Privacy Policy

This policy explains how Applyplus Ltd, trading as "Kit & Grit" ("we") processes personal data when you use Kit & Grit. We are the data controller for the purposes of UK GDPR and the EU GDPR.

1. What we collect

• Account data: email address, authentication identifiers.
• Assessment data: quiz answers (height, body shape, colouring, training style, budget, layering preferences).
• Photos: optional images you upload to receive a more accurate assessment.
• Generated content: the AI analysis, palette, outfits and product recommendations created for you.
• Technical data: minimal logs (timestamp, request status) for security and debugging.
• Search insights: search terms entered in the shop or Ask Kit, the women's or men's range, the search tool used and the time. These records do not include visitor identifiers, account identifiers, IP addresses or AI replies. Contact details are filtered and requests containing recognised sensitive personal terms are not recorded. Please do not include personal details in searches.

2. How we use it (lawful bases)

• Contract: to deliver the styling notebook you signed up for.
• Legitimate interests: to secure the Service and prevent abuse.
• Legitimate interests: to understand shopping demand and improve our product selection using identity-free search insights, accessible only to authorised administrators.
• Consent: for any optional marketing emails (you can withdraw at any time).

3. AI processing

Ask Kit uses your current conversation to find relevant pieces. The conversation clears when you refresh; we do not save conversation history or AI replies. Individual search requests may be recorded separately as described above.

Your photos and quiz answers are sent to AI model providers (Google Gemini and OpenAI, via the Lovable AI Gateway) to generate your analysis and visual flat-lays. These providers process your data on our behalf and do not use it to train their models under our gateway agreement.

4. Who we share with

• Hosting & database: Lovable Cloud / Supabase (EU region).
• AI processing: Google and OpenAI via the Lovable AI Gateway.
• Email: our transactional email provider for sign-in and account messages.
• Avri orders: when you add Avri pieces to the basket, your basket is held by Avri's Shopify store. At checkout you give your name, address and payment details directly to Avri (also operated by Applyplus Ltd) and Shopify; Kit & Grit never sees or stores your card details. Avri's own privacy policy applies to your order.

We do not sell your personal data.

5. International transfers

Some subprocessors are based in the US. Transfers are protected by Standard Contractual Clauses and the UK/EU adequacy frameworks where applicable.

6. Retention

• Account data: kept while your account is active.
• Assessments and photos: kept until you delete them or close your account.
• Backups: purged within 30 days of deletion.

7. Your rights (UK/EU GDPR)

You have the right to access, rectify, erase, restrict, port, and object to processing of your personal data, and to withdraw consent. To exercise any right, email nicola.gomme@kitandgrit.com. You can also complain to the UK ICO (ico.org.uk) or your local EU supervisory authority.

8. Security

Data is encrypted in transit (HTTPS) and at rest. Photos are stored in a private bucket accessible only to your account through row-level security policies.

9. Children

The Service is not intended for under-16s and we do not knowingly collect their data.

10. Contact

Applyplus Ltd - nicola.gomme@kitandgrit.com.