Privacy Policy
NOEMA is built to keep your wardrobe on your phone. This policy explains what we collect across the NOEMA iPhone app, noemalooks.com, the beta waitlist and NOEMA Studio, why, who we share it with, how long we keep it, and the rights you have. The short version: your library stays on your iPhone, photos you send for a try-on are used only to make that image and are not stored by us, and we never sell your data or use tracking cookies.
01 Who we are
NOEMA is operated by Wyntre Studios LLC, a limited liability company organised in Wyoming, USA (“we”, “us”). We are the controller of the personal data described here, except where section 8 says we act for a business customer. Contact us about anything in this policy at hari@wyntrestudios.com.
02 What we collect and why
We collect only what each part of NOEMA needs. Under the GDPR, each use has a legal basis, shown below.
| What | Why | Legal basis |
|---|---|---|
| Beta waitlist: your email, which button you signed up from, the time, the version of these policies you agreed to, and your invite status | To invite you to the TestFlight beta and record your agreement | Consent (Art. 6(1)(a)) |
| Anti-abuse: a salted, one-way hash of your IP address (never the address itself) and a hit count | To rate-limit sign-ups and sign-in attempts | Legitimate interests in security (Art. 6(1)(f)) |
| App account: an account identifier from Sign in with Apple (and an email only if Apple shares one), request identifiers, dates, status and duration of generations, and a protected fingerprint of your Apple sign-in identity to preserve your lifetime trial allowance | To run your account, enforce credit allowances and diagnose failures | Contract (Art. 6(1)(b)) |
| Purchases and credits: product and transaction identifiers, dates, subscription and refund state, and a credit ledger. Apple handles payment; we never see card details | To grant and spend credits and prevent a purchase being counted twice | Contract; legal obligations for records (Art. 6(1)(b), (c)) |
| Try-on photos: the selfie, clothing and optional hairstyle or background images you choose, plus camera and lens settings (never GPS or location) | To create the image you asked for (section 3) | Contract, and your explicit consent in the app before the first generation (Art. 6(1)(b), 9(2)(a)) |
| NOEMA Studio: your work email, a sign-in account for it, and, if you request access, your name, company, website, role, catalogue size and the version of the terms you accepted; your workspace and team membership, uploaded model and product photos, styling instructions, saved results and credit usage | To verify your email, review requests, provide your team workspace and generate the images you request | Contract; legitimate interests (Art. 6(1)(b), (f)) |
| Messages and brand sample requests: your name, email, brand and any website or product links you choose to share, plus your permission to contact you | To answer you and keep a record of requests | Legitimate interests (Art. 6(1)(f)) |
| Website hosting logs: IP address, browser and pages requested, kept by our host | To deliver and secure the website | Legitimate interests in security (Art. 6(1)(f)) |
You don’t have to give us any of this, but without it we can’t provide that feature (for example, we can’t invite you without your email).
03 Your photos and on-device data
What stays on your iPhone
Your wardrobe, wishlist, garment details, reference photos, drafts, saved looks, wear history, style preferences and insights are stored in the app on your iPhone. Photo tagging, text reading, cut-outs and wardrobe insights run on your device. We don’t provide cloud sync, so we never receive this library. Your device backups (for example iCloud) are managed by Apple under your own settings.
What leaves your iPhone, and only when you ask
When you tap Generate, the app sends the selfie and the clothing, hairstyle or background images you selected through our backend to our AI provider, OpenAI, which returns one finished image to your phone. The app asks for your explicit permission before the first photo is sent.
- We do not store these photos or the generated images in any cloud storage, and they are never written to our logs.
- We do not use your photos to identify you, and we do not create face templates or biometric identifiers.
- OpenAI processes these images to return your result. Under its API terms it does not use them to train its models by default, and it may keep them for a limited period to detect abuse.
- Sample generations use bundled example images and send nothing.
Photos can reveal sensitive information about you (for example ethnicity, religion or health). We process them only to make the image you requested, with your explicit consent, which you can withdraw at any time in the app’s settings.
