DRAEVA Privacy Policy

Note: The app was previously published under the name giybibak (Weardrobe). This Policy applies to DRAEVA, the new name of the same service; references made under the former names refer to DRAEVA.

This Privacy Policy describes our policies and procedures on the collection, use and disclosure of your information when you use the DRAEVA app, and tells you about your privacy rights and how the law protects you.

This text informs you about the processing of your personal data; on its own it is not a request for, or a grant of, explicit consent. Processing that requires explicit consent is subject to separate, optional permission.

Current state of getdraeva.com: This policy describes the DRAEVA service as a whole. Login, sign-up, payment and the waitlist are currently closed on the getdraeva.com marketing website; no new account, password or payment data is collected through these areas. The mobile app provisions below apply when the relevant app feature is used.

Interpretation and Definitions

Interpretation

Words with an initial capital letter have the meanings defined under the following conditions. The following definitions have the same meaning whether they appear in the singular or the plural.

Definitions

For the purposes of this Privacy Policy:

• Account means a unique user account created for you to access the DRAEVA service.
• App refers to DRAEVA, the mobile (iOS, Android) and web application provided by the Company.
• Company (referred to as "the Company", "We", "Us" or "Our" in this Policy) refers to Draeva.
• Cookies are small files placed on your computer or mobile device by a website, containing details of your browsing history.
• Country refers to the Republic of Türkiye.
• Device means any device that can access DRAEVA, such as a computer, mobile phone or tablet.
• Personal Data means any information relating to an identified or identifiable individual.
• Service refers to the DRAEVA mobile app and website.
• Service Provider refers to third-party companies that process data on behalf of the Company (see "Service Providers and Data Recipients").
• Sale of Personal Data refers to the transfer of personal data to third parties for monetary or other valuable consideration. DRAEVA does not sell your personal data (see "Sale of Personal Data and Advertising").
• Usage Data refers to data generated automatically through use of the Service (for example, number of AI operations, session length).
• Website refers to the DRAEVA web application (https://getdraeva.com).
• You means the individual accessing or using the Service.

Collecting and Using Your Personal Data

Types of Data Collected

Personal Data

While using our Service, we may ask you to provide certain personally identifiable information that can be used to contact or identify you. Personally identifiable information may include, but is not limited to:

Information Collected at Sign-up:

• Email address
• Password (stored encrypted by Firebase Authentication; your password never reaches us in plain text)
• Name / display name
• Profile photo (optional)
• If you use Sign in with Apple or Sign in with Google, the identity information that provider passes to us (email, name). If you choose to hide your email with Sign in with Apple, we receive the relay address created by Apple.

Profile and Style Information (Onboarding and Style Analysis): To generate personalized recommendations, we collect the preferences you give during first setup, which you can later update in settings:

• Your preferred silhouette/gender presentation, your display name
• Morning getting-ready time, decision-making habits, how much the weather affects you
• Heat/cold sensitivity (thermal preference), fit preference, upper/lower body size information
• Lifestyle and social activity preferences, weekly number of office/campus days, daily role
• Your style card swipe results: styles you liked/disliked and the style category scores derived from them
• The DRAEVA stylist character matched to you and the reasons for the match

Information Collected During Use:

• Wardrobe Data: Clothing photos you upload, clothing names, categories, colors, and labels such as fabric/season
• AI Processing Data: Daily outfit recommendations, clothing images with the background removed, and other AI-generated outputs
• Outfit Journal Photos: Outfit photos you save for your own archive (visible only in your account; they may include photos taken of you wearing the clothes)
• Calendar and Wear Records: Which outfit you planned/wore on a given day, feedback you give after wearing an outfit (I was cold/comfortable/sweating, how I felt, how others reacted) and a snapshot of the weather at the time of that feedback
• Stylist Chat: Messages you send to the DRAEVA stylist character, photos and wardrobe item references you share during the chat, and your daily message usage counters
• Credit and Aura Transactions: History of AI feature use, credit spending records, Aura points, outfit streak records, referral code and referral relationships
• Social Data: Your public username and profile card, your Discover posts, captions and tags, likes/saves and follow relationships, block and report records, style group memberships, invitations and your votes in outfit polls. For anonymous posts, authorship is kept private on the server for safety and deletion purposes.
• Wishlist: The product link you add, product name, image, store and price information where available, and your saving preferences are stored linked to your account. To fetch product information, our server makes a request to the site the link belongs to; that site can see the requested address and the technical details of the connection. If you open the external product page, that site's own data practices apply. Do not add session keys or personal information to links.
• Device Information: Device type, operating system, app version, language/region setting, device identifiers
• Notification Data: Your notification permission status and the push notification token assigned to your device by Firebase Cloud Messaging (FCM)
• Usage Statistics: Feature usage frequency, session length, screen views, number of AI operations
• Diagnostic Data: Crash reports, error logs and performance measurements

Payment and Subscription Information:

• App Store / Google Play (Mobile): Payment information is processed by Apple and Google; we do not store it.
• RevenueCat: Mobile subscriptions are managed through RevenueCat's infrastructure to verify and manage subscription status. Only your Firebase user ID (UID), the purchase receipt and platform/device information are passed to RevenueCat as the user identifier; your name or email address is not sent to RevenueCat.
• Stored Information: Subscription plan, purchase date, transaction ID, subscription status, promotion/campaign code used.

