This is a translation provided for your convenience. The app is published from France and the French version is the legally binding one; in case of divergence, the French text prevails.

Privacy policy

This privacy policy describes the personal data processed in connection with the cOde:Dress app, published by Cahutech, Loïc Cahuzac EI (entreprise individuelle, micro-entreprise, SIREN 130 880 230) (hereinafter the "Publisher"), and the rights its users have under the General Data Protection Regulation (GDPR).

1. Data controller

The data controller is the Publisher, whose identity is set out in the legal notice, and who can be reached at the following address: contact@cahutech.fr.

The Publisher has not appointed a data protection officer, as the processing carried out falls under none of the cases provided for in article 37 GDPR.

2. Data processed

The Publisher processes the following data:

• Account: email address, username and password, stored in hashed form.
• Age: at signup, the user declares they meet the minimum age set by the Terms. No date of birth is kept.
• Profile: height and weight and, optionally, body shape, hair colour and length, eye colour and skin tone.
• Reference photo: a photo of the user or a photo of their partner's outfit, sent during a generation or a request for advice. It is not kept by the Publisher. Google, which processes it, keeps it for 55 days to detect abuse of its service.
• Colouring: skin undertone (warm or cool), overall lightness and contrast between hair and skin, read from the user's photo. These three indications help choose the colour of garments.
• Wardrobe: photos of garments and their descriptions (category, colour, notes).
• Creations: generated outfit images, saved outfits and the history of style advice.
• Purchases and credits: credit ledger (date, reason, amount) and record of the purchases validated by the App Store or Google Play, which collect the payment. The Publisher has no access to payment details.
• Rewarded ads: when the user chooses to watch an ad, Google (AdMob) receives technical data about the device, including the advertising identifier where the system allows it, and their consent choices. The Publisher only receives Google's signed confirmation that the ad was watched, with the account's public identifier.
• Security and abuse prevention: app installation identifier, IP address, generation history.
• Usage measurement: the app's language, and one record per gesture (a shopping search opened or a piece of advice requested) holding the gesture, a garment category, the originating screen and the date.
• Notifications: device notification token, platform (iOS or Android) and the app's language; for discovery journey reminders, the device's timezone, the date the app was last opened and the list of reminders sent.

3. Use of data

The Publisher uses the user's data in order to:

• provide the service: account, wardrobe, outfit generation, style advice;
• have outfits generated and analysed by artificial intelligence, from the photos and the profile characteristics;
• automatically moderate the photos sent and the images generated;
• manage purchases and credits;
• credit an outfit when the user watches an ad they chose to see;
• prevent abuse, such as creating multiple accounts or overconsumption;
• measure how the app is used;
• send discovery journey reminders, when the user has turned them on.

Providing the service and managing purchases are necessary for the performance of the Terms. Generation and analysis by artificial intelligence rest on the user's consent, collected at signup. Discovery journey reminders also rest on their consent, given in "Profile → Notifications". Moderation, abuse prevention and usage measurement rest on the Publisher's legitimate interest and, for moderation, on its legal obligations. Rewarded ads are shown only at the user's request, are not personalised and rest, where the law requires it, on their consent, collected by Google's form before the first ad and changeable in "Profile → Account → Ad choices".

4. Privacy of photos

The photos that are kept (garments, generated images) are accessible only to the user's account. They are not visible to other users and are used to train no artificial intelligence model, except Google's abuse detection tools described among the recipients.

5. Retention periods

• Reference photo and photo of the partner's outfit: not kept by the Publisher; 55 days at Google, for abuse detection.
• Colouring: until the reference photo is removed from the app. The indications are replaced when the photo changes.
• Account, profile, wardrobe, saved outfits, credit and purchase ledger: for as long as the account exists.
• Generated images that were not saved: 30 days.
• "Partner" advice: 30 days.
• Payment receipts: kept by the App Store or Google Play, not by the Publisher.
• Technical logs (IP address): 12 months at most.
• Usage measurement: 400 days.
• Notification token: until logout, account deletion or 180 days without the app being opened.
• Backup copies: 3 months at most.

