Plain language summary
MedaStaré processes the information needed to operate your account, provide wardrobe, styling, beauty, visual and AI features, manage subscriptions, protect the Service and answer support requests. Certain AI features may send user selected information to an identified AI provider only after the app presents a specific notice and obtains the consent required for that transfer. You can manage optional permissions, request access or export, and initiate account deletion through the app.
This summary is not a substitute for the complete Policy below. The complete Policy controls.
1. Who we are
MedaStaré Inc. is the controller of personal data processed through the MedaStaré website, mobile application and related services, except where another party is clearly identified as an independent controller. MedaStaré Inc. is a United States company.
Privacy and support requests may be sent to support@medastare.com. Where applicable law requires a local representative, data protection officer or additional public company information, MedaStaré will publish that information in the Legal Notice or a regional supplement before the relevant requirement becomes applicable.
2. Scope of this Policy
This Policy applies to the public website, the MedaStaré mobile application, account registration, subscriptions, customer support, business inquiries, creator or agency communications, and any feature or campaign that links to this Policy.
A feature specific notice may provide additional information at the moment data is collected. Where a feature specific notice directly conflicts with this Policy, the more specific notice controls for that feature. Independent third party services remain subject to their own privacy notices.
3. Personal data we may process
Account and authentication data
- Name, email address, account identifier and profile details you provide.
- Authentication records, verification status, login events and security information.
- Identifiers received from Sign in with Apple or another login method that you choose.
Style, wardrobe and personalization data
- Style, color, fit, sizing, mood, occasion and preference information.
- Wardrobe photographs, garment descriptions, saved outfits, notes and StyleTrack history.
- Body related styling inputs such as proportions, measurements or silhouette preferences when voluntarily provided.
Photos, videos, voice and AI content
- Photos or videos you select for outfit, garment, appearance, beauty, body, nail or visual analysis.
- Prompts, conversations, voice inputs, generated outputs and feedback connected with MedAI and other AI features.
- Technical attributes created to provide a requested feature, such as style tags, visual descriptors or recommendation context.
Sensitive information
- Face and body images may be sensitive because of their content. MedaStaré does not use them to identify or authenticate you unless a separate feature expressly states that it performs biometric identification and obtains any legally required permission.
- Cycle information may be processed only when the relevant feature is enabled and the user chooses to provide it. It is not used for advertising.
- MedaStaré does not ask users to submit medical records and does not provide medical diagnosis or treatment.
Transactions, device and support data
- Subscription status, product entitlement, purchase and restoration information received from Apple.
- Device type, app version, operating system, language, coarse region, network and diagnostic information.
- Interaction data such as screens or features used, performance events and crash information, subject to applicable permissions and preferences.
- Notification token and notification preferences when notifications are enabled.
- Support correspondence and information voluntarily provided in a business or partnership inquiry.
- Website request data such as IP address, browser information, server logs and consent preferences where applicable.
4. How we obtain data
We obtain personal data directly from you, from your use of the Service, from device permissions you choose to grant, from Apple and other enabled identity or platform services, and from service providers that help us operate security, hosting, communications, diagnostics and AI functions. We do not collect photos, microphone input, location or contacts merely because the app is installed. Collection begins only when a feature needs the information and the applicable permission or consent has been provided.
5. Why we process data
| Purpose | Typical data | Legal basis where applicable |
|---|---|---|
| Create and secure an account | Account, authentication and security data | Performance of the user agreement, legitimate security interests and legal obligations. |
| Provide styling, wardrobe and AI features | User selected content, preferences, prompts, images and feature context | Performance of the requested service and consent where required, especially for third party AI transfers. |
| Manage subscriptions | Apple transaction, entitlement and account data | Performance of the subscription agreement and legal obligations. |
| Personalize the experience | Preferences, saved content, history and product interaction | Performance of the service, consent, or legitimate interests where permitted. |
| Operate support and communications | Contact details, messages and limited diagnostics | Performance of the service, legitimate interests and consent for optional marketing. |
| Protect users and the Service | Security logs, authentication events, abuse signals and device information | Legitimate interests, legal obligations and protection of rights. |
| Measure and improve performance | Limited product interaction and diagnostic information | Consent where required and legitimate interests for essential service diagnostics. |
| Comply with law and resolve disputes | Relevant account, transaction, consent and request records | Legal obligation and establishment, exercise or defense of legal claims. |
Where consent is the legal basis, you may withdraw it for future processing. Withdrawal does not make earlier lawful processing unlawful. Some features cannot operate without the data that is necessary to perform them.