Location and Weather Data:

• City and District Information: The city and district used for weather recommendations are stored in your user profile.
• Automatic Location Detection (Optional): The app offers an option to determine your city/district automatically instead of selecting it manually. When you use this option, your device's operating system asks for approximate (coarse) location permission, and your location is processed only at that moment and only on your device: your coordinates are compared with the province/district coordinate list embedded in the app to find the nearest province/district. Your raw GPS coordinates are not sent to our servers, are not passed to a map/reverse-geocoding service and are not stored — the only information saved to your profile is the name of the province/district found.
• Permission and Control: Location permission is entirely optional. If you do not grant it, or withdraw it later, you can keep using the weather features by selecting your city/district manually. The app does not collect location in the background; background location is disabled on iOS and Android, and precise (fine) location permission is blocked on Android.
• OpenWeatherMap API: Weather information is obtained from the OpenWeatherMap API (https://openweathermap.org/privacy-policy). Only province/district-level location is sent to this service.
• Caching: Weather data is cached locally on your device and refreshed when it expires.
• Purpose of Use: Location and weather information is used only to make clothing/outfit recommendations and to show the weather screen/widget; it is not used for advertising, profiling or location tracking.

• Usage Data

Usage Data

Optional app usage measurement starts only when the separate permissions described below are enabled. Server processing records necessary to provide and secure the Service are separate from this optional measurement.

Usage Data may include information such as your Device's Internet Protocol address (e.g. IP address), browser type, browser version, the pages of our Service that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers and other diagnostic data.

The mobile app offers two separate options that are off by default:

• Usage analytics: If you allow it, screen views, feature usage, purchase events, device/app information and, where necessary, usage categories with your account ID (UID) are sent to Google Firebase Analytics. The purpose is to understand and improve how the app is used. Google advertising storage and ad personalization are not turned on by this choice.
• Error and performance reports: If you allow it, error/crash details, technical context, device/app information, performance measurements and network request addresses may be sent to Google Firebase Crashlytics and Performance Monitoring. Error reports may be linked to your account ID. The purpose is to detect and fix technical problems.

These choices are separate from Meta advertising measurement, from the AI permission and from acceptance of the general policy. You can sign up and use the app without granting them. Your choice, the version of the notice and the time are stored on this device and can be changed under Settings → Privacy & Data. Withdrawing stops future measurement; it does not automatically delete data already sent to providers. For data requests, you can contact info@getdraeva.com. Providers may process data abroad; transfer safeguards must be provided separately. Records linked to a UID are not considered anonymous.

Firebase App Check: Firebase App Check, based on Apple App Attest / Google Play Integrity, is used to verify that costly server-side operations (AI calls, etc.) come only from the genuine DRAEVA app. This verification checks the integrity of the device; it is not used to identify or track you.

New Areas on the Marketing Website

• Analytics: Google Analytics 4 loads only after you explicitly allow the Analytics category in the cookie preference panel. Without permission, no analytics script, page view or custom event is sent. The name, email, subject and message from the contact form, and the file name or image content uploaded to tools, are not added to analytics events.
• Ad measurement (Google Ads): The Google Ads conversion tag loads on every page in Google Consent Mode v2 advanced mode. If you do not allow the Marketing category, it does not read or write cookies and sends Google only cookieless signals without identifiers (that a page view or conversion happened, plus technical data such as IP address and browser information), which Google uses to model conversions in aggregate. If you allow it, page views and the fact that the demo form was submitted successfully are sent to Google Ireland Ltd. together with the browser/device data Google collects itself, and may be processed outside your country. The name, email, phone and message from the form are not sent to Google; enhanced conversions are off. Google Consent Mode v2 signals start as denied and are updated from your cookie choice.
• Ad measurement (Meta Pixel): Meta Pixel loads only after you explicitly allow the Marketing category in the cookie preference panel. Page views and the fact that the demo form was submitted successfully are sent to Meta Platforms Ireland Ltd. together with the browser/device data Meta collects itself, and may be processed outside your country. The name, email and message from the form are not sent to Meta.
• Contact form: Form submissions are validated on the server; a honeypot, request size limit and safe header checks are applied. If no email provider is configured, the form does not send and does not show a false success message. Rate limiting is not currently active; if abuse is observed, a serverless-safe persistent limiter will be added. When the integration is enabled, the name, email, subject and message are passed to the email delivery provider solely to respond to the request.
• Web background removal tool: In the current version, only a local preview is active; no real background removal provider is connected. Images are not written to disk, a database or persistent object storage. Before a provider is enabled, data transfer, processing location and the provider's retention behavior will be updated separately in this Policy.

