Privacy Policy

1. Who is responsible

The controller under the GDPR is Yacine Bensaid, trading as Kleiders. Contact for all privacy questions: support@kleiders.com.

We are a small team and are not required to appoint a data protection officer. Write to the address above and a founder will answer.

2. What we process and why

Visiting the website

Our host Vercel processes your IP address, browser type and the pages you request so the site can be delivered and protected against attacks. Legal basis: our legitimate interest in a working, secure website (Art. 6(1)(f) GDPR). Server logs are kept for a short time, usually a few days.

Your account

Name, email address, username, a hashed password, the choices you make during onboarding (for example your role and the sizes you work with), the date and version of the terms you accepted, and referral codes. We need this to provide the account (Art. 6(1)(b) GDPR). It is stored until you delete your account.

Your designs

Your descriptions, the images you upload, the garment views we generate for you, patterns, measurements and size profiles (including measurements you enter for your own clients). We process them to provide the service (Art. 6(1)(b) GDPR). They are kept until you delete them or your account.

Checking quality

We may look at generated garments, patterns and the requests behind them to find errors and improve the quality of Kleiders. We do not use them to train AI models, do not use them for marketing and do not make them public unless you choose to. Legal basis: our legitimate interest in a service that works (Art. 6(1)(f) GDPR).

Photos of people

If you upload photos that show people, including their faces, we process them only to create the results you ask for. We do not use them to recognise or identify anyone. Only upload photos of other people if they agree.

Emails

Account emails (sign-up, password reset, security notices) are needed for the account (Art. 6(1)(b) GDPR). Our newsletter is only sent if you sign up for it (Art. 6(1)(a) GDPR); you can unsubscribe in every email.

Abuse protection

To stop abuse and runaway costs we count requests per account and per IP address (for example the number of designs per minute and per day). These counters expire on their own after minutes to at most two days. Legal basis: our legitimate interest in protecting the service (Art. 6(1)(f) GDPR).

Usage statistics

We use Umami, a cookieless analytics tool, to count page views and how features are used (for example how many designs are created). When you are signed in, these events are linked to your account ID. Legal basis: our legitimate interest in improving the product (Art. 6(1)(f) GDPR).

Optional analytics

Only if you accept them in the cookie banner, we also use Google Analytics and Microsoft Clarity. Clarity can record how you move through pages (session replays, with text fields masked). Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can change your choice at any time in the cookie settings at the bottom of the page.

Support

When you write to us, we use your message and email address to answer (Art. 6(1)(b) or (f) GDPR) and keep the conversation as long as needed for that.

Your own API key

If you add your own AI provider key, we store it encrypted and use it only for your requests. Your contract with that provider then applies, including whether it may use your data.

Payments

Paid plans are not available yet. When they are, payments will be processed by Stripe and we will keep invoices for the 10 years required by German tax law.

3. How we use AI

When you write to the studio, you are working with an AI system, not with a person. Answers, garment views and patterns are generated automatically.

Kleiders uses Google's Gemini API to read your request and draw garment views. Your words and images are sent to Google for that purpose. We use the paid Gemini API, under which Google does not use your prompts or results to train its models and processes them as our processor. Google keeps them for a limited time to detect misuse.

We do not train AI models on your designs, uploads or results, and we do not sell them.

Images generated by AI carry Google's invisible SynthID watermark, and we add a machine-readable label saying they were generated by AI, as the EU AI Act requires (Art. 50). Please do not remove these marks.

AI can make mistakes. Check garment views and patterns before you rely on them, for example with a test garment. No decision with legal or similarly significant effect on you is made automatically (Art. 22 GDPR).

4. Who receives your data

We only share data with service providers that help us run Kleiders, under data processing agreements:

Vercel

hosting, servers in Frankfurt (Vercel Inc., USA)

Supabase

database, EU region

Upstash

abuse protection counters, EU region

Google (Gemini API)

AI processing of your requests

Cloudinary

storage and delivery of images

Cloudflare

backup image description service, only used when the main one is unavailable

Resend

sending emails

Umami

cookieless usage statistics

Google Analytics and Microsoft Clarity

only with your consent

Stripe

payments, once paid plans are available

Some of these companies are based in the USA or may access data from there. Transfers are covered by the EU–US Data Privacy Framework where the provider is certified, and otherwise by the EU Standard Contractual Clauses (Art. 45 and 46 GDPR).

We do not sell personal data, and we only pass data to authorities if the law requires it.

5. Cookies and storage on your device

Necessary

a sign-in cookie, your language and your cookie choice. These are needed for the site to work and do not need consent (§ 25(2) TDDDG).

Designs started before signing in

when you describe a garment or add images on the home page before you have an account, they are kept only in your browser (IndexedDB) so they are waiting in the studio after you sign up or log in. Nothing is sent to us until you press Create. The copy is deleted when the design is made, when you start a new design, when you sign out, or after 24 hours.

Unsaved edits

the pattern editor keeps unsaved changes in your browser so they are not lost if the tab closes.

Optional

Google Analytics and Microsoft Clarity set cookies only after you accept them.

6. How long we keep data

Account data and designs: until you delete them or your account. Deleted data disappears from backups within about 30 days. Records of your consent: as long as the account exists and up to three years after, to be able to prove it. Server logs and abuse counters: from minutes to a few days. Invoices, once there are paid plans: 10 years.

7. Your rights

You can at any time ask us for:

• access to your data and a copy of it (Art. 15 GDPR),
• correction of wrong data (Art. 16),
• deletion (Art. 17); you can also delete your account yourself in the settings,
• restriction of processing (Art. 18),
• your data in a common machine-readable format (Art. 20).
• You can object at any time to processing based on our legitimate interest (Art. 21), and withdraw any consent with effect for the future (Art. 7(3)).
• You can complain to a data protection authority, for example the Bavarian State Office for Data Protection Supervision (BayLDA), or the authority where you live.

Just write to support@kleiders.com.

8. Do you have to provide data?

You need an email address and password to create an account. Everything else is optional, but the studio cannot make a design without a description or an image.

9. Changes

When Kleiders changes, this policy changes too. We will show the date of the latest version at the top and tell you by email about important changes.