Privacy Policy
HalloweenDress ("we") runs Costume Closet. This policy explains what data we collect, why, how long we keep it, and what you can ask us to do with it.
What we store, and for how long
| Data | Why | Where | How long |
|---|---|---|---|
| Uploaded photo | To generate your preview | Private object storage | Deleted within 1 hour |
| Generated image | To show and download your result | Private object storage | Deleted after 14 days |
| Account identifier | To keep your credits and history | Application database | Until you delete your data |
| Session and security token | To keep you signed in and prevent abuse | Your browser / database | Until you clear cookies or delete your data |
| Support email you send us | To answer you | Email provider | Up to 24 months |
| Usage and error events | Security, fraud prevention and reliability | Application database | Up to 12 months |
| Payment records | Legal and accounting obligations | Payment provider / database | As long as tax law requires |
Lawful basis
We rely on performance of a contract to provide the service, on our legitimate interests in securing and improving it, and on consent where we ask for it (for example analytics cookies).
Your photos and AI
Your uploaded photo is used only to produce your preview. It is passed to our AI processor, which acts on our instructions. We do not use your photographs to train our own models, and free previews carry a visible watermark.
Processors and sub-processors
We use the following categories of providers, each acting only on our documented instructions:
- Payments: Razorpay — takes payment, returns the transaction result.
- Infrastructure and storage: Vercel (hosting), Supabase (database and private file storage).
- AI generation: Google, for text recommendations and image generation.
- Email: Resend, to send account and support emails.
- Rate limiting: Upstash Redis, to prevent abuse.
- Bot protection: Cloudflare Turnstile.
- Monitoring and analytics (optional): Sentry, Plausible.
Your rights
You may ask us for a copy of your data, ask us to correct it, or ask us to delete it. You can also ask us to restrict or object to processing, and to data portability. Email [email protected] and we will respond within 30 days. If you are in the EEA or UK you may also complain to your local data protection authority.
Cookies and local storage
We store a session cookie and a security token in your browser, plus your consent choice and any unsent draft selections. We do not use advertising cookies and we do not sell personal data. You can clear your browser storage at any time; doing so creates a new anonymous session.
Children
The service is for adults aged 18 and over. We do not knowingly collect data from children, and we delete an account immediately if we learn it belongs to a child.
HalloweenDress, India. Privacy questions: [email protected].