Privacy Policy

This policy applies to XRAYED websites, apps, public pages, account features, publishing flows, feedback forms, and related services. It does not apply to third-party websites, social platforms, identity providers, or services that XRAYED does not control.

VONDOU SRL is the data controller for personal data processed through XRAYED unless a specific feature or provider notice says otherwise.

• Account and profile data, such as identifiers, contact details, usernames, display names, authentication state, and account settings. If you sign in with Apple or Google, this includes what they give XRAYED: your name, your email address or Apple's private relay address, and their identifier for your account. Your name is not shown on your profile. For Apple, XRAYED also keeps an authorization so it can end that access when you delete your account.
• Purchase and subscription data, such as membership status, entitlement state, purchase history, store transaction identifiers, and billing product identifiers. Payment is handled by Apple and Google; XRAYED never receives your full payment card details.
• Profile preference data, such as gender presentation and style-quiz answers, used to personalize feeds and product features.
• Home city and timezone data, such as a city you choose, its approximate coordinates, and your device timezone, used for daily outfit features and local weather context, and to reset your daily limits at your local midnight.
• Content and media data, such as images, image links, captions, public publications, generated text, generated images, video clips and the voice or sound recorded with them, public profile content, and related metadata.
• Live Mirror camera video, processed in real time while you record a take, and the photo or look you chose to try on.
• Messages and comments, such as the text, photos, and reactions you send in chats with your stylist, in private and group chats with other members, and in comments under publications.
• Search data, such as what you type in Search. Searches that match nothing are kept as counts, without your account, for up to 180 days.
• Hearts data, such as the hearts you earn from likes on what you publish and which profile's like earned each one (kept even if that like is later removed), your hearts balance, and each gift card you ask for: the card, its value and brand, the country you chose, the hearts spent, its status, the card link, and the email address you confirm for a card sent by email.
• Private product data, such as private uploads, private generated assets, saved preferences, private analysis, and account-scoped product history.
• AI and content-processing data, such as AI inputs and outputs, moderation signals, quality signals, usage information, diagnostic information, and security data needed to provide AI-assisted features.
• Usage, device, diagnostic, and security data, such as browser or device signals, request information, logs, error data, abuse-prevention data, and cookies or similar browser data.
• Feedback and support data, such as messages, contact details, request context, and information needed to respond to a request.

Public Content can be viewed by other people, including logged-out visitors. It may be indexed, shared, copied, exported, reposted, screenshotted, or used in marketing as described in the Terms.

XRAYED's current in-app marketing featuring opt-in is narrower than that background license: it covers opted-in public publications, public Mirrors, including published Live Mirror videos and their sound, and @handle on XRAYED-owned organic Instagram and TikTok only. Private saved publications, private Mirrors, and other non-public account information are excluded; the current program is never paid ads and never sold.

Wardrobe item cards, including pieces you own and save, are public profile content. Private source looks, source photos, and private analyses remain private. Deleting a private source does not necessarily delete a valid public Wardrobe item derived from it.

A photo you use to try clothes on stays private. It is deleted when the last Mirror or Remix made from it is deleted, or with your account. While a result made from it is published, XRAYED keeps using the photo internally so other members can try the same clothes on. They never see the photo, and a service provider receives only a clothes-only picture made from it or the photo with the face removed.

Profile avatars generated from a selected private photo are public profile content by default after the in-product disclosure. The selected source photo remains private. Unpublishing hides but retains the avatar. Regenerating retires the prior avatar for asynchronous cleanup; changing the source photo does not remove the current avatar.

A Live Mirror you keep is private until you publish it. A published Live Mirror, with its video, sound, your handle, caption, and look credits, is Public Content: anyone can view it on its link page, including logged-out visitors, and other people can like it, save it, comment on it, and try its look on. A file you share from it carries your handle.

Comments under a public publication are public. Chat messages are visible only to the members of that chat.

Your hearts, your gift card requests, and your card links are private to your account.

Private Content is not intended to be public unless XRAYED provides an explicit publish action and the user uses that action. XRAYED still processes Private Content as needed to provide, secure, support, and improve the service.