05 International transfers
We are based in the USA, and some providers process data in the USA. When personal data from the European Economic Area, the UK or Switzerland is transferred, we rely on the EU–U.S. Data Privacy Framework (and its UK and Swiss extensions) where the recipient is certified, or on the European Commission’s Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards at hari@wyntrestudios.com.
06 How long we keep it
- Waitlist: deleted automatically 12 months after your invite is sent, or 24 months after you signed up if you haven’t been invited, whichever comes first; sooner if you ask.
- Anti-abuse counters: deleted automatically after 2 days.
- App account and linked credit history: kept while your account exists and deleted when you delete your account in the app. Minimal generation usage records remain with the account link removed to enforce shared spending limits. A protected fingerprint of your Apple sign-in identity and the trial credits already used remain to prevent a new trial being granted after account deletion. This fingerprint does not contain your email or photos. These anti-abuse records are retained for as long as the corresponding limits and lifetime trial are enforced.
- Purchase records: on account deletion, transaction and product identifiers, dates and refund state are kept without any link to you, to stop a purchase from being redeemed twice and to meet accounting obligations.
- iPhone try-on photos: not stored by us (see section 3). Studio storage is described below.
- Studio: account, request, team records, uploaded photos and saved results are kept while your workspace is active and deleted when you ask us to close it; rejected requests are deleted automatically after 12 months. Sessions last 12 hours. Minimal generation and credit records survive closure to enforce spending limits and prevent repeated trial claims. The Studio demo keeps workspace content only in your own browser.
- Messages: kept for up to 2 years after the conversation ends. Brand sample requests are deleted automatically 2 years after submission, or sooner if you ask.
- Hosting logs: kept by our providers for short periods under their own policies.
08 NOEMA Studio for businesses
When a business uploads its own content to NOEMA Studio (for example product photos or photos of its models), that business is the controller of any personal data in it and we process it only on its instructions. The business is responsible for having a lawful basis and, for models, written consent to AI-generated imagery; Studio requires confirming this before a model can be added. Live Studio stores uploaded photos and completed results in private workspace storage hosted by Supabase. Only active members of that workspace can access them through Studio. When a member generates an image, the selected model, garment and optional background or approved result are sent through our backend to the AI provider listed in section 4. Completed results remain available to the team after the browser closes. We do not use Studio content to train AI models. Businesses can request our data processing agreement at hari@wyntrestudios.com.
09 Your rights
Depending on where you live, you can:
- access the personal data we hold about you and get a copy in a portable format;
- correct it, or have it deleted;
- restrict or object to how we use it, including anything based on legitimate interests;
- withdraw consent at any time (this doesn’t affect what we did before you withdrew);
- not be subject to decisions based solely on automated processing with legal or similarly significant effects. We make none.
How: delete your app account and library in the app’s Settings, withdraw photo permission there, or email hari@wyntrestudios.com for anything else, including leaving the waitlist. We answer within one month and may need to confirm it’s you first. We won’t treat you differently for using these rights.
Complaints: you can complain to your local data protection authority (in the EU, the authority in the country where you live or work; in the UK, the ICO). We’d appreciate the chance to fix things first.
California residents: you have the rights to know, delete and correct personal information, and to opt out of its sale or sharing. We don’t sell or share it, and we don’t use sensitive personal information for anything other than providing the service you asked for.
10 Security
We protect data with encryption in transit (HTTPS everywhere, with HSTS) and at rest in our database, access limited to the people and systems that need it, secrets kept out of our code, database rules that stop the public from reading any stored personal data, rate limits against abuse, and a strict website security policy. No system is perfectly secure; if a breach affects your personal data, we’ll notify the relevant authority within 72 hours where required and tell you without undue delay if it puts your rights at high risk.
11 Age limit
NOEMA is for people aged 16 and over. We don’t knowingly collect personal data from anyone younger. If you believe a child has given us personal data, email hari@wyntrestudios.com and we’ll delete it.
12 Changes to this policy
We’ll post any change here with a new effective date and version. If a change materially affects how we use your data, we’ll tell you before it takes effect and, where the law requires, ask for your consent again. You can also read the Terms of Service.