Outfint for Brands – Privacy Policy

1. Who We Are

Outfint for Brands is operated by:

Outfint Technology Ltd
Company number: 16798802
124–128 City Road
London EC1V 2NX
United Kingdom

Email: contact@outfint.com

For personal information for which Outfint determines the purposes and means of processing, Outfint Technology Ltd is the data controller.

In certain circumstances described below, we process personal information on behalf of a merchant. In those circumstances, the merchant is normally the controller and Outfint acts as its processor.

2. Information We Collect

The information we collect depends on how you interact with the Service and which features you enable.

Merchant and account information

When you contact us, create an account, install the Shopify app, join a pilot or use the Service, we may collect:

• name;
• business email address;
• job title or role;
• company or brand name;
• telephone number, where provided;
• account identifiers;
• account preferences;
• authentication and login information;
• communications with our team; and
• information relating to your subscription, pilot or commercial arrangement.

We may also receive business contact information from your employer, business partners, referral partners, publicly available professional sources or other legitimate business sources.

Shopify store information

If you connect a Shopify store, we may receive information made available through Shopify APIs according to the permissions granted to Outfint, including:

• store name and domain;
• store identifiers;
• store currency, locale and related settings;
• product and collection information;
• product titles and descriptions;
• product images;
• categories, tags and product attributes;
• variants, prices and availability information;
• inventory-related information;
• product metafields or other catalogue metadata where enabled; and
• information required to maintain and synchronise the integration.

The exact information available to Outfint depends on the permissions requested by the app and approved by the merchant.

Catalogue information from other sources

If you provide your catalogue through a CSV file, product feed, API or other integration, we may process information such as:

• product names and identifiers;
• descriptions;
• product images;
• categories and collections;
• colour, fit, style, seasonality, formality and other fashion attributes;
• variants;
• prices;
• availability; and
• other product metadata provided by you.

Most catalogue information is not personal information. However, catalogue assets may occasionally contain personal information, for example where product imagery contains identifiable models.

Storefront and performance information

Where Outfint storefront components or analytics features are enabled, we may process information about how shoppers interact with those components.

This may include:

• page and product identifiers;
• outfit recommendations displayed;
• recommendation impressions;
• clicks and interactions;
• products added to a cart;
• conversion or purchase attribution;
• order or transaction identifiers;
• products contained in an order;
• transaction values;
• timestamps;
• browser or device information;
• IP address or derived approximate location where necessary;
• cookie or similar identifiers where permitted; and
• technical information required to measure the performance of the Service.

We aim to use the minimum information necessary to provide recommendation and performance analytics.

Outfint does not require shoppers’ payment card information to provide its outfit recommendation features, and we do not process payment card details through the Service.

Where we process shopper or customer personal information solely to provide the Service on behalf of a merchant, the merchant determines the relevant purposes and lawful basis and Outfint processes the information as a processor.

Usage, security and technical information

When you access the dashboard, website or Service, we may automatically collect:

• IP address;
• browser and device type;
• operating system;
• pages or features accessed;
• actions performed within the Service;
• timestamps;
• authentication events;
• error and diagnostic information;
• application logs; and
• security-related events.

We use this information to operate, secure, troubleshoot and improve the Service.

Support and communications

If you contact us, request a demo, book a meeting or communicate with us, we may process your name, business contact details, company, message contents and related correspondence.

Where you use a third-party scheduling service, such as Calendly, that provider may also process information in accordance with its own privacy policy.

Billing information

Where subscriptions or other charges are processed through Shopify or another payment provider, the payment provider may process your payment information.

Outfint may receive billing status, subscription information, transaction references and related commercial information, but we do not normally receive full payment card details.

3. How We Use Information

We use information to:

• provide, operate and maintain Outfint for Brands;
• create and administer merchant accounts;
• connect and synchronise product catalogues;
• analyse catalogue attributes;
• generate compatible outfit combinations and recommendations;
• allow merchant teams to review, approve and manage recommendations;
• display approved recommendations through storefront components;
• provide engagement, conversion and influenced-revenue analytics;
• provide customer support and onboarding;
• communicate about the Service;
• administer subscriptions, pilots and commercial agreements;
• monitor performance and troubleshoot technical problems;
• protect the Service, merchants and users against fraud, abuse and security threats;
• improve our products, algorithms and user experience;
• develop new features using aggregated, anonymised or appropriately protected information;
• comply with legal and regulatory obligations; and
• establish, exercise or defend legal claims.

