Privacy policy

1. Who we are

Byte Shift Ltd, registered in England and Wales under company number 13244292, registered office Office 408, Screenworks, 22 Highbury Grove, London, N5 2ER, is the controller of the personal data described here. Write to us about anything on this page at support@fashionstudioapp.com.

This policy covers FashionStudio and this website. We are not required to appoint a data protection officer and have not appointed one; the address above reaches the people responsible.

2. Two different roles

For your account data, we are the controller: we decide what is collected and why, and this policy explains it.

For personal data inside the photographs you upload, for example the face of a model in a photograph you own, you are the controller and we act as your processor. We handle that material on your instructions, which you give by using the service. Our data processing agreement sets out those terms, and you must have your own lawful basis and the necessary consent for that material before you upload it.

3. What we collect, why, and for how long

We do not collect special category data deliberately. A photograph of a person can reveal characteristics such as ethnicity, and we process it as ordinary image data on your instructions rather than to infer anything about anyone. Do not upload health, biometric or other sensitive material: the service is not designed for it.

4. AI, and what we do not do with your photographs

We do not use your uploads, your product descriptions or your generated photographs to train, fine tune or evaluate any AI model, ours or a third party's. There is no opt out because there is nothing to opt out of.

To produce your photographs we send them to the AI providers listed in our subprocessor list. We use their business or enterprise arrangements, under which submitted content is not used to train their models. Providers may retain content briefly to run abuse detection, and we keep the list current so you can see exactly who is involved.

We record the fact and cost of each AI call, the model used and the account it belonged to, so we can bill correctly and detect abuse. Those records contain no image data.

5. Who else sees your data

We do not sell personal data, and we do not share it for anyone else's advertising. We share it only with:

• the processors in our subprocessor list, each under a contract that restricts them to our instructions;
• professional advisers, and a buyer of our business if it is sold, in which case this policy continues to apply until you are told otherwise;
• the authorities, where we are legally required to, or where it is necessary to establish, exercise or defend legal claims.

6. Sending data outside the UK

Some of our processors are outside the United Kingdom. Where that happens we rely on UK adequacy regulations where they exist, and otherwise on the International Data Transfer Agreement or the UK Addendum to the European Commission's standard contractual clauses, together with an assessment of the safeguards in the destination country. Ask us and we will tell you which applies to a given provider.

7. How we protect it

Passwords are stored only as bcrypt hashes and are never recoverable, by us or by anyone else. Session tokens are stored hashed and expire automatically. Your uploaded and generated images are served only through authenticated routes scoped to your own account, never from a public folder. Administrative access uses a separate system with separate credentials from customer accounts, and administrators cannot read your password.

No service is perfectly secure. If a breach affects your rights we will tell the Information Commissioner's Office within 72 hours where required, and tell you without undue delay where the risk to you is high.

8. Your rights

Under UK GDPR you can ask us to:

• give you a copy of the personal data we hold about you;
• correct anything inaccurate;
• delete your data, which for most of it means closing your account;
• restrict or object to processing we carry out under legitimate interests;
• send your data to you or another provider in a portable form;
• withdraw consent, where we relied on it, without affecting processing before you withdrew.

Write to support@fashionstudioapp.com. We answer within one calendar month, and usually much sooner. There is no charge unless a request is manifestly unfounded or excessive.

You can also complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk or on 0303 123 1113. We would rather you came to us first so we can put it right.

9. Cookies

This website sets no cookies at all. The application sets one strictly necessary cookie to keep you signed in, and stores your light or dark preference in your own browser. There is no advertising, profiling or cross site tracking, which is why you are not being asked to accept anything. The cookie policy lists each one.

10. Children

The service is for adults. It is not directed at children, we do not knowingly collect data about anyone under 18, and we delete such an account if we discover one.

11. Changes to this policy

We update this policy as the service changes. The date at the top of this page always reflects the current version, and we will tell you by email before a change that materially affects your rights takes effect.