Information Collected While Using the App

While you use the DRAEVA app, we may collect the following with your prior permission to provide these features:

• Camera Access: To take photos of clothing, the outfit journal and the user
• Photo Library Access: To select clothing, outfit journal and user photos from your existing photos
• Storage Access: To save photos to your device
• Notification Permission: To send daily outfit reminders, weather alerts and social interaction notifications
• Location Permission (Optional, approximate location): Only to determine your city/district automatically as described above

We use this information to:

• Create and manage your wardrobe (including removing the background from clothing photos and labeling them)
• Create your outfit journal and calendar
• Generate personalized daily outfit and weather recommendations
• Provide the stylist chat

Sharing Data with Third-Party Artificial Intelligence Services (Important):

Data processing differs depending on the feature you use:

• On-device outfit generation: Outfit Time and the outfit selection/scoring during first setup are done by the engine on the device. No separate request is sent to a remote outfit generation service for this calculation. Cloud sync of your wardrobe and saved outfits with your account continues.
• Google (Gemini API / Vertex AI): For clothing labeling, the stylist chat and the image analysis/generation features offered, the photos and messages you select and the profile/wardrobe information needed for the operation are sent. Although outfit selection/scoring in the stylist chat runs on the device, the result and clothing references return to the server to prepare and validate the response; the chat is not processed entirely on the device. Retention terms depend on the product used, the contract and data control settings; no zero-retention commitment is made. Privacy Policy: https://policies.google.com/privacy
• Draeva background removal service: The clothing image you select is sent through an authenticated server to the service Draeva operates on Google Cloud infrastructure. This flow does not use a separate external background removal provider. After the background is removed, the output is used in the wardrobe flow; clothing labeling is a separate operation.

If you choose to share a photo in the stylist chat, that photo is also sent to Google to be processed in the same way. This content is sent only to carry out the operation you started.

A permission separate from acceptance of the general Privacy Policy or Terms of Service is requested for transferring data to artificial intelligence services. This permission covers the transfer of the photos you select, chat texts and the profile/wardrobe information needed for the operation to third-party artificial intelligence services within the scope of the analysis, style recommendation and usable image generation features. Your decision is stored on the server with version and time information; these operations do not start without current permission. You can withdraw the permission under Settings → Legal → AI Data Use. Social sharing and model training permissions are separate.

Reporting AI content: When you report a response or image result, the selected content, the reason for the report, the result ID where available and your account ID are recorded privately for review by our team. Your entire chat history is not sent with this report. Reports and their attachments are not visible to other users; review copies of posts removed by moderation are also kept in an area with restricted access; when you delete your account, report records linked to your account and uploaded report attachments are also deleted.

Blocking on anonymous posts: Blocking also applies to anonymous posts through the private author mapping kept on the server. The account ID of the anonymous author is not shown to the blocking user. You can remove all blocks you created through anonymous posts at once under Settings → Legal → AI Data Use.

Social sharing safety — OpenAI: Images, captions and style tags you choose to share on Discover are sent to OpenAI's Moderation API service for inappropriate content checks. This processing is explained separately before sharing, and the version and date of your explicit permission are recorded. If you applied face masking, the masked output is used for the check. Your email address and other contents of your private wardrobe are not added to this check request. Images are re-encoded to remove embedded metadata. A post is not made public until the check is complete. Not granting permission does not prevent you from using your private wardrobe; the post is simply not shared.

Post images and text may be transferred to the provider abroad for the check. The provider's data processing and retention terms are described in OpenAI's API data controls; no "never retained under any circumstances" commitment is made. In our own system, the sharing permission is kept linked to your account and is removed when the account is deleted. You can delete your post from the app. You can contact us at info@getdraeva.com to object to a check result or for data requests.

Additional visual AI features: When offered in the app, the photos and processing inputs you select for virtual try-on, avatar creation and color/fit analysis may be sent to Google Gemini API / Vertex AI, and to OpenAI for avatar generation. These operations are subject to the separate AI data permission. If a feature is not offered in the app, no data will be requested from you for that operation. Social sharing moderation is a different purpose and requires separate sharing permission.

Your personal photos are stored securely in Firebase Storage and are accessible only from your account. (The only exceptions are processed clothing/outfit images added to the global inspiration pool with your explicit consent, and your public profile and social features — see the two sections below.)

Contributing to the Global Inspiration Pool and Public Content (Important):

Outfits you create and clothing you add in the app may be added as contributions to a global inspiration/catalog pool to inspire other users and to improve the quality of AI recommendations/analysis. This contribution happens only with your explicit consent: the feature does not work unless you turn on the "Share your style" and "Share your outfits" options on the Settings → Privacy & Data screen. Consent is also verified on the server.

Images added to this pool are publicly accessible (anyone with the link can view them). Content added to the pool is limited to:

• Clothing images: A processed image with the background automatically removed, containing only the garment itself. Your original photo, which may include the background, your surroundings or other personal elements, is not added to the pool.
• Outfit images: A composite image of clothes combined on a canvas. Your face, body or personal photo does not appear in these images.

