
Billing data: Subscription plan, invoices, and payment status. Payments are collected by Your Platform's app store (Shopify or WooCommerce), and We do not receive or store card numbers or bank details.
Usage data: pages of the merchant dashboard visited, features used, technical logs (IP address, browser, operating system, timestamps), and support correspondence.
Catalog data: the product images, titles, descriptions, and metadata of Your store ("Your Content"). Catalog data does not normally contain personal data.
Managed Plans: if You subscribe to a plan that includes managed advertising services, We also access Your advertising accounts (for example Google Ads and Meta Business Manager) through the partner access You grant Us, and process the campaign, conversion, and audience data in those accounts on Your behalf and instructions, as described in Annex 4 of Our Data Processing Addendum.

3.2 Purposes and Legal Bases

To create and manage Your account, deliver the Service, synchronize Your catalog, and provide support. Legal basis: performance of the contract with You (Article 6(1)(b) GDPR).
To bill You and keep accounting records. Legal basis: performance of the contract and compliance with legal obligations, including tax law (Article 6(1)(b) and (c) GDPR).
To send You service communications, such as sync alerts, security notices, changes to terms, and billing notices. Legal basis: performance of the contract (Article 6(1)(b) GDPR).
To send You product updates, tips, and offers relating to Ustyle. Legal basis: Our legitimate interest in promoting Our services to existing customers (Article 6(1)(f) GDPR). You may opt out at any time using the link in each email or by writing to Us.
To analyze how the dashboard is used in order to improve it. Legal basis: Our legitimate interest in improving the Service (Article 6(1)(f) GDPR). Analytics are collected through Our EU-hosted PostHog instance.
To perform managed advertising services where included in Your plan, including configuring tracking, building audiences from data You provide, and reporting. Legal basis: performance of the contract with You (Article 6(1)(b) GDPR); for End User data involved, We act as Your processor.
To ensure security, prevent fraud, and enforce Our Terms. Legal basis: Our legitimate interest in protecting the Service and Our rights (Article 6(1)(f) GDPR).
To comply with legal obligations and respond to lawful requests from authorities. Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR).

Providing identification, contact, and billing data is necessary to enter into the contract; without it We cannot provide the Service.

3.3 AI Model Training Limitations

We do not sell, rent, or trade personal data.
We do not use Your Content, Your customers' identities, or shopper activity data to train, fine-tune, or alter generalized machine learning models, whether Our own or those of the third-party AI providers We use from time to time. We engage AI providers only under terms that prohibit them from using Your catalog data, prompts, or outputs to train their models. The AI providers in use are identified on the Sub-processor List page of the Website.
Only catalog data is submitted to AI providers. No End User personal data is sent to them.

4. Shoppers on Merchant Stores (End Users)

4.1 Our Role

When You browse a store that uses the Ustyle widget, the store owner (the Merchant) decides why and how Your data is processed and is the data controller. We process Your data only on the Merchant's instructions, as set out in Our Data Processing Addendum. Please read the privacy policy of the store You are visiting for the full picture. If You contact Us directly about data processed on a Merchant's behalf, We will forward Your request to the Merchant and let You know that We have done so.

4.2 Data We Process on Behalf of Merchants

Online identifiers: a pseudonymized IP address (truncated or hashed at collection), a Ustyle widget cookie identifier, the Platform's customer or session identifier, browser type and version, operating system, device type, and language.
Behavioral data: products viewed, widget impressions and clicks, outfit selections, add-to-cart events, and timestamps.
Order data: for orders placed in the preceding sixty (60) days, the order ID, date, line items, total, currency, and a hashed customer identifier, used solely to measure whether Ustyle's suggestions led to a purchase. We do not store shopper names, email addresses, postal addresses, phone numbers, or payment details.
Approximate location: country and region derived from the IP address, for regional reporting only. We do not collect precise geolocation.

4.3 Purposes

We process this data only to display outfit suggestions on the store, to measure the conversion and revenue attributable to those suggestions in the Merchant's dashboard, and to respond to data subject requests forwarded by the Merchant or the Platform. Outfit suggestions are based on product catalog analysis, not on profiles of individual shoppers, and produce no legal or similarly significant effects for You.

4.4 Cookies Set by the Widget and Consent

The widget sets a first-party cookie on the Merchant's domain, referred to here as the Ustyle attribution cookie. It contains a random identifier that allows Us to link a click on an outfit suggestion to a later add-to-cart or checkout event in the same store, and to avoid loading the same visual assets twice in a session. It is not used to track You across different websites and is not shared with advertisers. It expires after no more than thirty (30) days.

Because this cookie is not strictly necessary to display the store, it requires Your consent under the ePrivacy rules. The widget reads the consent state provided by the store's consent banner (for example through the Shopify Customer Privacy API or a supported consent management tool on WooCommerce) and does not set the attribution cookie until You have consented. If You decline, outfit suggestions are still displayed, but Your interactions are not linked to purchases. You can withdraw consent at any time through the store's cookie settings or by deleting cookies in Your browser.

4.5 Retention

Event data containing online identifiers is deleted or irreversibly aggregated within thirty (30) days of collection. Order data is deleted or aggregated after the sixty (60) day attribution window. All data relating to a store is deleted within thirty (30) days after the Merchant uninstalls the app.

