Vivariety ("we", "us", "our"), under the parent company of Ihcanum Enterprise Limited (SC868445), operates the Vivariety website at vivariety.vercel.app and vivariety.com as well as the Vivariety mobile application (together, the "Service"). This Privacy Policy explains what information we collect, how we use it, and the choices you have.By using the Service, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the Service.

1. Information We Collect
   We collect the following categories of personal information:
   • Account data: your email address, account identifier and authentication credentials needed to create and secure your account. Passwords are stored in hashed form rather than plain text.
   • Fit Passport data: height, weight, chest, waist, hip and other measurements you choose to enter, fit preferences and sizes at brands you already wear.
   • Size check history: the products you check and the size recommendations we provide.
   • Technical and usage data: device type, operating system, app version, IP address, diagnostic information and information about screens and features used, as applicable to the functionality enabled.
   • Subscription data: app user identifiers, subscription status, purchase and renewal events, transaction references and related subscription information supplied by Apple, Google and RevenueCat. We do not receive or store your payment card details.
   • Privacy preferences: your consent choices and records needed to demonstrate and honour them, including applicable Apple tracking permission status.
   • Support information: information you provide when contacting us, and correspondence needed to resolve your request.
   If you enable optional Meta advertising measurement, limited event and technical information is shared as explained in section 6. This can include identifiers used to link events to an app installation or device. Such identifiers can be personal data even if they do not include your name or email address.

We obtain information directly from you, through your use of the Service and from the subscription and platform providers described above. If you do not provide information needed for your account or a size recommendation, we may be unable to provide that feature. Advertising consent is optional.

2. How We Use Your Information
   This summary illustrates how we use the information provided by you:

• Providing the Service: we use account information, Fit Passport data, brand sizes and size check history to authenticate you, generate personalized recommendations and maintain your history. Our lawful basis is performance of our contract with you, where the processing is necessary to deliver the features you request.
• Managing subscriptions: we use subscription information to provide paid access, validate entitlements and handle related support. Our lawful basis is performance of our contract, and legal obligation where records must be kept by law.
• Security and support: we use necessary technical data and correspondence to secure the Service, investigate misuse, fix problems and respond to enquiries. Our lawful basis is our legitimate interests in operating a secure and reliable service, balanced against your rights, or performance of our contract where necessary to address a service request.
• Improving the Service: we use proportionate information to evaluate recommendation accuracy and service performance. Our lawful basis is our legitimate interests in improving the Service, subject to your rights. Where optional analytics involve device storage or access requiring consent, we obtain consent before enabling them and rely on consent for associated personal data processing.
• Advertising measurement: with your consent, we share the limited information in section 6 with Meta to attribute results to Facebook and Instagram advertising and assess campaign performance. We rely on consent for this processing and obtain consent for related device storage or access where required. We do not rely on legitimate interests to override a refusal or withdrawal of advertising consent.
• Service communications: we use your email address for necessary account, security, subscription and service updates. Our lawful basis is performance of our contract or our legitimate interests in keeping you informed about the Service, as appropriate. Permission for advertising measurement does not constitute permission for promotional emails.
• Legal compliance: we process information necessary to comply with applicable laws and valid legal requests on the basis of legal obligation. Where necessary to establish, exercise or defend legal claims, we rely on our legitimate interests, subject to applicable safeguards.
We may create genuinely anonymised, aggregated datasets to improve and train our size recommendation models. The creation of those datasets involves processing personal data and is based on our legitimate interests in improving recommendation accuracy, balanced against your rights. Removing your name or replacing it with an identifier is not, by itself, anonymisation. Only data that can no longer identify you using means reasonably likely to be used is treated as anonymous and may be retained indefinitely. Identifiable measurements are not shared with Meta.

Size recommendations are automated estimates based on the information you provide and relevant sizing information. They are not intended to make decisions producing legal or similarly significant effects. You remain free to decide what to buy.

3. How We Protect Information
   We use appropriate technical and organisational measures, including encrypted transmission over HTTPS, database encryption and access controls designed to restrict access to authorised users and personnel. No electronic system can guarantee absolute security. This does not limit our legal responsibilities to protect personal data or respond to security incidents.