Content added to the pool is published without showing your identity; your name, username or profile link is not attached to these images. Your outfit journal photos, private wardrobe items, stylist chats and calendar records are not included in this pool; they are accessible only from your account. These settings only work going forward: when you turn them off, no new content is shared. You can view and withdraw your past contributions from the "Manage past contributions" screen in the app. Content you contributed to the global pool is also deleted from the pool when you delete your account. To request removal of specific content, you can contact us at info@getdraeva.com.

Social Features and Your Visibility Controls (Important):

DRAEVA includes social features you may optionally use. Your private wardrobe does not turn into a Discover post on its own. Profile visibility, Discover sharing and contribution to the global inspiration pool are different preferences; hiding your profile does not delete a Discover post you published earlier.

• Discover and anonymous sharing: The final image, caption and tags you publish are visible to other users on Discover. In anonymous sharing, your profile identity is not shown; Draeva may match the author with their account for safety, blocking and deletion. Anonymous sharing does not mean you cannot be recognized from the image or caption.
• Face masking: Face positions are detected on the device to help you prepare a mask; no face recognition or identity verification is performed. Detection can fail; you need to check the final image to be shared. The final output you prepare is what is sent for moderation and publication.
• Moderation and removal: A post goes through a safety check before it is published. When you report, your account ID, the target post and the reason are recorded for review. The public media copy of a hidden/removed post is cleaned up; a private evidence copy may be kept for authorized review. When you delete your own post or your account, the related media and private evidence copies are also cleaned up. Copies others have already taken and external caches cannot be undone by this process.
• Public profile and username: When you turn on profile visibility, other users can see your profile card. This card contains only the following fields: your username, display name, profile image, short profile text (bio) and style tags. Your email address, account information, credit/subscription status and location information never appear on the profile card. You can separately set your wardrobe and outfit visibility to "private / friends / public". Usernames are unique and are technically kept in a separate directory.
• Style groups and "Let Friends Choose" polls: You can create or be invited to style groups of up to 10 people. When you start a poll, the images of the 2–3 outfits you select and your question are shown only to the members of that group. When group members vote, their usernames and votes are visible within the group. Polls close after 48 hours and their records are automatically deleted after 7 days.
• Referral program: When you share your referral code, the referral relationship with the person who uses the code and the Aura points earned are recorded. Sharing the code is under your control.
• Aura and streaks: Your Aura points and outfit streaks are personal progress indicators; they are not published on a public leaderboard.

You can turn off any of these features at any time, set your profile back to private or leave a group.

Shared content may not be retractable (Important): When you publish an image on your public profile or share it in a style group, the people who see that content can take a screenshot, save it to their device or move it outside the app. Although these actions are prohibited by the Terms of Service, they cannot be technically prevented. Deleting the content through DRAEVA or setting your profile to private does not remove copies already taken by others, and we have no control over those copies. We therefore recommend that you do not share any image you would be uncomfortable not being able to take back.

No Biometric Data Is Processed: The photos you upload are not used to create biometric templates that identify you (face recognition signatures, face geometry scans, etc.); no such template is generated, stored or transferred to third parties. Photos are processed only for image processing (removing clothing backgrounds, labeling, stylist chat); no biometric processing is carried out for authentication or identification.

You can revoke these permissions at any time through your Device settings.

Post-Specific Clothing Sharing: Catalog items, or private clothing the user separately chooses to show, may be added to shared outfits. Private items are hidden by default. When you choose to show a private item, a post-specific copy of its name and image becomes accessible to other users; this does not open the rest of the wardrobe. The private image to be published goes through a content check. Hidden items show only a privacy indicator; the private item ID and private image link are not disclosed. The post owner can remove item sharing later. Changing the profile's privacy setting does not automatically remove items separately shared in the post. Hiding the item card does not change how it appears in the existing outfit photo.

Home Screen Widgets

DRAEVA offers "Today's Outfit" and "Today's Weather" widgets that can be added to the iOS and Android home screen. The data shown by the widgets (the day's outfit image, weather summary) is stored on your device in the protected area the operating system provides for sharing data between the app and the widget (iOS App Group / Android shared preferences). This data does not leave your device and is not shared with third parties. When you remove the widget or delete the app, this data is also deleted.

Tracking Technologies and Cookies

We use Cookies and similar tracking technologies to track activity on our Service and store certain information. See our Cookie Policy for details.

• Cookies or Browser Cookies (website only)
• Web Beacons (website only)
• Mobile local storage and SDK identifiers (mobile app; session, preference and cache data, and Firebase/RevenueCat identifiers)

We use both Session and Persistent Cookies for the purposes set out below:

• Necessary / Essential Cookies
• Cookie Policy / Notice Acceptance Cookies
• Functionality Cookies

Advertising measurement — separate and optional permission: DRAEVA uses the Meta SDK to measure and improve the results of its own Facebook/Instagram ads. When you separately allow advertising measurement on this device, app open/install, sign-up completion and store purchase, trial/subscription events; product, amount/currency, device/app information, IP address and the permitted advertising ID (IDFA/GAID) may be passed to Meta. On iOS, system tracking permission is also required; this integration does not turn on event sending when system permission is denied. Meta may match this information with information it obtains from its own services and process it for advertising measurement/optimization. Data may be processed abroad; Meta's data processing and retention terms apply: https://www.facebook.com/privacy/policy/.

