ThreadWeb Ltd (company number 16974872) is the controller of personal information processed through the ThreadWeb website and iOS app. Our registered office is 7 Fallowfields, Coventry, Warwickshire, United Kingdom, CV6 4PX. Our ICO registration number is ZC154733. General privacy enquiries: support@threadweb.co.uk. Data Protection Officer and New Zealand Privacy Officer: James Moffitt, james.moffitt@threadweb.co.uk.

This notice applies to ThreadWeb users and visitors in the United Kingdom, United States, Australia and New Zealand. The service is for people aged 18 or over. You must create an account before using its features.

Name, email address, user ID, authentication records, account status, accepted legal-document versions and timestamps, and information returned by Google or Apple if using those sign-in methods.

Body or appearance photos you choose to upload; photos containing clothing; wardrobe-item images; generated virtual try-on images; and visible appearance features needed for styling, such as skin-tone, undertone, contrast, face shape and body proportions.

Clothing items, outfit history, fit or style feedback, saved selections, calendar entries, occasions, preferences, measurements or sizing information you provide, and the personalised profile we create (your Style File).

Chat messages, prompts, questions, feedback and support communications.

Search terms, product selections, retailer URLs you provide, product titles, prices, merchant names and outbound-link events. Product information may come from public retailer pages and shopping-search providers.

A location you provide or permit the app to use and weather information associated with it, where you use weather-aware recommendations.

Your separate email-marketing choice, consent record, campaign delivery information and unsubscribe or suppression status.

App or browser version, device and operating-system information, request timestamps, feature interactions, errors, security events and technical logs used to operate, secure and troubleshoot ThreadWeb. We do not intentionally collect or infer ethnicity or racial origin. We do not create biometric templates or use facial recognition, identity verification, face matching, age estimation or emotion analysis. A photograph is personal information, but ThreadWeb does not process it for biometric identification. Please do not include health information, racial or ethnic information, sexual-orientation information or other sensitive information in free-text. If you submit unnecessary sensitive information, we may remove it or restrict its use.

Most information comes directly from you. We also create derived styling preferences and appearance descriptors from what you provide; receive sign-in information from Google or Apple; receive product information from SerpAPI and public retailer pages requested by you through Firecrawl; receive weather context from Open-Meteo; and receive operational information from our hosting, database and email providers.

Where we rely on legitimate interests, we balance ThreadWeb's need to operate, secure and improve the service against your privacy rights. You may object as explained below. Where device permission is required, such as access to photos or location, you can control that permission through your device settings.

ThreadWeb uses AI to analyse clothing and visible appearance, create Style File recommendations, support chat and shopping suggestions, extract clothing from a user-supplied image, and generate virtual try-on images. We send only the information reasonably needed for the feature you request. The detailed provider and retention information appears in our AI Transparency and Third-Party AI Notice. Personalisation compares your wardrobe, visible appearance features, preferences, answers and context to produce recommendations. These recommendations do not have legal or similarly significant effects. They are suggestions, not professional advice, and you decide whether to use them.

We may also disclose information to professional advisers, insurers, courts, regulators, law-enforcement bodies or a buyer or successor to our business where lawfully required. Our suppliers generally act under business terms and data-protection obligations. Some providers may separately process limited information for security, abuse prevention and legal compliance as described in their own notices.

ThreadWeb may show product information and remote images obtained from shopping-search services or public retailer pages. ThreadWeb does not claim ownership of retailer content and does not save retailer product images as local downloadable copies. A selected remote product image may be transmitted to an AI provider solely to produce a user-requested virtual try-on result. Some outbound retailer links on the website are affiliate links. If you buy after clicking one, ThreadWeb may receive a commission at no extra cost to you. ThreadWeb does not activate Sovrn tracking merely because you view ThreadWeb; the affiliate redirect occurs after your intentional click. The destination service may use its own cookies and privacy practices.

Although ThreadWeb's principal Supabase project is in London, several suppliers are based in, or process information from, the United States and other countries. Those countries may have different privacy laws. Where UK transfer rules apply, we use an adequacy regulation or approved contractual safeguards such as the UK International Data Transfer Agreement or UK Addendum, together with supplier security commitments. Contact the DPO for information about the relevant safeguard. For New Zealand users, ThreadWeb remains responsible for information held by cloud providers acting on our behalf. Where Information Privacy Principle 12 applies to a disclosure, we use recipient assurances, contractual protections or another permitted basis intended to provide comparable safeguards.

ThreadWeb uses access controls, encrypted connections, restricted administrative access and provider security features appropriate to the service. Body images are stored in private Supabase storage and accessed using time-limited signed URLs. A changing signed URL is a security control; it does not make the image anonymous. Only two authorised ThreadWeb team members currently have access to provider and operational logs, and access is limited to troubleshooting, security and service operation. No internet service is completely secure. Please use a strong, unique password and contact us promptly if you suspect unauthorised access.

Depending on where you live and the applicable law, you may ask us to access, correct, delete or restrict your information; receive certain information in a portable form; withdraw a consent; or complain about our handling. UK users may also object to processing based on legitimate interests.

You have the right to object at any time to direct marketing and, in some circumstances, to processing based on our legitimate interests. We will stop direct marketing when you object. For other objections, we will stop unless we have compelling lawful grounds or need the information for legal claims. You can delete your account in Settings or email support@threadweb.co.uk. Deletion removes active account-linked data immediately, while provider logs, backups and minimal legal or suppression records expire under the periods above. You can unsubscribe from marketing through any marketing email. We may ask for information needed to verify a rights request.

ThreadWeb does not sell personal information, share it for cross-context behavioural advertising, or use sensitive personal information to infer characteristics. ThreadWeb does not currently respond differently to browser Do Not Track signals because it does not run cross-site advertising trackers on its own service. A Global Privacy Control signal is treated as an opt-out where applicable, although ThreadWeb currently has no sale or targeted-advertising processing to opt out of. Residents of US states with applicable privacy rights may request access, correction, deletion or a copy, and may appeal a refused request, by contacting the DPO. Some state statutes apply only after business or processing thresholds are met, but we will consider all reasonable requests.

Australian privacy-law coverage can depend on business size and statutory exceptions. Regardless of whether a particular Privacy Act obligation applies, ThreadWeb uses the practices described in this notice. Australian marketing emails identify ThreadWeb, include a working unsubscribe route, and can be turned off in Settings. For New Zealand users, James Moffitt is ThreadWeb's Privacy Officer. You may request access or correction and complain to ThreadWeb first. You may also contact the Office of the Privacy Commissioner at privacy.org.nz.

Please contact the DPO first so we can try to resolve your concern. UK users may complain to the Information Commissioner's Office at ico.org.uk or by calling 0303 123 1113. New Zealand users may contact the Office of the Privacy Commissioner. Australian users may contact the Office of the Australian Information Commissioner where its jurisdiction applies. These routes do not limit any other legal remedy.

We may update this notice when the service, providers or law changes. We will post the new version and update its date. If a change would materially alter how we use personal information, we will give appropriate advance notice and obtain a new permission or consent where required. Continued use will not be treated as consent to a new processing purpose where the law requires consent.