How Vestly handles photos, purchases, app usage and support requests.

1. Who we are

Vestly is operated by Vision Publishing LLC, 2105 Vista Oeste NW Suite E #3990, Albuquerque, NM 87120, USA. You can contact us at contact@hellovestly.com or at +1 (505) 278-9455.

2. What the app does

Vestly is a wardrobe and virtual try-on app for iPhone and Android phones. It lets you add reference photos, import clothes, analyze items, import photos from a shared link, generate AI-assisted outfit visuals and track prices for products you voluntarily add to your shopping list.

3. Data we may process

• The reference, base and clothing photos you choose to import.
• Descriptions, categories and other clothing information derived from these images.
• Generated images and outfit history, stored primarily on your device.
• Optional profile information you provide, such as your first name, age, height and weight.
• Apple or Google Play purchase IDs and statuses needed to activate and restore a subscription.
• A pseudonymous internal identifier, access tokens, usage counters, quota decisions and technical signals used to prevent abuse.
• Usage and diagnostic events from our first-party analytics, enabled by default and can be turned off anytime in the app.
• The contents of a support request, including your email address, message and optional attachments.
• The contents of feedback sent from the app (“Send feedback”): its subject, your message, an optional voice message and its transcript, optional screenshots, an optional email address, and the app and system versions and device family (phone or tablet).
• Product links you share or save, as well as the merchant, title, public images, availability, price, target price and price history needed for the shopping list.

3 bis. Optional account and backup

In versions that offer a Vestly account, you can use your email address with a sign-in code or choose Google (and Apple on iOS when that option is available). An account is optional. Signing in with Google shares your Google service-specific identifier and verified email address with Vestly; we don’t receive your password or request access to Gmail, Google Drive, or your contacts. The provider handles sign-in under its own privacy policy. This data is used to authenticate your account, secure your session, and retrieve its associated access rights; it isn’t used for ad targeting.

Remote backup is separate from signing in and requires your consent in the app. If you turn it on, your wardrobe data and associated images, looks, profiles, and other items supported by the app version are sent to our servers so you can access them on your devices. Backup copies stay on our infrastructure as long as you keep this backup; they aren’t subject to the short retention period for AI working copies described below. Your wardrobe data isn’t sent to Google or Apple for this backup. Data transfers use HTTPS, and access is limited to your authenticated account.

You can manage backup, sign out, or request deletion of your account and its data in the app. To make a request without the app, use the help page or email contact@hellovestly.com. Limited information needed for security, purchases, or legal obligations is retained for the periods described in this policy. Deleting your account doesn’t cancel an Apple or Google Play subscription; you still need to cancel it through the store. Signing in or verifying an email address alone doesn’t trigger any payment or automatically grant a subscription.

Store links and automatic retries.

To diagnose failures and repair store access, we keep the submitted link (with login and tracking parameters removed), country, timestamps, reading steps and their outcome for up to thirty days. This private history is linked to your internal Vestly identifier. It is not used for advertising and is erased when your account is deleted.

When an image request has to wait for a store to be repaired, compatible app versions save the request and the necessary photos on our servers, with your consent to AI processing. Creation can then continue even if you close the app. Working copies are deleted when the request finishes, when you cancel it, or after thirty days at the latest. Created images remain in the retry queue until you retrieve them, for up to thirty days; results added to your account backup then follow the rules in section 3 bis. You can cancel a request in the app or delete your account and its data.

Store pages opened in the app.

Starting with version 1.9.5, a store link opens in Vestly’s in-app browser. The merchant’s site then receives a visit from your device, just as with an ordinary browser: your network address, technical browser information and the cookies it sets, under its own privacy policy. These cookies stay in the app and are deleted when you delete your data or your account in the app.

To create your inspirations or a try-on, the app sends our servers a copy of the page displayed: its content, its address and the thumbnails of the visible items. We use it only to read the items, their prices and their public photos. If you are signed in on that site, the page may contain information the site displays, such as your first name; we do not use it. This copy is used only within fifteen minutes of being read: it is kept in memory or, for a saved request, in a private file, then deleted, at the latest when the request ends. It is never added to the shared store database or to our logs, and it is not used for advertising.

