Privacy Policy

This policy explains how Avri Ltd ("we") processes personal data when you use Kit & Grit. We are the data controller for the purposes of UK GDPR and the EU GDPR.

1. What we collect

• Account data: email address, authentication identifiers.
• Assessment data: quiz answers (height, body shape, colouring, training style, budget, layering preferences).
• Photos: optional images you upload to receive a more accurate assessment.
• Generated content: the AI analysis, palette, outfits and product recommendations created for you.
• Technical data: minimal logs (timestamp, request status) for security and debugging.

2. How we use it (lawful bases)

• Contract: to deliver the styling notebook you signed up for.
• Legitimate interests: to secure the Service and prevent abuse.
• Consent: for any optional marketing emails (you can withdraw at any time).

3. AI processing

Your photos and quiz answers are sent to AI model providers (Google Gemini and OpenAI, via the Lovable AI Gateway) to generate your analysis and visual flat-lays. These providers process your data on our behalf and do not use it to train their models under our gateway agreement.

4. Who we share with

• Hosting & database: Lovable Cloud / Supabase (EU region).
• AI processing: Google and OpenAI via the Lovable AI Gateway.
• Email: our transactional email provider for sign-in and account messages.

We do not sell your personal data.

5. International transfers

Some subprocessors are based in the US. Transfers are protected by Standard Contractual Clauses and the UK/EU adequacy frameworks where applicable.

6. Retention

• Account data: kept while your account is active.
• Assessments and photos: kept until you delete them or close your account.
• Backups: purged within 30 days of deletion.

7. Your rights (UK/EU GDPR)

You have the right to access, rectify, erase, restrict, port, and object to processing of your personal data, and to withdraw consent. To exercise any right, email hello@casaavri.com. You can also complain to the UK ICO (ico.org.uk) or your local EU supervisory authority.

8. Security

Data is encrypted in transit (HTTPS) and at rest. Photos are stored in a private bucket accessible only to your account through row-level security policies.

9. Children

The Service is not intended for under-16s and we do not knowingly collect their data.

10. Contact

Avri Ltd - hello@casaavri.com.