• To provide, operate, secure, troubleshoot, and improve XRAYED.
• To manage accounts, authentication, access, settings, and user-requested actions.
• To accept content, process images, generate outputs, create publications, display public pages, and support private product features.
• To operate AI-assisted, image-processing, moderation, personalization, and quality-control features.
• To meter usage, enforce limits, prevent abuse, detect suspicious activity, and maintain service reliability.
• To respond to feedback, support requests, rights-holder requests, takedowns, legal requests, and security reports.
• To promote XRAYED using Public Content where the Terms and applicable law allow it.
• To comply with legal obligations, enforce agreements, resolve disputes, and protect XRAYED, users, providers, and the public.

XRAYED may process images, text, generated outputs, and related context through AI-assisted systems and service providers to provide product features, moderation, personalization, quality control, safety, troubleshooting, and service improvement.

Text you submit may be screened by a hosted third-party moderation provider at the moment you send it, to check it against our content rules.

Live Mirror sends your camera video directly from your device to a real-time video AI provider for a take of a few seconds, together with the reference image of the look and a description of the clothes, and without an account identifier. Sound is recorded on your device and is not sent to that provider.

Messages you send to your stylist are processed by AI service providers to write the reply.

What you type in Search is processed, including by an AI service provider, to return results.

Public captions, comments, and other public text may be translated automatically into other languages by an AI service provider and shown to readers in their language. For captions and comments, the original is one tap away.

On the website, you can try Live Mirror without an account. It uses your camera and microphone, the video is processed by the real-time video AI provider, and the resulting clip is kept privately for 24 hours, for that browser only. A browser credential and a bot check limit this to one try a day.

AI outputs may be inaccurate, incomplete, unexpected, biased, delayed, or unavailable. Provider behavior, retention, output, and security may vary by provider, configuration, and applicable terms.

XRAYED may use analytics and diagnostic services to understand product use, measure errors, diagnose performance, improve reliability, and understand whether features work as intended.

XRAYED may collect or share limited events, logs, error reports, diagnostic information, and performance data where needed to operate and troubleshoot the service.

XRAYED offers optional paid features, such as the XRAYED membership and Mirror packs. Purchases are made through the Apple App Store or Google Play and billed to your store account. Apple and Google process the payment; XRAYED never receives your full payment card details.

XRAYED uses a billing provider to validate purchases and keep membership state accurate. The billing provider receives an account identifier, store purchase receipts, transaction and subscription state, and app and device metadata. XRAYED stores your entitlement status and purchase receipt records to grant access, prevent abuse, and support billing questions.

Canceling a membership happens in your Apple App Store or Google Play subscription settings. Account deletion does not cancel an active membership.

• Publicly, when you publish Public Content.
• With service providers and other third-party providers that help provide, protect, maintain, analyze, support, improve, or distribute XRAYED.
• With billing and purchase providers and with the app stores, to process in-app purchases and subscriptions; and with a weather provider, which receives home-city coordinates without account identifiers to provide local weather context.
• With providers that process content, AI inputs and outputs, technical data, communications, analytics, security events, or support requests on XRAYED's behalf.
• With a real-time video AI provider, which receives your camera video during a Live Mirror take.
• When you ask for a gift card with hearts: the brand of the gift card you choose receives the delivery email, the value, and the country when the card is sent by email, and a gift-card service receives an order reference, the brand, the value, and the currency, but nothing that identifies your account. Opening a card takes you to that service's own page, under its own terms.
• With social platforms, marketing channels, press, app stores, or distribution partners when XRAYED uses Public Content for lawful promotion.
• With law enforcement, regulators, courts, rights holders, affected users, or security partners when required by law or reasonably needed to protect rights, safety, or the service.
• In connection with a merger, acquisition, financing, reorganization, asset sale, bankruptcy, or similar business transaction.

XRAYED does not currently sell personal information in the ordinary meaning of that phrase. XRAYED also does not currently use analytics data for cross-context behavioral advertising. If XRAYED later uses personal information in a way that applicable privacy law defines as a sale, share, or targeted advertising use, XRAYED will provide any required notices and controls.