6. AI processing and automated systems
MedaStaré uses AI assisted systems to create style guidance, wardrobe combinations, visual analysis, conversational responses, beauty appearance observations, creative outputs and related features. The specific data, provider, purpose and relevant retention information for an external AI request are disclosed in the app before personal data is transmitted when consent is required.
- MedaStaré does not make decisions that produce legal or similarly significant effects solely through fashion or beauty recommendations.
- AI outputs may be incomplete, inaccurate, biased or unsuitable. Users should review outputs and use independent judgment.
- Private account content will not be used by MedaStaré to train a generally available model without a separate affirmative choice.
- Provider training and retention practices depend on the active provider, API plan and contract. The current information is shown in the app and on the AI Data Processing page.
- Authorized personnel may access limited content when needed for support, safety, abuse investigation, quality review requested by the user, or legal compliance. Access is restricted according to role and purpose.
More information is available in the AI Data Processing Notice.
7. Device permissions and user controls
- Photos and camera are requested only when the user selects or captures media for a feature. Where possible, the app uses Apple system pickers rather than requesting access to the entire photo library.
- Microphone access is requested only when a voice feature is started. Text input remains available where practical.
- Location is used only for a feature such as weather aware styling. A manually selected city may be offered instead.
- Notifications are requested in context and can be changed in the app or iOS settings.
- Optional analytics and marketing communications are controlled separately from account, AI and subscription choices.
Denying an optional permission does not prevent unrelated features from working.
9. No sale for advertising
MedaStaré does not sell personal data for money and does not use private photos, wardrobe content, prompts, beauty inputs, body inputs or cycle information for cross context behavioral advertising. MedaStaré does not authorize advertising networks to build advertising profiles from those categories. If the business model changes in a way that creates a legal right to opt out of sale, sharing or targeted advertising, MedaStaré will provide the required notice and control before the change takes effect.
10. International data transfers
MedaStaré is based in the United States and operates globally. Personal data may be processed in the United States and other countries where MedaStaré or its service providers operate. Those countries may have different data protection laws.
Where applicable law requires a transfer mechanism, MedaStaré will use an available lawful mechanism such as contractual protections, adequacy decisions, certifications or other legally recognized safeguards. Users may contact MedaStaré for information about applicable safeguards.
11. Retention and deletion
MedaStaré keeps personal data only for as long as reasonably necessary for the purpose described, the user relationship, security, dispute resolution and legal obligations. Retention is determined by data category and feature rather than a single period.
| Category | General retention approach |
|---|---|
| Account and profile | Kept while the account is active. After a verified deletion request, removed from active systems subject to lawful exceptions and backup rotation. |
| Wardrobe, saved outfits and style history | Kept until the user deletes the content or the account is deleted, unless a shorter feature setting applies. |
| Temporary AI inputs | Kept only as long as needed to complete the request and meet security or provider requirements. Provider specific information is disclosed before transfer. |
| AI chats and generated content | Kept according to the user history setting until deletion, account deletion or a shorter product rule. |
| Purchase and accounting records | Kept for the period required by tax, accounting, platform and consumer laws. |
| Security and abuse records | Kept for a limited period proportionate to fraud prevention, security and legal defense needs. |
| Support records | Kept as needed to resolve the request, document the response and protect legal rights. |
| Consent and privacy request records | Kept as evidence of the user choice and legal compliance for the applicable limitation period. |
| Backups | Deleted or overwritten through scheduled rotation. Backups are isolated from ordinary use and restored only for continuity or security needs. |
Deletion does not require removal of data that must be retained by law, is necessary to protect security or legal rights, or has been irreversibly anonymized so that it no longer identifies a person.
