Privacy Policy

1 Who we are

The data controller responsible for your personal information is:

Nextwave Infotech (a sole proprietorship owned by Dhruvisha Jagani)
408, Elita Square, Utran, VIP Circle, Surat, Gujarat 394105, India
Email: support@nextwaveinfotech.com
Phone: +91 88491 38176
Grievance Officer (India DPDP Act, 2023): Dhruvisha Jagani, support@nextwaveinfotech.com — grievances are acknowledged within 48 hours and resolved within 30 days.

We have not appointed a separate EEA/UK representative or Data Protection Officer; for all privacy matters, contact us using the details in the Contact section.

2 Information we collect

2.1 Information you provide

• Account information. Email, display name, and (for email sign-up) a password managed by our authentication provider. If you sign in with Google or Apple, we receive your name, email and profile photo from that provider. With Apple’s “Hide My Email,” we receive a private relay email.
• Guest use. You may also use the App as a guest without registering. We then create an anonymous account identifier for you and collect the device and usage data described in this Policy, without an email address. Guest accounts and their data can be deleted in the App just like registered accounts (see Section 13).
• Profile information. Optional name, phone number, and profile photo.
• Photos & images. The full-body photo of yourself and the outfit images you upload or select to generate a try-on. See Section 3.
• Model descriptions. If you use “Create your own model,” the description you type and the gender you select are sent to ModelsLab to generate a model image; we store the description and the image with your account until you delete that model or your account. Please do not include health or other sensitive information in descriptions.
• Referral programme. If you use Invite & Earn we store your invite code, who invited you, and counters of friends joined and credits earned.
• Purchases. Processed by the Apple App Store or Google Play and our purchase provider (RevenueCat). We receive purchase and entitlement records, but not your full card number.
• Communications. Information you provide when contacting support or exercising a right.

2.2 Information collected automatically

• Device & identifiers. On Android we read the Android ID assigned to the App; on iOS we generate a random identifier and keep it in the device Keychain so it persists if you reinstall. We store it with your account and keep a one-way SHA-256 hash of it permanently to prevent repeat free-credit and referral claims. We also collect your device model, OS version, app version, language, and a user ID.
• Usage & analytics. Events such as screens viewed, taps, and try-ons, via Mixpanel. We also associate your user ID, name, and email address with your analytics profile and record purchase amounts in Mixpanel to understand feature usage and revenue. In the EEA, UK and Switzerland, analytics runs only if you consent in the form shown at first launch. Elsewhere analytics runs by default under our legitimate interests; you can opt out at any time by e-mailing support@nextwaveinfotech.com (see Section 9).
• Advertising identifiers. Where ads appear, Google AdMob and Meta Audience Network may access your advertising ID to serve and measure ads.
• Meta (Facebook) SDK. To measure our app-install advertising, the Meta SDK in the App reports an app-install and app-launch event to Meta together with your advertising identifier and basic device information. In the EEA/UK, and on iOS unless you allow tracking, this happens only after you consent.
• Crash & diagnostics. If the App crashes or an operation fails, Firebase Crashlytics (Google) receives the technical error report, device model/OS, app version, an installation identifier and the sequence of screens leading up to the error. Reports are kept for 90 days.
• Push registration. The App registers your device with OneSignal (device model, OS, language, time zone, country, app version and, when you sign in, your user ID). We send notifications only if you turn them on in Settings.
• Approximate location. No precise GPS. Partners may infer city/region-level location from your IP address.
• Install referrer (Android). When you install the App through a referral link, we read the Play Store install referrer once, on first launch, to apply your invite code automatically. We use only the invite code contained in the referrer string and do not store the rest.
• Local storage. The App keeps a copy of the photo you chose, your outfit image, a cache of results and your settings on your device. This data is removed when you sign out, delete your account or uninstall.

2.3 Information from third parties

• Sign-in providers (Google, Apple) — identity details as above.
• App stores & purchase provider (Apple, Google, RevenueCat) — purchase validation and subscription status.

