Privacy Notice
Effective
BossyPants Limited (“BossyPants,” “we,” “us,” or “our”) provides an AI-assisted style service through our iOS and Android applications, bossypants.com, and this corporate website. This notice explains what information the service handles and the choices available to you.
At a glance: we use information to provide and protect the styling service. BossyPants does not sell personal information and does not use product data for targeted advertising. Some information— including photos, voice, fit constraints, and beliefs—is handled only when you choose to provide it.
1. Who controls your information
BossyPants Limited, a Colorado limited liability company, is responsible for the personal information described here. Questions and privacy requests may be sent to privacy@bossypants.ltd or to BossyPants Limited, 1500 N Grant St, Ste N, Denver, CO 80203, USA.
2. Information we handle
| Category | Examples | Why we handle it |
|---|---|---|
| Account and identity | Email, display name, internal and Firebase identifiers, and Google or Apple sign-in provider. | Authenticate you, administer the account, prevent abuse, and secure the service. |
| User content | Chats, photos, voice audio and transcripts, wardrobe items, outfits, boards, and feedback. | Answer styling requests and provide the organization and conversation features you choose to use. |
| Preferences and inferences | Style, fit, body or sensory constraints, allergy or other health-related constraints, religious or modesty preferences, inferred preferences, beliefs, and vetoes. | Personalize recommendations and avoid unsuitable results. This may be sensitive information when you volunteer it; you do not have to provide it. |
| Approximate location and weather context | A city or region you state and weather for that place. | Make weather-aware recommendations. We do not request live device location or use device GPS/location permissions for weather. |
| Selected photo and screenshot content | Photos or screenshots you select in the app are re-encoded on your device before transmission. The re-encoded image does not copy source embedded metadata, including EXIF, XMP, GPS coordinates, or other precise location metadata. | Process the sanitized visual content you choose to submit and create derived or app-generated metadata needed for styling and feedback. Feedback images are re-encoded again server-side. |
| Device, usage, and diagnostics | App version, device and OS details, random install identifier, feature events, errors, mutation receipts, and traces. | Operate, secure, troubleshoot, and improve reliability. |
| Website analytics | Pages viewed on bossypants.com, the linking site, browser, operating system, device type, country, and page-load timing, collected by Cloudflare Web Analytics without cookies or device storage. | Count visits, including visits to each creator’s page, and keep the site fast. |
| Creator links | The short name of the creator whose link you used to get the app. On Android, the app saves it with your account when you first sign in. On iPhone, Apple tells us how many people joined through each creator’s link and how much they use the beta, without telling us who they are. | Learn which creators bring people to BossyPants. |
| Beta and support administration | Beta request, invitation, support request, feedback, and deletion receipt. | Administer access, respond to you, and prove completion or retry of governed requests. |
We receive information directly from you, from the device and app as you use the service, from Google or Apple when you choose their sign-in flow, and from service providers acting for us. We do not intentionally infer sensitive traits for advertising or unrelated profiling.
3. How we use information
- Provide conversations, wardrobe organization, outfit and board features, photo understanding, voice interactions, and personalized style output.
- Authenticate users, maintain sessions, enforce beta access, prevent fraud and abuse, and protect accounts.
- Remember preferences and constraints so future recommendations are more relevant and avoid choices you have rejected.
- Monitor performance, investigate errors, answer support requests, and improve product quality.
- Count visits to our websites and learn which creators’ links bring people to BossyPants.
- Comply with law, enforce our Terms of Use, and establish or defend legal claims.
Depending on where you live, our legal bases include performing our contract with you, your consent for optional processing, our legitimate interests in operating and securing the service, and compliance with legal obligations. You may withdraw consent for future optional processing, although that does not undo processing already completed lawfully.
4. Service providers and disclosures
We disclose information to providers only as needed for the purposes in this notice. We do not permit them to use BossyPants product data for their own advertising. Our current provider set includes:
- Firebase/Google and Apple for authentication and mobile-platform services.
- Amazon Web Services, including Bedrock, RDS, S3, ECS, and CloudWatch, for hosting, storage, AI processing, and operational telemetry.
- MongoDB Atlas and Neo4j Aura for conversation, memory, relationship, and preference data.
- Anthropic, OpenAI, Google Gemini, and AWS Bedrock model providers for language, vision, extraction, and recommendation processing. OpenAI does not use this content to train its models. By default it keeps it for up to 30 days to monitor for abuse, and longer when the law requires or when needed to protect its services or others from harm.
- ElevenLabs for voice interactions and related audio/transcript processing.
- Linear for private feedback triage. When you send in-app feedback, we send your note, device and app details, and an optional temporary screenshot link. We do not attach your account email.