4. AI photo processing

An AI feature runs only when you request it and after you give your consent in the app. Depending on the feature, the request may include reference, base, or clothing photos, item descriptions, and certain useful profile information you’ve provided. It passes through Vestly’s secure proxy to Vestly AI; neither the iOS app nor the Android app contacts our artificial intelligence provider directly.

Working copies of photos are temporary and are deleted from our worker when processing is complete. The result may remain available for a short technical window so the app can retrieve it, then it’s automatically deleted. Transient technical logs that don’t intentionally contain images may be kept for security and diagnostics. Processing by our artificial intelligence provider is also subject to its operational measures and applicable obligations.

Vestly’s AI relies on a single specialized AI provider for image generation (try-ons, inspiration, catalog images on a white background) and analysis of your photos (clothing, try-ons, body shape). No backup provider is used: if this provider is temporarily unavailable, your request isn’t passed to any other provider, and you can try again later. This provider may process data outside the European Union and apply its own technical retention periods; Vestly shares only what’s needed to fulfill your request.

Fill your wardrobe from your photos. If you use this feature, Vestly scans your photo library on your iPhone to find photos of someone posing in an outfit; nothing is sent during this scan. Only the photos you choose afterward, after giving separate consent, are sent: they’re first cropped around the person and the face is blurred on your device, and a photo won’t be sent if the blur can’t be guaranteed. The service identifies the clothing being worn (name, category, color, and position in the photo); items you keep are then prepared on a white background, like your other clothes. The rest of your photo library never leaves your iPhone. If you choose photos while exploring the app, only their IDs are stored on your device for up to 30 days.

On Android, Vestly doesn’t scan your photo library: you choose photos yourself in Android’s photo picker, and only those photos are checked on your phone to find ones of someone posing in an outfit; the rest of your library is never accessed. The next steps are the same: separate consent, cropping and face blurring on your phone, then sending only the photos you approve. This scan is performed by an image analysis module that runs on your phone: neither the photos nor the analysis results are sent to its publisher (see section 11). If you choose photos while exploring the app, only their IDs and permission to access those specific photos again are stored on your phone for up to 30 days.

Automatic creation of your Vestly profile. The first time you open the app, you can choose photos from your library. Your phone detects faces in them and asks which one is yours: this comparison stays on your device and is never stored. With your permission, photos you appear in are cropped around you; other people are removed or blurred. The photos are then securely sent to Vestly’s AI, which creates your profile photos, identifies your clothes (with faces blurred), prepares them on a white background, and puts together your first try-ons. The photos are deleted from our servers after processing; the results stay on your device.

Face scan. In app versions that offer it, you can scan your face with the front camera, while your Vestly is being created and then at any time from your Profile. The app analyzes the image live, on your phone, to guide you (distance, light, head angle) and takes three photos: straight on, then each side. No video is recorded or sent. These three photos become your “Face” profile photos. Your phone also compares the scanned face with your photos to find you in them: this comparison stays on your device and is never stored. With your consent, the three photos are sent securely to Vestly’s AI, which checks that they are usable (glasses, headwear, blur, lighting) and then uses them, like your other profile photos, to create your full-body photos and your try-ons. The photos are deleted from our servers after processing; they stay on your device until you delete them.

5. How we use data

• Provide the wardrobe analyses and visuals you request.
• Verify your subscription, restore purchases, and maintain access.
• Apply generous quotas, allocate capacity, and prevent automated or abusive use.
• Understand how the product is used, diagnose errors, and improve reliability when analytics is enabled.
• Respond to support requests, meet our obligations, and protect the service.
• Review your feedback, fix reported issues, and improve Vestly; voice messages are transcribed automatically so the team can read them.
• Read the product page you provide, display its images, and check its price daily to detect a requested price drop.

6. Storage and retention

Photos, generated images, and wardrobe content are stored primarily on your device. AI processing data is retained on the server only for as long as needed to process your request and retrieve the result, subject to temporary technical backups and applicable requirements.

On Android, Vestly data is not included in your phone’s Google backup; the optional Vestly backup described in section 3 bis is a separate service that lets you retrieve supported data on another device.

Feedback sent from the app (message, voice message, transcript, screenshots, and optional email) is kept for up to twelve months, then deleted. Feedback from an account deleted in the app is automatically erased within the following hour. You can also request deletion of feedback by writing to us.

Access, purchase, quota, security, and analytics data are retained for as long as reasonably necessary for the purposes described here. Certain limited records of purchases, fraud, refunds, or deletion may be kept longer when required by law, security, or the defense of legal rights.