3 Your photos & AI processing

Generating a try-on requires processing the images you provide — the most sensitive processing we perform:

• What we process. The photo of you and the outfit image you upload or select.
• On-device validation. Your photo is first checked on your device to confirm it contains a person (see Section 4).
• Transfer to AI processors. To create the try-on, your photo and the outfit image are transmitted to third-party AI services — ModelsLab and/or Google (Gemini API) — which process them to produce the result, acting as our processors/sub-processors. If you use Create your own model, the text description you type (and the gender you select) is sent to ModelsLab to generate the model image.
• Temporary storage. Your photo and the outfit image are uploaded to our cloud storage (Google Firebase) only for the seconds needed to generate the try-on and are deleted automatically as soon as the result is ready, whether or not the generation succeeds. If an interruption prevents that, remaining uploads are removed automatically within 24 hours and when you delete your account.
• Generated results. Your try-on result is created on our AI provider’s servers and immediately copied into our own cloud storage (Google Firebase), from which it is shown to you. Once we hold our copy we instruct ModelsLab to delete the copy on its servers. Every generated image — including results you do not save and background variations you preview — is kept in our storage so we can show it to you again; unsaved images are deleted automatically after 30 days, and saved Creations are kept until you delete them or your account. Results you download are saved to your device gallery.
• Our AI providers. ModelsLab (M Studio AI Inc., India) downloads your photo and the outfit image from a temporary, access-tokenised link, generates the result and hosts it on its servers. ModelsLab deletes all generated data automatically after 30 days, and we instruct it to delete our results earlier, as soon as we have copied them to our storage. ModelsLab states that it is SOC 2 Type II and ISO 27001 certified and GDPR-compliant and encrypts data at rest. Google (Gemini API), used when ModelsLab is unavailable, receives your photo and the outfit image, keeps prompts and outputs for up to 55 days solely to detect abuse, and — because we use Google’s paid API — does not use them to improve its models.
• No AI training. We never use your photos or results to train any model of our own. Google does not train on content we send through the paid Gemini API. ModelsLab has not given us a written training commitment; we therefore delete our results from ModelsLab as soon as we have copied them, ModelsLab deletes all generated data within 30 days in any case, and we will update this Policy if we obtain a commitment.

4 Face detection & biometrics

The App uses Google ML Kit to run on-device face/person detection solely to verify that an uploaded photo contains a human before it is used for a try-on. Importantly:

• Detection runs locally on your device and is not transmitted to us for that purpose. Face landmarks and head angles are computed transiently on your device and discarded immediately.
• For the Background Change feature we also run on-device person segmentation (Google ML Kit on Android, Apple Vision on iOS). Like face detection, nothing leaves your device.
• We do not create, store, or use a faceprint, face geometry, or any biometric identifier to identify you.
• We do not use face data for authentication, surveillance, or recognition, and never sell or share biometric information.

This section addresses biometric-privacy laws such as the Illinois Biometric Information Privacy Act (BIPA) and comparable statutes.

5 How we use your information

Abuse prevention

To prevent abuse of one-time free credits and of referral and daily-reward bonuses (e.g., deleting and re-creating accounts, or claiming the same invite from one device repeatedly), we store a one-way SHA-256 hash of your e-mail address, sign-in provider ID and device identifier. It lets us recognise a repeat claim but does not contain your e-mail or identifier in readable form; we treat it as personal data, use it solely to prevent free-credit, referral and daily-bonus abuse, and retain it after deletion.

6 Legal bases (EEA / UK)

If you are in the EEA or UK, we rely on these legal bases under the GDPR/UK GDPR:

Where your photo is treated as a special category of data, we rely on your explicit consent (Art. 9(2)(a)).

7 How we share information

We do not sell your personal information for money. We share information only as follows:

• Service providers / sub-processors processing data on our behalf under contract (see Section 8).
• AI processors that generate your try-on results (ModelsLab, Google Gemini).
• Analytics, crash-reporting, push-notification and purchase providers (Mixpanel, Firebase Crashlytics, OneSignal, RevenueCat), which process data only on our instructions.
• Advertising partners for showing and measuring ads. Under some laws (e.g., California CPRA) this may be “sharing” for cross-context behavioral advertising; you can opt out (see Section 12).
• Meta, which receives app-install and app-launch events and your advertising ID so we can measure our advertising; under some U.S. laws this may be “sharing”, and you can opt out (Section 12).
• Legal, safety & corporate transactions — to comply with law, protect rights and safety, or in a merger, acquisition, or asset sale.

8 Third-party services

The App integrates the following services, each processing data under its own privacy policy:

9 Advertising & analytics

The App may show ads served through Google AdMob with Meta Audience Network mediation, and uses Mixpanel for analytics. Depending on your consent and settings, ads may be personalized using your advertising identifier and related signals.

Our ad partners receive your advertising ID, IP address (approximate location and fraud prevention), device and app information and how you interact with ads. In the EEA/UK/Switzerland the ad technology providers Google may share data with are listed at support.google.com/admob/answer/9012903.

