Privacy Policy

1. Controller and contact

The controller for LookTrace is magiclabs GmbH (“magiclabs”, “we”, “us”). For privacy requests, email hello@magiclabs.dev. Our full company disclosure, including the legally required address, is in the Imprint.

2. What the app processes

3. Purposes and legal bases

• Provide searches, accounts, cloud sync, saved looks, referrals, and subscription access: performance of our contract with you (GDPR Art. 6(1)(b)).
• Rate limiting, service security, fraud prevention, troubleshooting, and aggregated service performance: our legitimate interests in operating a secure and reliable service (Art. 6(1)(f)).
• Customer support: performance of the contract and our legitimate interest in answering and documenting requests (Art. 6(1)(b) and (f)).
• Tax, accounting, regulatory, and legal claims: compliance with legal obligations and our legitimate interests in establishing or defending claims (Art. 6(1)(c) and (f)).

We do not rely on consent merely because you accept this policy. Where consent is legally required for a new optional use, we will ask separately.

4. Recipients and processors

• Supabase: backend functions, authentication, database, saved-look sync, account deletion, referrals, and request records.
• Lykdat: fashion-specialist visual search using garment crops.
• SerpApi and Google Lens results: visual product and exact-match search using garment crops, depending on search mode and catalog coverage.
• RevenueCat: subscription entitlement and purchase validation.
• Apple: App Store distribution and payments, Sign in with Apple, and device services you choose to use.
• Vercel: delivery and security of this public website, including ordinary request information such as IP address, requested URL, browser/device information, and timestamp.
• Independent merchants: only when you choose to open a merchant link. Their own terms and privacy policies then apply.

We may also disclose information where required by law, to protect rights or security, or in a corporate transaction subject to appropriate safeguards.

5. International transfers

Some providers or their subprocessors may process information outside the European Economic Area, including in the United States. Where required, we use an adequacy decision, the European Commission’s Standard Contractual Clauses, and supplementary measures or another lawful transfer mechanism. You may request information about the applicable safeguards at hello@magiclabs.dev.

Interrupted-search recovery

To recover a completed search if its response is interrupted, we temporarily store its product results and a one-way fingerprint of the search inputs, associated with the verified app installation and optional signed-in account. Retrying the same photo and settings within 24 hours can return those results without charging another search. This cache contains no uploaded photos or garment crops.

6. Retention

• We do not write the complete source photo or garment crops to the LookTrace database. Garment crops are held in memory for the search request and sent to the search providers.
• Search-request records in our database are automatically deleted after 30 days.
• Recovery results are available for 24 hours. An hourly cleanup removes expired results, normally within 25 hours of creation.
• SerpApi states that search data is retained for 31 days unless its ZeroTrace mode applies. Lykdat processes image data under our service arrangement and its applicable policy. Provider logs or backups may follow their own documented deletion cycles.
• Optional account, saved-look, referral, and guest-pass data is kept until you delete the account or request deletion, unless a longer period is required for security, fraud prevention, legal claims, or law.
• RevenueCat purchase records and Apple transaction records are retained under their policies and legal obligations. Deleting your LookTrace account does not by itself delete Apple records or all RevenueCat records.
• Support correspondence is normally kept for up to three years after the end of the calendar year in which the request is resolved, unless law or an active dispute requires longer retention.
• Required tax and accounting records are kept for the statutory retention period.

7. Account deletion

You can delete an optional LookTrace account inside the app. This deletes the Supabase authentication user and cascades deletion to saved looks and referral/guest-pass records tied to that user. It does not automatically remove data held independently by Apple, merchants, or all purchase records held by RevenueCat. To request deletion or de-linking of remaining data under our control, email hello@magiclabs.dev.

8. Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, portability, or objection to processing. Where processing is based on consent, you may withdraw it at any time without affecting earlier processing. You also have the right to complain to a supervisory authority. Our lead local authority is the State Commissioner for Data Protection of Lower Saxony (Die Landesbeauftragte für den Datenschutz Niedersachsen), lfd.niedersachsen.de.

We may need reasonable information to verify your identity. You will not be discriminated against for exercising privacy rights.

9. Security

We use transport encryption, restricted service credentials, row-level database access controls, request-size limits, and data minimization. No system is perfectly secure. Please do not send sensitive images or information that are unnecessary for using the service or getting support.

10. Commercial content and automated decisions

LookTrace does not include third-party advertising SDKs, sell personal data, or use data for cross-app tracking. We may show contextual sponsored placements or use affiliate links. Commercial content will be clearly labeled and will not change the evidence behind a match label. We do not use outfit photos to build advertising profiles.

Search ranking and match labels are automated suggestions, but they do not produce legal or similarly significant effects. You decide whether to visit a merchant or make a purchase.

11. Children

LookTrace is not directed to children under 16. If you believe a child has provided personal data without the authorization required by local law, contact us so we can review and delete it where appropriate.

12. This website

This website does not use an account, advertising pixels, product analytics, or non-essential cookies. Vercel processes ordinary connection data to deliver and protect the static pages. Email links open your chosen mail application; we receive information only if you send a message.

13. Changes

We may update this policy when LookTrace, its providers, or legal requirements change. We will post the revised policy with a new effective date and, where a change materially affects your rights, provide additional notice where appropriate.