Shopping list products and their price history are kept as long as you keep them on the list or until your data is deleted. Older observations are automatically time-limited. Links placed in the iOS share sheet or sent to Vestly from Android’s share menu (“Add to Vestly”) are used only to open the import in Vestly and are removed after processing.

7. Apple and Google Play subscriptions and purchases

Purchases and payments are handled natively by Apple using StoreKit 2. Vestly receives and verifies signed Apple transactions and notifications on the server to determine the product, expiration, renewal, refund, or billing issue. We also process a pseudonymous account token and the transaction identifiers needed to link, restore, and protect your access rights. We do not receive your full credit card details.

On Android, purchases and payments are handled by Google Play using Google Play’s billing system (Google Play Billing). When you make a purchase, the app links the transaction to your installation’s pseudonymous identifier, then sends our server the purchase token provided by Google Play. The server verifies this token directly with Google and receives real-time Google Play notifications to determine the product, trial, expiration, renewal, suspension, refund, or billing issue, then confirms the purchase with Google. We retain the purchase token, subscription status and dates, price, currency and billing country, a hash of the order number (not the number itself), and the link between the subscription and your installation. A purchase that has not been presented by any installation is deleted after 30 days, along with Google notifications. We do not receive your payment method details. Optional Google sign-in is separate from Google Play payments and shares your email address as described in section 3 bis.

On both iPhone and Android, verified purchase events (trial start, purchase, renewal, cancellation, refund, expiration), along with the product, price, currency, and country, also feed our internal sales analytics, linked to your pseudonymous ID. Separate, optional advertising data sharing is described in section 9; internal records are deleted along with your data.

8. First-party analytics

Vestly uses its own analytics, hosted on our backend infrastructure and viewed in the private Gabriel dashboard. It may receive a random pseudonymous ID, the screens and actions used, operation status, durations, errors, non-financial subscription information, as well as the app version, general technical information about the device and its operating system (iOS or Android), and the language, region and time zone set on the device. The country in our statistics comes from this region, never from your IP address. Photos and their contents are not sent in analytics events.

Analytics is enabled by default. You can turn it off at any time in the app under Profile, in “Privacy and Data,” using the “Audience Measurement” setting. This choice stops future client events and clears the local analytics queue. The data deletion process also lets you request deletion of server-side records linked to your internal ID, subject to the limited information we must retain for security or legal obligations.

9. Meta ad measurement, only with your consent

Versions that offer this choice include the Meta SDK to measure and improve Vestly ads on Facebook and Instagram. This feature is optional and stays off until you consent in the app. On iPhone, it also requires permission to track from iOS (App Tracking Transparency). Refusing does not limit Vestly’s features. Earlier versions that do not offer this choice do not include this tracking.

With your consent, Meta receives an advertising ID from your device, a pseudonymous ID specific to the SDK, technical information about the app and device, as well as the installation, app opens, and certain discovery steps: presentation completed, first successful use, offer viewed, and purchase started. Our server also sends trial starts and verified subscriptions or purchases, with their date and, for a paid purchase, the amount and currency. Renewals may be sent as long as the recorded consent remains valid. A free trial is not reported as revenue.

Our advertising events do not include photos, wardrobe contents, profile information or measurements, email addresses, text you enter, or details about shop pages. We do not send Meta store transaction IDs, login tokens, or anti-abuse fingerprints. The SDK makes technical connections to Meta, which may process the network address needed for these exchanges. Meta may match IDs and events with its own data to attribute results to ads. See the Meta Privacy Policy, including information about international transfers, retention periods, and your rights with Meta.

You can withdraw your consent under Profile → Privacy and Data → Meta Ad Measurement. On iPhone, iOS tracking settings also apply. Withdrawing consent stops new advertising events from the app; once our server receives the withdrawal, it deletes events that are still pending. A transmission that has already been sent cannot be recalled. If your device is offline, the withdrawal is sent the next time the app connects.

Your choice is stored on your device, separately from internal audience measurement and wardrobe backup. On our server, attribution context expires after 180 days without confirmation from the app; unsent events expire after seven days, and deduplication records after 180 days. The content of a sent event is removed from our queue. Deleting your data erases the attribution context and queues linked to you. To exercise your rights, use the contact details in the section about your rights and, for data processed by Meta, its privacy tools.