4. Artificial Intelligence and Automated Processing

Outfint uses automated systems and artificial intelligence to analyse product information and identify attributes and relationships between fashion items.

These systems may be used to:

• classify products and fashion attributes;
• identify complementary items;
• rank product compatibility;
• generate outfit combinations;
• generate descriptive information relating to outfits; and
• support other merchandising features.

Catalogue information and product assets may be processed by technology and AI service providers where necessary to provide these features.

Outfint does not intentionally provide shopper names, email addresses, postal addresses or payment information to generative AI providers for the purpose of generating outfit recommendations.

AI-generated recommendations may contain errors or produce combinations that a merchant considers unsuitable. Outfint therefore provides merchant review and publishing controls so that the merchant can determine which recommendations appear to its customers.

We do not use Outfint for Brands to make solely automated decisions about individuals that produce legal or similarly significant effects on them.

5. Our Lawful Bases

Where Outfint acts as a controller under UK or European data protection law, we rely on one or more of the following lawful bases.

Performance of a contract: where processing is necessary to provide the Service, administer an account, provide support or perform our agreement with a merchant.

Legitimate interests: where necessary for legitimate business purposes such as operating and improving the Service, maintaining security, preventing misuse, analysing product performance, communicating with business customers and prospective customers, and developing our business, provided those interests are not overridden by the rights and interests of individuals.

Consent: where we ask for consent, including for certain cookies, tracking technologies or marketing activities where consent is legally required.

Legal obligation: where processing is necessary to comply with applicable law, regulatory obligations, tax requirements or lawful requests.

Where Outfint processes personal information on behalf of a merchant as a processor, the merchant is responsible for establishing the applicable lawful basis for that processing.

6. Merchant Customer and Storefront Data

When Outfint processes personal information relating to a merchant’s customers or storefront visitors solely to provide the Service, we act on the merchant’s documented instructions.

The merchant is responsible for:

• determining the purposes and lawful basis for processing;
• providing appropriate privacy information to its customers;
• obtaining consent where required, including for applicable tracking technologies;
• configuring its Shopify privacy and consent settings appropriately; and
• handling customer privacy requests as controller.

Outfint will provide reasonable assistance to merchants in responding to applicable privacy requests.

For Shopify integrations, we also process applicable data-access and deletion requests received through Shopify's required privacy mechanisms.

7. Cookies and Similar Technologies

Our website, dashboard and storefront integrations may use cookies, pixels, local storage or similar technologies.

These technologies may be used for:

• essential authentication and security;
• maintaining sessions and preferences;
• service functionality;
• measuring Service usage and performance;
• analytics; and
• understanding interactions with Outfint recommendations.

Where applicable law requires consent for a particular technology, it should only be activated after the required consent has been obtained.

Storefront merchants are responsible for ensuring that Outfint integrations are implemented consistently with their own cookie and consent obligations.

8. How We Share Information

We do not sell personal information.

We may disclose information to the following categories of recipients where necessary:

Hosting and infrastructure providers that host or operate parts of the Service.

Database and storage providers that store Service information.

AI and machine-learning providers that assist with product classification, recommendation generation or related functionality.

Analytics and monitoring providers that help us understand Service performance and diagnose errors.

Authentication providers where used to manage accounts securely.

Communications and support providers used for email, support and customer communications.

Scheduling providers used to arrange demonstrations or meetings.

Payment or billing providers, including Shopify where applicable.

Professional advisers, including lawyers, accountants, insurers and auditors where reasonably necessary.

Authorities and regulators where disclosure is required by law or necessary to protect legal rights.

Corporate transaction parties where information is reasonably necessary in connection with a merger, acquisition, financing, restructuring or sale of all or part of our business, subject to appropriate confidentiality protections.

Service providers that process personal information on our behalf are required to handle that information under appropriate contractual and security obligations.

9. Shopify

If you install Outfint through Shopify, Shopify independently processes information about merchants and customers under its own terms and privacy practices.

Outfint receives information from Shopify only according to permissions granted to the app and applicable Shopify requirements.