5. Website Visitors and Business Contacts

5.1 Website Visitors

When You visit https://ustyle.it We process technical data (IP address, browser, operating system, pages visited, referring site, timestamps) to deliver the site securely and to understand how it is used. Legal basis: Our legitimate interest in operating and securing the Website (Article 6(1)(f) GDPR). Analytics and any non-essential cookies on the Website are set only with Your consent, requested through the cookie banner, and are described in the Website's cookie notice. Strictly necessary cookies (such as those that remember Your cookie choices) are set without consent.

5.2 Contact Forms, Demo Requests, and Support

If You write to Us or request a demo, We process the data You provide (name, email, company, message) to reply to You and follow up on Your request. Legal basis: pre-contractual measures taken at Your request (Article 6(1)(b) GDPR) or, for general enquiries, Our legitimate interest in responding to You (Article 6(1)(f) GDPR). We keep this data for up to twenty-four (24) months after Our last exchange.

5.3 Business Contacts and Prospects

We may contact representatives of fashion e-commerce businesses whose professional contact details are publicly available (for example on a company website or a professional network) or were obtained at an event, to present Ustyle. We process name, role, company, and business contact details for this purpose. Legal basis: Our legitimate interest in promoting Our services to businesses (Article 6(1)(f) GDPR). You may object at any time by replying to Our message or writing to [email protected], and We will stop contacting You. We keep prospect data for up to twenty-four (24) months from the last contact.

6. Sharing Personal Data

We share personal data only with the following categories of recipients:

Service providers (processors) acting on Our instructions. The current list of Our sub-processors, with their role and processing location, is published on the Sub-processor List page of the Website. At the date of this Policy they include Microsoft Azure (hosting, North Europe), Amazon Web Services (database, Frankfurt), Cloudflare (CDN and security, global edge), AI model providers such as Google Cloud (AI inference on catalog data only, EU and US, or as stated on the Sub-processor List), and PostHog (dashboard analytics, EU).
E-commerce Platforms: all Subscriptions are billed through the Shopify App Store or the WooCommerce Marketplace, and the Platform processes Your billing as an independent controller under its own privacy policy.
Professional advisors and authorities: accountants, lawyers, and auditors bound by confidentiality, and public authorities where disclosure is required by law or by a binding request from a competent authority.
Corporate transactions: in connection with a merger, acquisition, financing, or sale of assets, personal data may be disclosed to the parties involved and their advisors under confidentiality obligations, and transferred to the successor entity, which will be bound by this Policy.

We do not sell personal data and do not share it with advertisers.

7. International Transfers

We process personal data within the European Economic Area. Where a service provider processes data outside the EEA (for example, an AI provider processing catalog data in the United States, or Cloudflare routing traffic through its global network), We rely on an adequacy decision of the European Commission, including the EU-US Data Privacy Framework for certified recipients, or on the Standard Contractual Clauses adopted by the European Commission, supplemented where necessary by additional safeguards. You may request a copy of the relevant safeguards by writing to Us.

8. Retention

Merchant account and Subscription data: for the duration of the Subscription and up to twelve (12) months afterwards, unless a longer period applies below.
Invoices and accounting records: ten (10) years, as required by Italian tax and accounting law.
Catalog data and generated content: deleted within thirty (30) days after uninstallation or termination.
Support and contact correspondence: twenty-four (24) months after the last exchange.
Dashboard usage logs: twelve (12) months.
Customer lists received for advertising audiences under a Managed Plan: deleted within seven (7) days of upload to the advertising platform; campaign working files and reports: thirty (30) days after the end of the Managed Plan.
Security logs: up to twelve (12) months.
End User data: as set out in Section 4.5.
Anonymized, aggregated statistics that cannot identify any person or store: indefinitely.

9. Your Rights

Under the GDPR You have the right to:

Access the personal data We hold about You and receive a copy
Rectify inaccurate or incomplete data
Erase Your data, where there is no overriding reason to keep it
Restrict processing in the circumstances set out in Article 18 GDPR
Receive the data You provided to Us in a portable format and have it transmitted to another controller
Object to processing based on Our legitimate interests, including direct marketing, at any time
Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal
Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects on You. We do not carry out such decisions.

To exercise these rights, write to [email protected]. We will respond within one month, extendable by two further months for complex requests, and We may ask You to verify Your identity. If You are an End User of a Merchant store, please contact the Merchant, who is the data controller; We will forward any request We receive to the Merchant.

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of Your habitual residence, place of work, or place of the alleged infringement. The Italian supervisory authority is the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma, www.garanteprivacy.it.

10. Security

We apply technical and organizational measures appropriate to the risk, including encryption in transit (TLS) and at rest, pseudonymization of online identifiers at collection, role-based access control with multi-factor authentication, logging, encrypted backups within the EEA, and confidentiality obligations for all personnel. Our measures are described in more detail in Annex 2 of the Data Processing Addendum.

11. Children

The Service is designed exclusively for businesses and is not directed at anyone under the age of 18. We do not knowingly collect personal data from children under 14, the age of digital consent in Italy. If You believe a child has provided personal data to Us, contact Us and We will delete it promptly.

12. Changes to this Privacy Policy

We may update this Policy from time to time. We will post the updated version on this page and change the "Last updated" date. For material changes affecting Merchants, We will also notify You by email to Your registered Account address at least thirty (30) days before the changes take effect.

13. Contact Us

If You have any questions or wish to exercise Your rights, You can contact Us:

By email: [email protected]
By post: Ustyle SRL, c/o I3P, Incubatore del Politecnico di Torino, Corso Castelfidardo 30/A, 10129 Torino TO, Italy