12. Security
MedaStaré uses administrative, technical and organizational safeguards designed to protect personal data. Depending on the system, safeguards may include encryption in transit, private object storage, signed media links, access control, credential protection, logging controls, vendor review, backup procedures and incident response.
No system can be guaranteed completely secure. Users are responsible for keeping account credentials confidential and should contact support if they believe an account has been compromised. Security concerns may be reported through the Security page.
13. Your privacy rights
Depending on your location and the circumstances, you may have rights to be informed, obtain access, correct data, delete data, restrict processing, object, withdraw consent, receive portable data, opt out of certain sale or targeted advertising practices, request review of certain automated decisions, appeal a denied request and complain to a regulator.
The easiest controls are available in the app under Privacy and Legal. Users who cannot access the app may use the Privacy Choices page or email support. MedaStaré may verify identity proportionately before acting on an account specific request. MedaStaré will not discriminate against a user for exercising a privacy right.
Requests are handled within the period required by applicable law. An extension may be used when legally permitted and reasonably necessary, with notice. Certain rights are subject to exceptions that protect other people, security, legal obligations and confidential information.
14. Regional information
European Economic Area and Italy
Users in the European Economic Area may exercise rights of information, access, rectification, erasure, restriction, portability, objection, withdrawal of consent and complaint to a competent supervisory authority. Processing is based on contract, consent, legitimate interests, legal obligation or another lawful basis. Mandatory consumer and privacy rights remain unaffected.
Brazil
Users in Brazil may request confirmation of processing, access, correction, information about sharing, anonymization, blocking or deletion where applicable, portability, withdrawal of consent and review of certain automated processing, subject to the LGPD and lawful exceptions.
United Arab Emirates
Users in the United Arab Emirates may exercise applicable rights under the federal personal data protection framework, including rights connected with consent, access, correction, restriction, transfer and objection, subject to lawful exceptions and the applicable implementing rules.
Singapore
Users in Singapore may request access and correction and may withdraw consent with reasonable notice. MedaStaré applies purpose notification, protection, retention limitation, transfer limitation and accountability controls as applicable under the PDPA.
Philippines
Users in the Philippines may exercise applicable rights to be informed, access, object, rectify, request erasure or blocking, portability, damages and complaint under the Data Privacy Act, subject to lawful limitations.
United States
Residents of certain United States states may have rights to know, access, correct, delete, obtain a portable copy, opt out of certain sale, sharing, targeted advertising or profiling, limit certain sensitive data uses, and appeal a decision. MedaStaré does not currently sell personal data for money or use private app content for cross context behavioral advertising.
15. Children
The Service is intended for users who are at least 18 years old. MedaStaré does not knowingly create accounts for children or process their personal data in violation of applicable law. A parent or guardian who believes that a child provided personal data should contact support. MedaStaré may delete the data and close the account after appropriate verification.
16. Account deletion
A user with an account can initiate deletion through Settings > Account > Delete Account. The app explains the data affected, any lawful retention, processing status and the effect on active subscriptions. Deleting a MedaStaré account does not automatically cancel billing managed by Apple. More information is available on the Account and Data Deletion page.
18. Changes to this Policy
MedaStaré may update this Policy to reflect product, legal, security or operational changes. The effective date and version will be updated. Material changes will receive additional notice, and renewed consent will be requested where law requires it. Historical versions are retained internally.
19. Contact and complaints
Questions, privacy requests and complaints may be sent to support@medastare.com. Please do not send passwords, Apple account credentials, full payment card information, intimate images or medical records by email.
You may also complain to the data protection authority or regulator in your country where applicable. MedaStaré asks users to contact support first so the issue can be reviewed, but this does not limit a right to contact a regulator.