Measurement is off by default. You can allow it through the optional advertising measurement option on the sign-up or privacy update screen, or from Settings. Accepting the general privacy text does not mean allowing advertising measurement. Your choice, the version of the notice and the time are stored on your device. You can turn off future measurement under Settings → Privacy & Data → Advertising measurement. Refusing or turning it off does not affect your access to the service. Data sent previously is not automatically deleted when the permission is turned off; for data requests, you can contact info@getdraeva.com. We do not add your name, email, Firebase account ID, photos, wardrobe content, style profile or chat content to this integration. No ads are shown in the app. To avoid sending purchase events twice, Meta's native store observer is used as the single source.

Use of Your Personal Data

The Company may use Personal Data for the following purposes:

• To provide and maintain our Service
• To manage your Account
• For the performance of a contract
• To generate personalized outfit, style and weather recommendations
• To offer optional social features (profile, style groups, polls, referral program)
• To send notifications and reminders
• Security, prevention of abuse and fraud; content safety checks
• Debugging, crash analysis and performance improvement
• To contact you
• To provide you with news and special offers (only with your consent)
• To manage your requests
• For business transfers
• For other purposes (aggregated data analysis, identifying trends, etc.)

Service Providers and Data Recipients

We may share your personal information in the following situations:

• With Service Providers: Our main service providers are:

• For business transfers: In the event of a merger or acquisition
• With other users: Your private wardrobe, outfit journal photos, stylist chats, calendar records and AI results are not shared with other users; they are accessible only from your account. The exceptions are: (i) clothing and outfit images you add to the global inspiration pool with your explicit consent (they become public without showing your identity) and (ii) content you share within the social features you turn on (Discover posts, public profile card, outfit polls you start in style groups). See "Contributing to the Global Inspiration Pool" and "Social Features and Your Visibility Controls".
• With your consent: For other purposes with your explicit consent

Retention of Your Personal Data

The Company will retain your Personal Data only for as long as necessary for the purposes set out in this Privacy Policy.

Data Retention Periods:

• Account Data (Email, Profile Information, Username): Kept while your account is active. Permanently deleted within 30 days after an account deletion request.
• Profile and Style Preferences (Onboarding, style analysis, size/thermal preferences): Kept while your account is active; deleted with account deletion.
• Wardrobe Data (Clothing Photos and Information): Kept while your account is active. Permanently deleted within 30 days after an account deletion request.
• AI Processing History and Results: Kept while your account is active. Permanently deleted within 30 days after an account deletion request.
• Outfit Journal Photos and Photos You Share in the Stylist Chat: Kept while your account is active, until you delete them. Permanently deleted within 30 days after an account deletion request.
• Calendar and Wear Records / Outfit Feedback: Kept while your account is active; deleted with account deletion.
• Stylist Chat History: Kept until you clear the chat or while your account is active; you can delete the chat from within the app at any time. Deleted with account deletion.
• Social Data (Public profile, username, group memberships): Kept while your account is active; public visibility ends immediately when you set your profile to private. Deleted with account deletion, and your username is released.
• Outfit Polls ("Let Friends Choose"): A poll closes after 48 hours; poll, option and vote records are automatically deleted 7 days after they are created.
• Aura, Streak and Referral Records: Kept while your account is active; deleted with account deletion.
• Payment and Invoice Records: Kept for 10 years due to legal obligations (tax laws).
• Subscription and Credit Transaction Records: Records linked to your account in the app are cleaned up in the account deletion flow. Purchase records held by Apple, Google and RevenueCat are subject to the provider's obligations and retention terms; account deletion does not delete store records.
• AI processing security: To prevent duplicate processing and abuse, the account ID, request digest, operation type, time, counter, credit reservation and result status are kept. Raw images or chat bodies are not written to the duplicate-check record. Expired temporary reservation records are removed by scheduled cleanup; related quota and reservation records are cleaned up on account deletion.
• Discover, wishlist, permission and report records: Content and preferences linked to your account are cleaned up in the account deletion flow. AI/Discover permission decisions are kept with version and time information; report and block records are kept associated with the account for safety purposes. When a post is deleted, its media and any moderation evidence copy are also removed.
• Weather Preferences (City/District): Stored with the user profile, deleted with account deletion.
• Weather Data (Cache) and Widget Data: Cached locally on your device, deleted when it expires or when the app/widget is removed. Raw location coordinates are not stored at any stage.
• Push Notification Token (FCM): Stored linked to your account; becomes invalid when you log out, withdraw notification permission or delete the app.
• Logs and Usage Statistics: Kept for 12 months for security and system improvement, then automatically deleted.
• Crash and Performance Reports: Kept for the standard retention periods of Firebase Crashlytics and Performance Monitoring (set by Google, typically up to 90 days).
• Support Requests and Communication Records: Kept for 2 years after the request is closed.
• Model Training Datasets (only if you consented): Your content is kept in the training dataset for as long as your consent continues. When you withdraw your consent or delete your account, it is removed from the dataset within 30 days at the latest. Model parameters produced by training cannot be reversed, as explained above.
• Anonymized and Aggregated Data: May be kept indefinitely because it does not qualify as personal data.
• Deleted Account Marker (Tombstone): To prevent abuse of free credits through re-registration, a keyed HMAC digest of the email address, the number of deletions and technical processing information are kept. The email is not stored in plain text in this record; however, because matching with a new registration is possible, the record is not considered anonymous. It is kept only for abuse prevention, with restricted access. The current system has no automatic expiry deletion; the necessity of retention and deletion requests are assessed taking into account both legitimate interest and the rights of the data subject.