XRAYED keeps data for as long as needed to provide the service, maintain public publications, support private user features, comply with legal obligations, resolve disputes, enforce agreements, secure the service, and maintain backups.

• Public publications remain public until deleted, hidden, archived, removed, or otherwise changed by an available product or operator path.
• Private Content is retained while the account or relevant product state exists, unless deleted through available product paths or support workflows.
• Live Mirrors you keep stay until you delete them or your account.
• Hearts do not expire. A gift card that was ordered or delivered is kept as a spending record.
• Account, authentication, legal-acceptance, support, and request records are normally retained while the account exists and then for as long as reasonably needed for security, abuse prevention, dispute resolution, accounting, legal compliance, and audit needs.
• Usage, operational, diagnostic, limit, and security records are normally retained for up to 24 months unless XRAYED reasonably needs them longer for abuse prevention, security review, legal compliance, accounting, audit, or service-integrity reasons.
• Deleted data may remain in backups, logs, caches, distributed copies, provider systems, or legal/security archives until those systems expire or are overwritten under their normal retention cycles.
• XRAYED may shorten or lengthen these defaults when required by law, user request, product deletion behavior, security needs, provider constraints, or a documented business need.

Signed-in users may delete owned publications where the product provides a delete action. Signed-in users may also delete certain private product data where the product provides those actions.

You can delete a Live Mirror, delete your own comments, and unsend your own chat messages in the app. What account deletion does to hearts and gift cards is described on the Account Deletion page.

Account deletion is handled through XRAYED's account lifecycle path and may remove or de-identify account data, authored content, private product data, feedback linked to the account, and user-scoped usage records where required or reasonably feasible. Some records may survive where retention is needed for legal, security, integrity, accounting, backup, abuse-prevention, or third-party dependency reasons.

Account deletion does not cancel an active membership; manage or cancel subscriptions in your Apple App Store or Google Play subscription settings. XRAYED de-identifies its purchase records when an account is deleted. Apple, Google, and XRAYED's billing provider retain their own transaction records under their own policies.

To request account deletion, use the Account Deletion page. For privacy assistance, contact support@xrayed.co from the email associated with your account.

XRAYED uses reasonable safeguards designed to protect data, including access controls, private handling for non-public content, limited public data exposure, abuse-prevention controls, operational monitoring, provider security expectations, and deletion or retention workflows. No safeguard can guarantee absolute security.

If XRAYED identifies a breach or provider incident that requires notice, XRAYED will investigate and notify affected people, regulators, providers, or other parties as required by applicable law.

XRAYED and its providers may process data in the United States, the European Economic Area, and other countries. Data protection laws may differ from the laws where you live. Where required, XRAYED relies on appropriate transfer mechanisms, provider terms, data-processing terms, or other lawful bases.

Where privacy law requires a legal basis, XRAYED may process data because it is needed to provide the service, because XRAYED has a legitimate interest in operating, securing, improving, and promoting the service, because you consented, because processing is needed for legal obligations, or because processing is needed to protect rights, safety, and the public.

Depending on where you live, you may have rights to access, correct, delete, export, restrict, or object to certain processing of your personal information. You may also have rights to withdraw consent, appeal a privacy decision, or complain to a regulator, including the Belgian Data Protection Authority where applicable.

XRAYED will not discriminate against users for exercising privacy rights where applicable law prohibits discrimination. To make a request, contact support@xrayed.co. XRAYED may need to verify your identity before responding.

XRAYED is not intended for children under 13. XRAYED does not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information to XRAYED, contact support@xrayed.co.

XRAYED may update this Privacy Policy from time to time. The updated date shows when it was last revised. Continued use of XRAYED after an update means the updated policy applies to your use of the service.

Contact XRAYED at support@xrayed.co. XRAYED is operated by VONDOU SRL, Rue Baron de Castro 37, 1040 Brussels, Belgium. Enterprise / VAT number: BE 0758.768.048.