Privacy Policy

The controller responsible for the processing of personal data on this website is:

Nikolai Efimov
Winsstraße 59
10405 Berlin, Germany
Email: hello@capsulekit.co

We collect the following categories of personal data in the course of providing our styling service:

• Contact data — name and email address provided during intake or account creation.
• Intake responses — lifestyle, occasion, and style preference answers you provide during the brief. These may include information about physical measurements and body characteristics. We process these solely to deliver the styling service and do not sell or share them with third parties beyond the processors listed in section 04.
• Photographs — client photos uploaded voluntarily for the AI virtual try-on feature. See section 03 for full details.
• Payment metadata — transaction references and payment status. Card details are processed exclusively by Stripe and are never stored on our systems.
• Usage data — presentation views and interaction timestamps, used to detect abuse and improve the service.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) for intake and project data; Art. 6(1)(a) GDPR (consent) for photographs used in AI try-on (see section 03).

As part of the styling service, we offer an optional AI-powered virtual try-on feature. This feature is strictly opt-in and requires your explicit written confirmation before any photo is transmitted.

AI try-on processing: To generate try-on visualisations, your photos are transmitted to FASHN (fashn.ai), a third-party AI image processing provider. Under FASHN's terms of service, uploaded content is not used for AI model training, marketing, or promotional purposes, and any third-party AI subprocessors engaged by FASHN process data transiently, solely to fulfil the generation request. All inputs and outputs submitted via the FASHN API are automatically deleted within 72 hours; only anonymised request logs are retained.

AI wardrobe analysis: When you (or your stylist) upload wardrobe photos, those photos are transmitted to OpenAI (openai.com) to recognise the garments and to generate clean garment images (cut-outs and studio photo preparation). Wardrobe photos can include you or parts of your home. Under OpenAI's API terms, content submitted via the API is not used to train OpenAI's models; API data may be retained for up to 30 days for abuse monitoring and is then deleted.

Result: a synthetic, AI-generated image. The output is a visualisation only and does not represent a guarantee of fit, colour accuracy, or product availability. This feature uses AI-generated content within the meaning of EU AI Act Art. 50.

International transfers: FASHN operates under the laws of England and Wales. Where personal data is processed outside the EU/EEA, transfers rely on an adequacy decision (e.g. for the United Kingdom) or Standard Contractual Clauses pursuant to Art. 46 GDPR.

Legal basis: Art. 6(1)(a) GDPR — your explicit consent, given when you upload your photos for a styling project. You may withdraw consent at any time with effect for the future; this does not affect the lawfulness of prior processing. To withdraw, contact us at the address in section 01.

Deletion: your original photos and all generated images are deleted from our systems within 12 months of project completion, or within 14 days of your request (see section 06).

We use the following processors under Data Processing Agreements:

• Vercel Inc. (USA) — website hosting and serverless functions. Transfers outside the EU/EEA are made under SCCs. Vercel DPA accepted in dashboard.
• Supabase Inc. — database and authentication. Data is hosted in the EU (Frankfurt / AWS eu-central-1). Supabase standard DPA accepted in dashboard.
• FASHN — AI try-on processing. See section 03. All inputs and outputs automatically deleted within 72 hours. No DPA yet in place — a formal DPA request is pending (see pre-first-client checklist). Processing governed by FASHN's terms of service (England and Wales law).
• OpenAI, L.L.C. (USA) — AI photo analysis (wardrobe item recognition) and image processing (garment cut-outs, studio photo preparation). See section 03. API content is not used for model training; API data may be retained up to 30 days for abuse monitoring, then deleted. Transfers outside the EU/EEA are made under SCCs.
• Stripe Inc. (USA) — payment processing. Stripe acts as an independent controller for payment data. Transfers under SCCs. See Stripe's privacy policy at stripe.com/privacy.
• WaveSpeedAI — AI video generation (Higgsfield models). Receives the look image, which may show the client, to animate it into a short runway clip. Used only when a stylist explicitly generates a video. Transfers outside the EU/EEA are made under SCCs. No DPA yet in place — a formal DPA request is pending (see pre-first-client checklist).
• Kaleido AI GmbH (remove.bg) (Austria, EU) — background removal during studio model-photo preparation. Receives the client photo. Used only when a stylist prepares a studio model photo. Processing takes place inside the EU/EEA.
• Resend Inc. (USA) — transactional email delivery (intake confirmations, presentation share links). Transfers outside the EU/EEA are made under SCCs. Resend DPA accepted in dashboard.

We do not use third-party analytics on public-facing pages. No tracking, advertising, or analytics scripts are loaded on this website.

We retain personal data only for as long as necessary for the purpose for which it was collected, or as required by law.

• Intake responses and project data — retained for the duration of the project and a reasonable period thereafter for service quality and legal compliance purposes, then deleted.
• Client photos and generated try-on images — retained for the duration of the active project; deleted within 12 months of project completion, or within 14 days of your request at any time.
• Payment records — retained for 10 years in accordance with § 147 AO (German fiscal retention obligation).
• Account / authentication data — retained until you request account deletion.
• FASHN processing artefacts — automatically deleted by FASHN within 72 hours of processing (see section 03).

Under the GDPR you have the following rights regarding your personal data:

• Access (Art. 15) — obtain a copy of data we hold about you.
• Rectification (Art. 16) — correct inaccurate data.
• Erasure (Art. 17) — request deletion of your data.
• Restriction (Art. 18) — limit how we process your data.
• Portability (Art. 20) — receive your data in a structured, machine-readable format.
• Objection (Art. 21) — object to processing based on legitimate interests.
• Withdrawal of consent (Art. 7(3)) — withdraw consent for photo/AI processing at any time without affecting prior processing.

To exercise any of these rights, contact us at hello@capsulekit.co. We will respond within one month (Art. 12(3) GDPR).

You also have the right to lodge a complaint with the competent supervisory authority. For Berlin: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Friedrichstr. 219, 10969 Berlin (datenschutz-berlin.de).

This website uses only technically necessary cookies — session tokens required for authenticated areas of the service. No tracking, advertising, or analytics cookies are set on any page. No cookie consent banner is displayed.

If third-party analytics are added in the future, this section and the consent mechanism will be updated before activation.