Important Notes:

• When you request account deletion, all your data is permanently deleted within 30 days unless legal obligations require otherwise (e.g. payment records).
• Due to legal obligations or legitimate interests (e.g. fraud prevention, legal disputes), some data may be kept longer than the stated periods.
• Retention and processing in Google Gemini API / Vertex AI are subject to the contract and data control settings of the product used; no zero-retention commitment is made.
• Poll content you share in a style group may continue to appear on group members' screens, even if you delete your account, until the poll's automatic deletion period (7 days) expires.

Transfer of Your Personal Data (International Transfers)

To provide our Service, your personal data (especially data stored on the Firebase infrastructure, photos/texts sent to Google/OpenAI for AI processing and information passed to RevenueCat for subscription verification) is transferred to service providers whose servers are located abroad. Please note that your data is mainly processed and stored in the United States of America; the processing location for each provider is shown in the service provider table above. These transfers:

• International transfers must meet the requirements of an applicable adequacy decision or an appropriate safeguard mechanism under Article 9 of KVKK. In-app explicit consent alone is not considered sufficient for regular cloud/AI transfers; exceptions for incidental transfers cannot be used in place of a regular data flow.
• You can send requests for information about the transfer mechanism applied for each provider and about data subject rights to info@getdraeva.com.
• The AI use permission, the social sharing permission and any other optional processing permissions are kept separate; withdrawing consent stops the related future processing.

Deleting Your Personal Data and Your Rights

You have the right to delete, or to ask us to help you delete, the Personal Data we have collected about you.

Account Deletion Procedure:

1. 1.Log in to the DRAEVA app
2. 2.Open the Settings tab
3. 3.Tap "Delete Account"
4. 4.Confirm the deletion

Important: Account deletion cannot be undone, and all of the following data is permanently deleted:

• User profile and identity information
• Profile and style preferences (onboarding and style analysis data)
• Wardrobe data (all clothing photos)
• Outfit journal photos and photos you shared in the stylist chat
• AI processing history and results, stylist chat history
• Calendar and wear records
• Your public profile, username, group memberships and social content
• Aura, streak and referral records
• Credit transaction records
• Subscription information in the app (cancelling the store subscription is a separate step explained below)
• Your contributions to the global inspiration pool

Only the deleted account marker (HMAC digest) described above and the payment/invoice records we are legally required to keep continue to be retained.

Note: If your subscription was purchased through the App Store or Google Play, deleting your account may not stop automatic renewal of the subscription on its own; you also need to cancel the subscription in the relevant store's subscription settings.

To get information about and exercise your data rights (access, rectification, erasure, portability), you can contact us at info@getdraeva.com.

Disclosure of Your Personal Data

Business Transactions

If the Company is involved in a merger, acquisition or asset sale, your Personal Data may be transferred.

Law enforcement

We may be required to disclose your Personal Data by law or in response to valid requests by public authorities.

Other legal requirements

The Company may disclose your Personal Data to comply with a legal obligation, protect the Company's rights, prevent possible wrongdoing in connection with the service, or protect against legal liability.

Security of Your Personal Data

We apply the following technical and administrative measures to keep your Personal Data secure:

• Encryption: Your data is encrypted in transit (TLS/HTTPS) and at rest on servers (Google Cloud infrastructure).
• Access Control: Your data is accessible only through your account; data isolation between users is enforced with Firebase Security Rules. (Public content you contribute to the global inspiration pool with your explicit consent and content you share within the social features you turn on are outside the scope of this isolation.)
• App Integrity Verification: Costly server operations open to abuse are protected with Firebase App Check (Apple App Attest / Google Play Integrity).
• Server-Side Authorization: AI operations, credit deduction and consent checks are done on the server; the balance or authorization reported by the client is not trusted.
• Restricted Access: System and data access is limited to those who need it for their role.
• Content Safety: Discover posts go through automatic checks before publication; the safety checks of the relevant service are applied in AI features. Automatic checks can produce incorrect results; in-app reporting and human review complement these checks.
• Logging Discipline: Sensitive data such as session tokens, credentials or raw email addresses are not written to app and server logs.