- GitHub for older feedback sent before we moved to Linear. Feedback linked to a deleted account is removed or neutralized through the deletion workflow.
- Open-Meteo for weather associated with a city or region you provide.
- Cloudflare for website hosting, delivery, security, and cookie-free website analytics (Cloudflare Web Analytics).
- Termly for the optional data-subject request form linked below.
We may also disclose information when required by law, to protect users or the service, in a business transaction subject to appropriate safeguards, or at your direction. BossyPants does not sell personal information and does not share it for cross-context behavioral or targeted advertising.
5. Retention
We keep different information for different periods:
- Vision-session artifacts are generally retained for about one hour.
- Voice-session artifacts are generally retained for about one hour.
- Transient photo classifications are generally retained for about ten minutes.
- Client events, mutation events, errors, and traces may be retained for up to 180 days.
- Chats, wardrobe items, outfits, boards, profiles, memories, and product inferences are retained until you delete them or your account is permanently deleted.
- Only sanitized visual content from a selected photo or screenshot, plus derived or app-generated metadata associated with it, follows the applicable file and product-data deletion and retention schedule. Source embedded metadata, including GPS or other precise location metadata, is removed before transmission and is not retained by BossyPants.
- An optional feedback screenshot link stops working no later than seven days after you send it, and may stop sooner. The screenshot itself is configured to expire from object storage after eight days, subject to ordinary asynchronous lifecycle processing.
- Feedback you send stays available for triage while your account exists. Our copy of a report that is waiting to be delivered is kept only until delivery succeeds or your account is permanently deleted.
- After the 14-day restoration period, account deletion removes your feedback from active use in Linear. Linear keeps deleted items recoverable for 30 days, and we do not restore them; its own history, cache, and backups may follow separate schedules. If a removal cannot be confirmed, we keep retrying. Our deletion record then keeps only what unfinished cleanup still needs: the link between the report and your account’s identifier and, while removal of older GitHub feedback is unfinished, your account email. We remove each identifier once no unfinished step needs it.
- Unconsumed beta requests and invitations are removed no later than the request’s original 14-day deadline. If an invitation becomes an account, normal account retention applies.
- Account content remains available during the 14-day restoration period, then is queued for permanent deletion by a daily worker.
- A creator’s short name saved with an account is kept until the account is permanently deleted.
- Website analytics are available to us in Cloudflare for six months.
After completion, we may keep a minimal, non-identifying deletion receipt and retry status as needed to prove completion, protect the service, or meet legal obligations. It is not used for personalization and cannot recreate the deleted account. Provider cleanup and storage lifecycle work may finish asynchronously and are monitored for failure.
Some device-local preferences and the random install identifier may remain on your device after server-side deletion. Uninstall the app or clear its application storage to remove information that remains under your device’s control.
6. Your choices and privacy rights
Depending on your location, you may have rights to access, correct, delete, or receive a copy of personal information; object to or restrict certain processing; withdraw consent; or appeal a denied request. You may make a request by emailing privacy@bossypants.ltd or by using our data-subject request form. We may need to verify your identity before acting. Authorized agents may be asked to show authority and verify the request.
To delete an account in the app, open Settings and choose Delete account. Full instructions and an alternative path are on our account-deletion page. You may also change or delete individual product content using available app controls.
You will not receive discriminatory treatment for exercising a privacy right. You may complain to the privacy or data-protection authority where you live. Because we do not sell information or use it for targeted advertising, there is no sale or targeted-ad profile to opt out of.
7. Cookies and analytics
The BossyPants corporate site uses Cloudflare delivery and may use cookie-free web analytics.
Our consumer site, bossypants.com, uses Cloudflare Web Analytics to count page views, including visits to the pages we give creators to share. It sets no cookies and stores nothing on your device, and Cloudflare does not log the query part of page addresses. If you install the Android app from a creator’s link, Google Play passes that creator’s short name to the app, and the app saves it with your account when you first sign in. We use it only to count which creators bring people to BossyPants, and we save nothing else from the link.
8. International processing
BossyPants is based in the United States, and our providers may process information in the United States and other countries. Those countries may have different privacy laws. Where required, we use contractual and other lawful safeguards for international transfers.
9. Security
We use administrative, technical, and organizational measures intended to protect information, including access controls, encryption in transit, restricted storage, and monitoring. No system or transmission is perfectly secure, and we cannot guarantee absolute security.
10. Children
The service is for people at least 18 years old. We do not knowingly collect personal information from children. Contact us if you believe a child has provided information so we can investigate and take appropriate action.
11. Changes and contact
We may update this notice as the service or law changes. We will revise the effective date and provide additional notice when a material change requires it. Questions, complaints, and requests may be sent to privacy@bossypants.ltd.