   
   

4. Who Receives Information
   We do not sell, rent or trade your personal data. We disclose it only for the purposes and on the lawful bases described in this policy.
   • Vercel and Supabase provide hosting, database and related infrastructure. Where providers process personal data on our behalf, appropriate data processing terms apply and they must follow our lawful instructions.
   • RevenueCat provides subscription management and entitlement validation. It also forwards permitted subscription events to Meta under the separate consent conditions in section 6. RevenueCat is not the card payment processor for purchases through Apple or Google.
   • Apple and Google process purchases made through their app stores. They may act as independent controllers for their payment, account and platform services, under their own privacy notices.
   • Meta Platforms receives information only as described in section 6. Meta is not treated as merely an operational processor for all uses of that information. Depending on the activity and applicable terms, Meta may act as an independent controller or share controller responsibilities with us.
   Provider privacy policies explain their own processing but do not replace our obligations or the contractual safeguards required when they act on our behalf. Meta information is available at https://www.facebook.com/privacy/policy/. You can contact us for information about applicable provider arrangements and any relevant allocation of controller responsibilities.

When you follow a retailer link, that retailer processes information collected on its own website under its own privacy notice. Affiliate and referral tracking is addressed in section 7.

We may disclose necessary information to public authorities where legally required, and to professional advisers where necessary for legal compliance or claims. If the business is sold, merged or reorganised, necessary information may be disclosed to relevant advisers and a successor subject to confidentiality, appropriate safeguards and an applicable lawful basis. We will provide any notice required by law. This does not permit unrelated use of your data or bypass your consent choices.

5. Facebook & Instagram Advertising Measurement

   We advertise Vivariety on Facebook and Instagram. If you agree when we ask, or subsequently enable the option in Settings, the app reports limited events to Meta Platforms: app installation or first activation, account creation, completion of account setup, completion of a size check and viewing our subscription plans. A size check event reports that a check was completed, not the measurements, recommended size or product checked.

With the same permission, RevenueCat sends Meta events when you start or renew a subscription, so Meta can help us identify which advertising produces subscriptions. These events may include subscription value and currency, event time and identifiers needed for attribution. RevenueCat can send subscription events from its servers even when the app is closed; these events are subject to your consent choices too.

Event transmissions can include event names and times, app and device information, IP address and app, device or advertising identifiers where applicable and permitted. Meta can use permitted identifiers to match events with advertising interactions or information it already holds. These events are not necessarily anonymous. They support attribution, campaign reporting and optimisation; Meta processes received information under its applicable terms and privacy policy.

We do not send Meta your email address, including a hashed version of it, your body measurements, your clothing sizes or details of the products you check, either directly or through RevenueCat. We do not sell your personal data.

Optional advertising measurement is disabled unless you consent. Refusing it does not prevent you from using the Service or affect your subscription entitlements. On iPhone, this tracking also requires authorisation through Apple’s App Tracking Transparency prompt, commonly described as “Allow tracking”. Apple permission alone does not replace the separate consent requested by Vivariety. If either required permission is absent, this optional event sharing is not enabled.

You can withdraw consent at any time in the app’s Settings under “Help grow the Vivariety community”. Withdrawal stops further consent-based app events and RevenueCat subscription events being sent to Meta, including events waiting to be sent. It does not stop processing necessary to manage your subscription. You can also change Vivariety’s tracking permission in your iPhone settings.

Withdrawal does not affect the lawfulness of processing that occurred before it. We communicate withdrawal to relevant providers and cease processing based on that consent. Information already received by Meta is subject to applicable legal obligations and your rights; changing the setting does not automatically recall earlier transmissions. Contact us if you also wish to request deletion or exercise another right.

Separately, on iPhone, Apple’s SKAdNetwork can send privacy-preserving advertising attribution reports to Meta indicating that an installation resulted from an advert. Apple’s signed reports do not contain user- or device-specific identifiers and are subject to Apple’s privacy protections. This mechanism is separate from the identifiable event sharing above and may operate even if that sharing is switched off or Apple tracking permission is refused. It is not used by us to identify you or circumvent your choices.

6. Cookies & Similar Technologies

   Our websites and app may use cookies, software development kits and similar technologies to store or access information on your device. Strictly necessary technologies support functions such as signing in, security and remembering your privacy choices. Where an applicable legal exemption permits their use, these do not require consent.