Despite these measures, please remember that no method of transmission or storage is 100% secure; absolute security cannot be guaranteed.

Data Breach Notification: If a data breach affecting your personal data is detected, the situation is reported as soon as possible to the Personal Data Protection Board and to affected users under KVKK, and the steps needed to reduce the effects of the breach are taken immediately.

Use of Anonymous Data and Training of Artificial Intelligence Models

This section explains how your data may be used (a) in anonymized form and (b) in the training of artificial intelligence models. These two uses are subject to different rules.

Anonymized and Aggregated Data

We may use your data after making it impossible to re-associate in any way with you or your device (anonymization). Anonymization is an irreversible process: all direct/indirect identifiers such as user ID, device identifier and email are permanently removed, and individual records are turned into statistical totals.

Anonymized data loses its character as personal data within the meaning of KVKK and the GDPR. We may use this data for the following purposes:

• Product and feature development, analysis of usage trends
• Measuring and improving the quality of recommendation and analysis algorithms
• Statistical studies on fashion and clothing habits, industry reports and academic/research outputs
• Publishing aggregated insights or sharing them with business partners

Example: an output such as "38% of users prefer layering on days below 10°C" is anonymous data. Photos, wardrobe content or profile information belonging to a specific user are not shared in this context. Because anonymized data is not personal data, your consent is not separately sought for this use, and once anonymization is complete it is technically not possible to request deletion of this data.

Artificial Intelligence Model Training (Optional — Subject to Explicit Consent)

We use your content to train and develop our own artificial intelligence models only if you have given explicit consent specific to this purpose.

• It is OFF by default. Your content is not used for model training unless you turn on the "Contribute to training the models" option on the Settings → Privacy & Data screen.
• Consent is not a condition of service. Even if you never turn this option on, you continue to enjoy all DRAEVA features in full; no price, plan or feature difference applies.
• The consent record is kept on the server with a version and timestamp and is verified on the server when the training dataset is prepared.

If you consent, the content that may be used in training is limited to:

• Your clothing images with the background removed
• Your outfit (composite canvas) images
• Clothing and outfit attributes: labels such as category, color, fabric, season and fit
• Your outfit feedback and recommendation interactions (signals such as liked/worn), separated from your identity

Content that is NEVER used in training, even if you consent:

• Personal photos taken of you and your outfit journal photos
• Your profile photo and stylist chat content
• Identity-linked data such as name, email, username, location, calendar records and payment information

Before being added to the training dataset, content is separated from your identity; the resulting model is used to learn general patterns, not to reproduce input images. We do not sell the content we use for training to third parties.

Withdrawing your consent and an important limit: You can withdraw your consent at any time through Settings. Withdrawal takes effect going forward: your content is not included in subsequent training runs and datasets, and it is removed from the current training dataset. However, it is technically not possible to remove a single user's contribution from model parameters produced by training that has already been completed. We state this clearly so that you know it before giving consent. The same rule applies when you delete your account: your content is deleted from datasets, but models trained earlier cannot be reversed.

In case of change: If we expand the scope of training (e.g. including a new type of content), this Policy is updated and your consent is requested again; your existing consent does not count for the expanded scope.

Sale of Personal Data and Advertising

• We do not sell your personal data. We do not sell, rent or trade your personal data to third parties for monetary or other valuable consideration.
• You choose advertising measurement. Only when you give separate permission is the limited event and device data described above shared with Meta for advertising measurement/optimization. Your data is not marketed to data brokers.
• We are not a data broker. We do not collect your personal data to build profiles and market them to third parties.
• We do not sell content we use for model training. Content used in training with your consent is not sold or licensed to third parties.
• Exception — anonymous insights: We may publish or share with business partners aggregated statistics that have been irreversibly anonymized and cannot be associated with anyone. Because this data does not qualify as personal data, this sharing is not considered a sale of personal data.
• We transfer your data to the relevant providers for the purposes described in the "Service Providers and Data Recipients" section; to other users within the social features you turn on; and where there is a legal obligation. The optional Meta advertising measurement transfer is also described in the advertising measurement section above.

US State Privacy Rights (California and Other States)

If you reside in the United States, you may have the following rights under the laws of your state (California Consumer Privacy Act / CPRA and similar state laws):

• Right to know: To learn which categories of personal information we collect about you, the purposes for which we use them and with whom we share them.
• Right of access and portability: To request a copy of the personal information we have collected in a portable format.
• Right to delete: To request deletion of your personal information (subject to our legal retention obligations).
• Right to correct: To ask for inaccurate personal information to be corrected.
• Right to opt out of sale/sharing (Do Not Sell or Share): We do not sell your personal data for monetary consideration. You can turn off Meta advertising measurement sharing under Settings → Privacy & Data or contact info@getdraeva.com.
• Right to limit use of sensitive personal information: We use sensitive personal information only for purposes necessary to provide the Service; we do not use it to build profiles by inference.
• Non-discrimination: We do not charge you a different price or provide a different level of service because you exercise these rights.

