Privacy Policy.

Aplomb is operated by Aplomb SAS, a French société par actions simplifiée (SAS) — [SIREN to be assigned], headquartered at [Postal address — to be added once the SAS siège social is registered].

We are the data controller for the personal data described in this policy. The brands you discover through Aplomb are our commercial partners, not joint controllers of your scan data.

Privacy contact: privacy@aplomb-app.com. We do not currently have a designated Data Protection Officer — under GDPR Art 37 §1.b, a DPO becomes mandatory once we cross the “regular and systematic monitoring on a large scale” threshold; we'll appoint one before that.

The table below maps every personal-data category to its purpose, the GDPR Article 6 lawful basis, and how long we keep it.

We never collect: government-issued IDs, payment card numbers (Stripe handles those — we only see customer IDs), location data beyond IP country inference, advertising identifiers, or biometric templates used for unique person identification.

Body-scan photos are notprocessed to uniquely identify you as an individual — they are processed to estimate body dimensions and render try-on imagery. We treat them as Article 9 “biometric- adjacent” data anyway and process them only under your explicit consent (Art 9 §2.a), captured at signup and re-requested per session before the first try-on render.

You can withdraw consent at any time from your Account → Your datapage; deleting your account erases every photo (front + side derivatives) from our private bucket before deleting any database rows. Withdrawing consent does not affect the lawfulness of past processing.

We share strictly the minimum data each subprocessor needs to perform its role under a written DPA. We never sell, rent, trade, or share personal data for marketing purposes.

We will notify you 30 days in advance of adding any new subprocessor via this page (you can subscribe to a feed by checking back monthly or following Aplomb on a public channel).

Several subprocessors are headquartered in the United States. GDPR Chapter V allows such transfers when an adequate mechanism is in place:

• EU-US Data Privacy Framework (DPF): Vercel, Cloudflare, Google Cloud (Gemini). The European Commission recognised DPF as adequate in July 2023; you can verify each company's current DPF certification at dataprivacyframework.gov.
• Standard Contractual Clauses (SCCs): Supabase Inc. (parent), Stripe, fal.ai, Upstash. We use the European Commission's 2021 SCC templates.
• Intra-EU only: Stripe Payments Europe Ltd. (Ireland) handles all European billing data — no transfer outside the EEA.

A copy of any transfer mechanism we rely on is available by emailing privacy@aplomb-app.com.

Photos are stored in a private object bucket that is unreadable without short-lived signed URLs we generate server-side. All transport uses HTTPS with HSTS preload. Session tokens use SHA-256 hashing and constant-time comparison. Row-level security policies enforce per-user access to database rows. We log access to private buckets and review for anomalies.

We've set technical limits to prevent abuse (rate-limiting per IP, Cloudflare Turnstile on sign-up, file-size + MIME caps on photo uploads) and to make denial-of-service costly to attackers.

As a data subject in the EU/EEA, you have the following rights. Most can be exercised directly from your account, in-app:

• Access (Art 15) — see what we hold. Use Account → Export my data.
• Rectification (Art 16) — fix wrong details. Edit your name from Account; for email, contact us.
• Erasure (Art 17) — delete everything. Use Account → Danger zone. Your photos are removed from storage before any database row is deleted.
• Restriction (Art 18) — pause processing while a dispute is resolved. Contact us.
• Portability (Art 20) — receive your data in JSON. Same export link as Access above.
• Object (Art 21) — to processing on legitimate-interest grounds. Contact us with your reasons.
• Withdraw consent (Art 7 §3) — wherever processing is on consent (e.g., try-on photos). Deleting the account is the most thorough way; consent withdrawal does not undo past processing.

We respond within one month (Art 12 §3). You can also lodge a complaint with your local supervisory authority — for residents of France, that is the CNIL (cnil.fr/fr/plaintes).

When you use Aplomb's widget through a brand's site without signing up, we identify your session via an opaque token stored in a cookie (the hash, not the token, is stored in our database). Because we cannot link that token back to a real identity, Art 11 §2 applies: we cannot fulfil access or erasure requests on this anonymous data on our own — but you can present the cookie token back to us to prove ownership and request a deletion. To take direct control of your data, create a free account.

Anonymous data is auto-purged 13 months after the last activity.

We use only strictly necessarycookies and local storage today — no analytics, no ad tracking, no profiling beyond what's needed to operate the service. Under the ePrivacy Directive, strictly-necessary storage does not require a consent banner.

• aplomb_session_token — anonymous shopper session (httpOnly cookie, 7 days)
• client_plan — your shopper plan (httpOnly cookie, 1 year)
• next-auth.session-token — your signed-in session (httpOnly cookie, 30 days)
• aplomb_wardrobe — locally cached saved looks (localStorage)
• SCAN_COUNT_KEY — monthly scan counter for quota UI (localStorage)
• Cloudflare Turnstile cookies (one-time bot-check)

If we ever add analytics or marketing storage, we'll publish a full cookie banner with a reject option as prominent as the accept option, in compliance with CNIL guidelines.

We send only transactional emails by default (welcome, password reset, billing). Marketing emails (newsletter, product updates, promotions) require a separate opt-in checkbox at signup or a dedicated subscribe action — never bundled with general consent. Every marketing email contains a one-click unsubscribe link.

We bump the policy version (2026-05-31) on every material change and store proof of your acceptance. When the policy materially changes, you may be asked to re-accept before continuing to use Aplomb. Non-material edits (typos, clarifications) don't change the version.

For any privacy-related question — exercising your rights, asking about subprocessors, querying retention, etc. — email privacy@aplomb-app.com. For everything else, use hello@aplomb-app.com.