Optional analytics, advertising and affiliate technologies that require consent are enabled only after you agree. We explain their purposes and relevant third parties when asking. Advertising tracking is governed by section 6. Any analytics operated under a statutory exemption must satisfy its conditions and is not used to bypass advertising consent.

Following a retailer link may involve affiliate or referral tracking so that a referral can be credited to us. This helps support the Service and does not affect the price you pay. We obtain consent for non-exempt tracking that we place or access; retailers are responsible for their own technologies and consent controls on their websites.

Use the privacy controls presented on our websites to manage optional website technologies and the app setting in section 6 for app advertising measurement. Browser settings provide additional controls but are not a substitute for our obtaining consent where required. Blocking essential technologies may affect Service functionality.

7. How Long We Keep Information
   We retain account, Fit Passport and size check information while your account is active and the information is needed to provide the Service. You can update your information or request deletion at any time. On account deletion, we ordinarily delete associated personal data from active systems within 30 days, subject to the limited exceptions below.

Necessary transaction, accounting and legal compliance records may be retained for the period required by applicable law. We may retain proportionate information needed for unresolved complaints, disputes or legal claims until those matters are resolved and relevant legal retention needs end. We retain limited consent and withdrawal records for as long as needed to demonstrate compliance and honour your choices; they are not used to resume advertising tracking.

Technical logs, support records and advertising measurement records are kept only for as long as needed for their stated purposes, taking account of security, troubleshooting, attribution and legal requirements. We review retention and delete or anonymise information when it is no longer needed. Contact us for information about the retention periods applicable to particular records.

Residual copies in restricted backups may remain until overwritten through the applicable backup cycle. They are not used for ordinary operations, and deletion is reapplied if a backup is restored. Providers acting as independent controllers may retain their own records under their notices and legal obligations.

Cached product information obtained from retailer websites is retained for up to 24 hours and does not contain user personal data. This is separate from your personal size check history.

We may anonymise and aggregate appropriate data before deletion using the safeguards in section 3. Genuinely anonymous data may be retained indefinitely, including after account deletion. This does not extend retention of your identifiable personal data or remove rights that apply before anonymisation.

8. International Transfers
   Our providers, including Supabase, Vercel, RevenueCat and Meta, may process information outside the United Kingdom. Where a transfer of personal data requires safeguards, we use a valid applicable adequacy decision or appropriate contractual safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, with any additional measures required. Where EU GDPR applies, corresponding EU transfer requirements are addressed.

We do not assume that a provider’s privacy policy alone makes an international transfer lawful. Contact us for information about the destinations and safeguards relevant to your data, or a copy of applicable safeguards, subject to necessary redactions.

9. Your Rights & Choices
   Subject to applicable law and relevant conditions, you can request access to your personal data, correction, erasure, restriction of processing and portability of eligible data. You can object to processing based on legitimate interests, including the processing used to create anonymised training datasets while your information remains identifiable. You have an unconditional right to object to use of your personal data for direct marketing. You can withdraw consent at any time where processing relies on it.

You can view and update your Fit Passport and preferences in the app. An app view may not display every record we hold; you can request fuller access or an export by emailing support@vivariety.com. You can request account deletion at the same address. Deleting your account does not itself cancel an Apple or Google subscription; manage cancellation through the relevant app store.

We respond without undue delay and normally within one calendar month, in accordance with applicable law. Where legally permitted, a complex request or multiple requests may require up to two additional months; we will explain the extension within the initial month. We may request proportionate information to verify your identity. Requests are normally free; any lawful refusal or fee will be explained.

If you are concerned, please contact us. You can also complain to the UK Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/ or, where applicable, your local EEA supervisory authority. You do not have to contact us before complaining.

10. Children & Young People
    The Service is not directed at children under 16. We do not knowingly collect their personal data. If you believe a child under 16 has provided information, contact us so we can investigate and delete it as appropriate. Where the Service is used by young people aged 16 or 17, applicable protections for children’s data remain relevant; the under-16 restriction does not remove our obligations to them.

    
    

11. Changes To This Policy
    We may update this policy to reflect changes to the Service, our practices or legal requirements. We publish the revised policy with its effective date and provide an appropriate notice of material changes. Where a change requires new consent, we obtain it before starting that processing. Continued use of the Service does not constitute consent to new or changed optional tracking.

    
    

12. Contact Us
    If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at: support@vivariety.com