To exercise these rights, you can contact info@getdraeva.com. To verify your identity, we may ask that the request be made from the email address registered to your account. We resolve requests within 45 days at the latest; where necessary, we may extend this period once by a further 45 days and will inform you. You may make a request through an authorized agent; in that case, we will ask the agent to document their authority.

Children's Privacy

Our Service does not address anyone under the age of 13. If we become aware that we have collected Personal Data from anyone under 13 without verification of parental consent, we take steps to remove that information from our servers. Social features (public profile, style groups, polls) should be used under parental/guardian supervision by users under 18.

Links to Other Websites

Our Service may contain links to other websites that are not operated by us. We strongly advise you to review the Privacy Policy of every site you visit.

Changes to this Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of changes by posting the new Privacy Policy on this page and updating the "Last updated" date. Material changes are announced through appropriate communication channels. If the scope of processing based on explicit consent changes, permission specific to the relevant purpose is requested again; the permission decision is recorded with version and time information. Updating the Policy does not by itself create new explicit consent.

GDPR Compliance (European Union / EEA Users)

If you are located in the European Union or the European Economic Area, you have the following additional rights and protections under the EU General Data Protection Regulation (GDPR).

Legal Bases for Processing (GDPR Article 6)

• Performance of a Contract: Processing necessary for account creation, wardrobe management, subscriptions and provision of the Service.
• Explicit Consent: Sending your photos and processing inputs to AI services (Google/OpenAI), contributing to the global inspiration pool, public profile and social features, location detection, push notifications and marketing communications.
• Explicit Consent (separate and optional): Use of your content to train our own artificial intelligence models. This consent is independent of other consents, is not mandatory and can always be withdrawn.
• Legitimate Interest: Service security, prevention of fraud and abuse (including the deleted account marker), and the server processing records necessary and proportionate for these purposes.
• Separate and optional consent: Firebase usage analytics and error/performance reports are enabled through choices that are separate from each other and from Meta advertising measurement.
• Legal Obligation: Retention of tax and commercial records.
• Out of scope: Irreversibly anonymized data loses its character as personal data and therefore falls outside the scope of the GDPR/KVKK (see "Use of Anonymous Data and Training of Artificial Intelligence Models").

Your Rights under the GDPR

• To access your data and obtain a copy (including portability),
• Rectification, erasure ("right to be forgotten") and restriction of processing,
• To withdraw consent at any time for processing based on consent,
• To object to processing based on legitimate interest,
• To lodge a complaint with the data protection authority in your country.

To exercise these rights, you can contact info@getdraeva.com; requests are answered within 30 days at the latest.

Data Controller

Draeva Email: info@getdraeva.com

KVKK Compliance (Türkiye)

Data Controller

Draeva Email: info@getdraeva.com Contact: info@getdraeva.com

Collection Method and Legal Grounds

Data is collected electronically through sign-up and settings forms, the images/texts you upload, the operations you start, social interactions and automatic technical records in the app/provider systems. Account, wardrobe, wishlist and subscription operations rely on the establishment or performance of a contract; mandatory commercial records on legal obligation; security, abuse prevention and proportionate technical records on legitimate interest, taking your fundamental rights into account; and dispute records on the establishment, exercise or protection of a right. Operations for which separate permission is offered, such as AI data transfer, social sharing, the inspiration pool and model training, are subject to explicit consent specific to the relevant purpose. Additional conditions for international transfers are explained in the transfer section above. Reading this text or accepting the Terms of Service does not replace these permissions.

Right of Application (KVKK Article 11)

Under Article 11 of Law No. 6698 on the Protection of Personal Data (KVKK), you have the following rights:

• To learn whether your personal data is processed
• To request information if your personal data has been processed
• To learn the purpose of processing personal data and whether it is used in line with that purpose
• To know the third parties in Türkiye or abroad to whom personal data is transferred
• To request correction of personal data that is incomplete or inaccurately processed
• To request deletion or destruction of personal data
• To request that the correction, deletion and destruction carried out be notified to third parties to whom the personal data was transferred
• To object to a result against you arising from the analysis of the processed data exclusively by automated systems
• To claim compensation for damage if you suffer damage due to unlawful processing of personal data

Application Procedure and Period

To exercise these rights, you can send your request together with information proving your identity to info@getdraeva.com, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller. Your applications are concluded free of charge as soon as possible and within 30 (thirty) days at the latest, depending on the nature of the request. For identity verification, we may ask that the application be made from the email address registered to your account.

Right to Complain to the Board

If your application is rejected, the answer given is found insufficient or no answer is given in time, you have the right to complain to the Personal Data Protection Board (https://www.kvkk.gov.tr) within 30 days from the date you learn of the answer and, in any case, within 60 days from the date of application.

Categories and Purposes of Processed Data (Summary)

Contact Us

If you have any questions about this Privacy Policy, you can contact us:

• Email: info@getdraeva.com
• Support: info@getdraeva.com
• Website: https://getdraeva.com

Version History