Deleting the account, from the "Profile" section, immediately erases all data and photos from the online service. Backup copies, used only to restore the service after an incident, keep this data until they are renewed. If a backup is restored, deleted accounts are erased again before the service resumes.

6. Recipients and transfers outside the European Union

The data is hosted by OVH SAS (France).

The Publisher uses the following processors, solely for the purposes described in this policy:

• Google (Gemini), Google Ireland Ltd and Google LLC (United States): image generation, advice and moderation.
• Brevo (France): transactional emails (signup confirmation, password reset, notice of changes to the terms). Brevo adds an invisible image to these emails, which counts opens without linking them to the user, and routes their links through its servers, which lets it record clicks. The Publisher uses this information only to check that messages are delivered.
• Apple (APNs) and Google (FCM), United States: delivery of notifications. They receive only the device token and the text of the notification.
• RevenueCat (United States): validation and tracking of in-app purchases. It receives only the account identifier and the product purchased.
• Google (AdMob), Google Ireland Ltd and Google LLC (United States): display of rewarded ads, at the user's request. Google processes the device data under its own privacy rules.

Transfers to the United States are framed by the EU-U.S. Data Privacy Framework, supplemented by the standard contractual clauses for Google (Gemini) and RevenueCat.

Google (Gemini) receives photos and texts only at the time of the requested processing. It keeps requests and responses for 55 days, solely to detect and prevent abuse of its service and to meet its legal obligations; authorised Google employees may review them for that purpose. This data is used to train no artificial intelligence model, except those Google dedicates to abuse detection.

The data is disclosed to no other recipient. The Publisher does not sell any data.

7. Searching at merchants

With "Find this piece", only the text description of the item is sent to Google Shopping, without the user's identity or photos. Google's privacy policy applies to that search, and the Publisher receives no information from it.

8. Usage measurement

The Publisher measures how the app is used from the content users create (generated outfits, garments added) and from the app's language. Some gestures are also recorded (a shopping search opened or a piece of advice requested): the gesture, a garment category, the originating screen and the date. This record holds no search text, no item name, no advice text and no photo.

This measurement uses no third-party analytics tool, no tracker and no advertising identifier. No decision concerning the user follows from it. Only totals may be shown to third parties, in particular to potential partners.

Records are deleted with the account and appear in the data export. In the event of an objection, they are erased and the account is no longer measured.

The Publisher also keeps aggregate statistics, for example a number of searches per category and per day. They hold no account or device identifier and do not make it possible to identify a user. They are kept after an objection and after the account is deleted.

9. Notifications

When the user allows notifications on their phone, the app informs them when a generation has finished or failed. These notifications are delivered by Apple (APNs) or Google (FCM) depending on the phone. They state only that the outfit is ready or could not be generated, with no image and no description. The user may turn them off at any time in their phone settings.

Discovery journey reminders are off by default. They can be turned on or withdrawn at any time in "Profile → Notifications", independently of the permission given on the phone. The Publisher sends at most one reminder a day and three a week, and stops sending them when the user does not follow them up.

Outfit reminders are local notifications, scheduled by the phone. They pass through no server.

10. The user's rights

The user has the following rights:

• Access and rectification: directly in the app ("Profile" section and wardrobe).
• Portability: "Export my data" button in the "Profile" section.
• Erasure: "Delete my account" button in the "Profile" section.
• Objection to usage measurement: by email to contact@cahutech.fr.

Any other request may be sent to contact@cahutech.fr. The user may also lodge a complaint with the CNIL, the French data protection authority (cnil.fr).

cOde:Dress is published by Cahutech, Loïc Cahuzac EI. Contact: contact@cahutech.fr.
Privacy policy · General terms of use · Legal notice · Delete my account
Last updated: 22 October 2026.