• iOS: Control tracking via Settings → Privacy & Security → Tracking (App Tracking Transparency).
• Android: Reset/delete your advertising ID and opt out of personalization in Settings → Google → Ads.
• Where required (for example in the EEA/UK), we display a consent form powered by Google’s User Messaging Platform when you first open the App; ads and analytics then run only according to your choices there.
• Withdraw consent in the App: where these consent rules apply, you can review or withdraw your consent for personalized ads at any time via Settings → Manage Ad Consent, which reopens the consent options form. Withdrawing consent also stops analytics tracking.

10 International data transfers

We are based in India, and our providers process data in the United States (Google, RevenueCat, Mixpanel, Meta), the EU/US (OneSignal) and India (ModelsLab). For transfers from the EEA/UK we rely on the Standard Contractual Clauses (with the UK Addendum) in our providers’ data-processing terms, and on your explicit consent for the photos you submit. You may request a copy of the relevant safeguards using the contact details below.

11 Data retention

12 Your privacy rights

Depending on where you live, you may have some or all of these rights:

• Access — request a copy of the personal data we hold about you.
• Correction — correct inaccurate or incomplete data.
• Deletion — request deletion of your data.
• Portability — receive your data in a portable format.
• Objection / restriction — object to or restrict certain processing.
• Withdraw consent — where processing is based on consent.
• Opt out of “sale” or “sharing” and targeted advertising, and limit use of sensitive personal information (U.S. state laws).
• Non-discrimination — we won’t discriminate against you for exercising rights.
• Complaint — lodge a complaint with your local data-protection authority.

To exercise any right, contact support@nextwaveinfotech.com. We respond within one month (EEA/UK), 45 days (U.S. state laws), or as required by law; we may ask you to confirm your identity by replying from your registered e-mail. You may use an authorized agent where permitted.

13 Account & data deletion

You can delete your account in the App: Settings → Delete Account (guest accounts included, while you are still signed in). After you re-verify your identity we delete your sign-in account, your profile, your remaining credits, your saved and unsaved results, models and collections, and the copies of your results held by ModelsLab, and we delete your analytics profile and sign you out of push notifications and purchases. Your analytics event history, push-notification record and purchase-provider customer record are deleted within 30 days. We keep only the one-way fraud-prevention hashes described in Section 5 and purchase records we must retain by law. For full steps and a breakdown of what is deleted and retained, see our Account Deletion page. If you cannot sign in, e-mail support@nextwaveinfotech.com from your registered address and we will delete your account within 30 days.

14 U.S. state & California disclosures

This section supplements the Policy for residents of California (CCPA/CPRA) and similar U.S. state laws (Virginia, Colorado, Connecticut, Utah, Texas). We do not sell your personal information for money. In the preceding 12 months, we may have collected these categories:

California residents may exercise the rights in Section 12, including opting out of “sharing” for cross-context behavioral advertising. To opt out, email support@nextwaveinfotech.com, and use your device’s advertising controls described in Section 9. We use and disclose sensitive personal information (your photos and sign-in credentials) only to provide the service you request, not to infer characteristics about you. We do not knowingly sell or share the personal information of consumers under 18.

15 EEA / UK disclosures

If you are in the EEA or UK, our legal bases are in Section 6 and your rights in Section 12. You have the right to lodge a complaint with your supervisory authority. Where we require a photo for AI processing, we rely on your explicit consent, which you may withdraw at any time by ceasing to upload photos and/or deleting your account.

16 Children’s privacy

The App is intended for adults. You must be at least 18 years old to use the App. We do not knowingly collect personal information from anyone under 18; if you believe a minor has used the App, contact us and we will delete the data.

17 Data security

We use technical and organizational measures designed to protect your information, including encryption in transit, access controls, and reputable cloud infrastructure (Google Firebase). No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please keep your login credentials confidential.

18 Changes to this Policy

We may update this Policy from time to time. Material changes will be indicated by updating the “Last updated” date and may be highlighted within the App or by other reasonable means. Where a change affects processing that relies on your consent (such as which AI providers receive your photos), we will ask for your consent again in the App before it applies to you. Your continued use of the App after changes take effect constitutes acceptance of the revised Policy.

19 Contact us

For any privacy questions or to exercise your rights, contact us:

We have not appointed an EEA/UK representative under GDPR Art. 27; EEA/UK users can contact the controller directly at support@nextwaveinfotech.com with any privacy request.