Vestra — AI Wardrobe Studio
Last updated: July 21, 2026
This Privacy Policy explains how Vestra App ("Vestra", "we", "us") collects, uses, and shares information when you use the Vestra mobile application and website (the "Service").
Account information. The app creates an anonymous account with a randomly generated user ID and display name. You may optionally set a display name and profile photo. We do not require your name, email address, or phone number.
Photos you provide. With your explicit in-app consent, we collect the full-body photos you upload as your "model", garment photos you upload, and any profile photo you set. Photo processing begins only after you consent.
Generated content. The AI try-on images and videos generated from your inputs are stored with your account so you can view them again.
Purchase and credit information. Records of your credit balance, credit transactions, and store purchase transactions (product identifier, transaction ID, subscription status). Payment is processed entirely by Apple or Google — we never receive your card details.
Advertising attribution data. If you install the app after tapping one of our ads, we may collect the ad campaign parameters from the link, and — for a short window around the ad click — your IP address, device platform, and browser user-agent, which we use to probabilistically match your install to the ad click. Our ad landing page may also place a one-time attribution token on your clipboard, which the app reads once on first launch (on iOS you will see the system "Allow Paste" prompt) and then clears. Attribution data is used only to understand which campaigns work and to personalize content — never to grant or deny paid features.
Technical data. Basic device and log information generated by operating the Service (e.g., request logs, error logs, app version, OS).
To provide the Service: generating AI try-on Renders from your model photo and the selected garment/scene, storing your content, and maintaining your credit balance.
To process purchases and deliver purchased credits and subscription benefits.
To operate, secure, debug, and improve the Service.
To measure advertising campaigns (attribution) and personalize in-app content.
To comply with legal obligations.
We do not sell your personal information, and we do not use your photos to advertise to others or to train our own AI models.
To generate a Render, your model photo and the selected garment image are transmitted to our AI infrastructure provider, which processes them solely to produce the output and returns it to us. Your photos are shared with providers only as necessary to generate the content you requested.
Face data
Vestra does not collect biometric face data. We do not perform facial recognition; we do not extract facial geometry, landmarks, or any "faceprint"; and we never use face data to identify anyone. The only face-related data we handle are the ordinary photographs you choose to provide — your full-body model photo, the try-on images and videos ("Renders") generated from it, and your optional profile photo. These photographs are used solely to provide the try-on feature you request and to display your own content to you in the app. They are stored with our storage provider (Bunny.net) and referenced from our database (Supabase); at render time they are processed by our AI infrastructure provider (Runware) solely to produce the output you requested. They are never sold, never used for advertising, and never used to train AI models. Photographs are retained only while your account is active and are permanently deleted from our systems when you delete a model photo in the app, use Settings → "Delete all face & body data", or delete your account in Settings.
We use a small number of service providers who process data on our behalf:
Supabase — backend database, authentication, and serverless functions.
Bunny.net (Bunny CDN) — storage and delivery of photos, Renders, and catalog media.
Runware — AI image and video generation (receives your model photo and garment image per render request).
Adapty — subscription and purchase management (receives your anonymous user ID and store transaction data).
Apple App Store / Google Play — payment processing.
Cloudflare — hosting of our website and ad landing pages.
These providers are bound by contractual obligations to process data only on our instructions. Your data may be processed in countries other than your own (including the EU and the United States); where required, we rely on appropriate safeguards such as standard contractual clauses.
Model photos, uploads, and Renders are retained while your account is active so the Service can function (e.g., re-running a render, viewing past results).
Attribution click records are retained only as long as needed for campaign measurement.
Credit and purchase ledgers are retained as long as necessary for accounting, fraud-prevention, and legal purposes.
When you delete your account, we delete your personal data (including photos and Renders) except where retention is legally required.
Depending on your location (including under the GDPR and Turkish KVKK), you may have the right to access, correct, delete, or receive a copy of your personal data, to restrict or object to its processing, and to withdraw consent at any time (withdrawing consent does not affect prior lawful processing). To exercise any right — including full account and photo deletion — contact us at vestrapp.dev@gmail.com. We will respond within the legally required period. You may also lodge a complaint with your local data-protection authority.
You can also, at any time in the app: delete individual model photos, and decline or revoke photo-processing consent (which stops new uploads).
Photos and Renders are stored under unguessable, user-scoped paths; database access is protected by row-level security so only your account can read your data; credits are managed exclusively server-side; and session credentials are stored in your device's secure keychain. No system is perfectly secure, but we apply industry-standard safeguards and least-privilege access throughout.
The Service is not directed at children under 13 (or the applicable age of digital consent), and we do not knowingly collect their data. If you believe a child has provided us personal data, contact us and we will delete it.
Because accounts are anonymous, your session survives in your device keychain — on iOS it may persist even after uninstalling and reinstalling the app. Deleting the app does not by itself delete your server-side data; use in-app deletion or contact us for full erasure.
We may update this Privacy Policy from time to time. Material changes will be announced in the app or on our website. The current version is always available at [PRIVACY URL].
The data controller is:
Vestra App
Cekmekoy, Istanbul, Türkiye
Email: vestrapp.dev@gmail.com