Shopify requires apps distributed through its App Store to support privacy requests relating to customer data and shop data. Where applicable, we respond to such requests and delete, anonymise or provide relevant data within the required timeframe, unless retention is required by law.

Uninstalling the Shopify app removes Outfint's ongoing access to the merchant's Shopify APIs, subject to Shopify's platform processes.

10. International Data Transfers

Outfint is based in the United Kingdom.

Some of our service providers may process information in the United Kingdom, European Economic Area, United States or other countries.

Where personal information is transferred internationally and applicable law requires additional protection, we use appropriate safeguards. Depending on the transfer, these may include:

• UK or EU adequacy regulations or decisions;
• the European Commission's Standard Contractual Clauses;
• the UK International Data Transfer Agreement;
• the UK Addendum to the European Commission's Standard Contractual Clauses; or
• another legally recognised transfer mechanism.

11. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including legal, accounting, security and contractual requirements.

Generally:

• merchant account information is retained while the account or commercial relationship remains active;
• catalogue and integration data is retained while required to provide the Service and is deleted or anonymised following termination or disconnection, subject to backups and legal requirements;
• storefront interaction and analytics information is retained only for the period reasonably necessary to provide analytics and improve the Service;
• security and technical logs may be retained for a limited period for security, troubleshooting and fraud prevention;
• support and business correspondence may be retained for the duration reasonably necessary to manage the relationship and establish or defend legal claims; and
• contractual, billing and accounting records may be retained for up to six years after the relevant relationship ends where necessary for legal or accounting purposes.

Information contained in backups may remain for a limited additional period until the relevant backup is securely overwritten.

We may retain aggregated or genuinely anonymised information that no longer identifies an individual.

12. Data Security

We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, disclosure, alteration, loss or destruction.

These measures are reviewed according to the nature of the information processed and risks associated with the Service.

No online system can be guaranteed to be completely secure, and merchants are also responsible for protecting their account credentials and controlling access granted to their users.

13. Your Data Protection Rights

Depending on your location and the circumstances, you may have rights including the right to:

• request access to your personal information;
• request correction of inaccurate information;
• request deletion of your information;
• restrict certain processing;
• object to certain processing;
• receive certain information in a portable format;
• withdraw consent where processing is based on consent; and
• object to direct marketing at any time.

These rights are subject to applicable legal conditions and exemptions.

To exercise a right relating to information Outfint controls directly, contact contact@outfint.com.

If your request relates to information Outfint processes on behalf of a merchant whose website you visited or purchased from, you should normally contact that merchant first. We will assist the merchant where required.

14. Marketing Communications

We may send relevant communications about Outfint for Brands to existing or prospective business contacts where permitted by law.

You may opt out of marketing communications at any time using the unsubscribe mechanism provided or by contacting us.

Service-related communications necessary to administer an account or contractual relationship are not marketing communications and may continue while the relevant relationship exists.

15. United States Privacy Rights

Residents of certain US states may have additional privacy rights where the applicable state privacy law applies to Outfint.

These may include rights to access, correct, delete or obtain a copy of certain personal information, or to opt out of certain uses.

Outfint does not sell personal information for monetary consideration.

Where legally applicable, requests may be submitted to contact@outfint.com. We may need to verify a request before responding.

16. Children

Outfint for Brands is a business service and is not intended for use by children.

Merchant accounts should only be created or used by individuals authorised to act for a business.

We do not knowingly solicit personal information directly from children through merchant accounts.

17. Complaints

If you have concerns about how we process your personal information, please contact us first at contact@outfint.com so that we can investigate.

You also have the right to complain to the Information Commissioner's Office (ICO) in the United Kingdom.

Individuals in the European Economic Area may also have the right to complain to the data protection supervisory authority in the country where they live or work.

18. Changes to This Privacy Policy

We may update this Privacy Policy when our Service, technology, legal obligations or data practices change.

Where changes are material, we will take reasonable steps to notify affected merchants, for example through the Service or by email.

The “Last updated” date at the top of this page identifies the latest version.

19. Contact

For questions, privacy requests or complaints relating to this Privacy Policy, contact:

Outfint Technology Ltd
124–128 City Road
London EC1V 2NX
United Kingdom

Email: contact@outfint.com