When you import or follow a product link, the page is read in the app’s in-app browser (version 1.9.5 and later) or accessed by our server when this feature requires it; your store links and pages are not sent in advertising events.

10. Quotas, security, and abuse prevention

To protect service availability, we process your internal identifier, access status, request dates and volumes, operation type and result, and certain network or technical signals. This data is used to enforce trial limits, generation and analysis counters, concurrency limits, gradual slowdowns, and abuse detection. It is not used for ad targeting. Communications between the app, on both iPhone and Android, and our servers are encrypted (HTTPS).

Previously granted seven-day access and abuse prevention

Seven-day access granted by versions before 1.9.6 remains available until it expires, with no purchase or automatic charge. No new seven-day access is granted. New subscriptions may qualify for the three-day App Store or Google Play free trial, depending on the eligibility shown by the store. To check this limit, the app sends a technical key unique to the device: on Android, a fingerprint of its Android identifier; on iPhone, a random identifier stored in the keychain. Our server stores only a fingerprint protected with a secret key, along with the access start and end dates. This information is used to provide access and prevent abuse, never for advertising. A limited technical record of access already granted may be retained after your data is deleted so reinstalling the app does not restart the seven-day period.

In versions before 1.9.6 that support it, a device check also protects the free trial from abuse: when you request the seven free days, the app sends a verification token provided by the device’s system. Our servers have it checked by Apple (DeviceCheck), which keeps a “trial already granted” indication for this device, or by Google (Play Integrity), which confirms that the app comes from Google Play and that the device is certified. We don’t store this token; on iPhone, only a fingerprint of it is kept for seven days so it can be used only once. We also keep daily counts of these checks, without any identifier, for 60 days. No advertising data is used.

Error and crash reports

To fix crashes, freezes, and errors, the app sends technical reports: Vestly version, device model, system version, error type, technical steps, and cleaned logs. They contain no photos, email addresses, entered text, or store page content. They are kept for 90 days. If audience measurement is disabled, these reports remain anonymous; otherwise, they may be linked to a fingerprint of your internal identifier. Deleting your account erases the reports linked to it.

11. Sharing and service providers

We limit sharing to the parties needed to operate Vestly:

• Apple, for StoreKit, payments, subscriptions, and restoring purchases.
• Google, for Google Play: payments, subscriptions, and restoring purchases on Android.
• The publisher of the image analysis module used on Android to fill your wardrobe from your photos: the module runs on your phone and does not send your photos or results, but it sends its publisher technical usage data (device, app, installation-specific identifiers, configuration, performance, and errors) for diagnostics and usage measurement.
• The artificial intelligence provider that powers Vestly AI through our servers for requested AI processing; no backup provider is used.
• An automatic transcription provider for the voice message attached to a review (only the recording is shared with it, without your name, email, or screenshots).
• Our hosting, security, email, and support providers, as needed to perform their functions.
• The merchant site of the link you chose: it receives a visit from your device when you open its page in Vestly and, when needed, a technical request from our server to read the public page, without personal photos or Vestly identifiers.
• Authorities or legal counsel when required by law or to protect rights and safety.

We do not sell your personal data.

12. Your choices and data deletion

• You can refuse or withdraw AI consent before future processing.
• Analytics is enabled by default; you can turn it off anytime in the app.
• A voice message is recorded only after you agree and take an explicit action; you can also write to us without using your microphone or taking a screenshot.
• You can delete your local data and request deletion of the associated server-side data in the app, or by email without the app (see the page Help).
• You can remove each item separately from the shopping list; deleting your data also removes the associated items, prices, and alerts.
• You can manage or cancel your subscription in Apple subscription settings or, on Android, in the Play Store (Payments and subscriptions).
• You can contact us to exercise your applicable rights to access, correct, or delete your data.

Deleting your Vestly data does not cancel your Apple subscription or delete records Apple keeps under its own responsibility. Cancel your subscription with Apple separately if you no longer want to be charged. Similarly, deletion does not cancel a Google Play subscription or delete records Google keeps under its own responsibility: cancel it in the Play Store.

13. Children

Vestly is not intended for children under 13, and we do not knowingly seek to collect personal data from children under 13.

14. Changes

We may update this policy as the service or applicable rules change. The date above indicates the version currently in effect.

15. Contact

Email: contact@hellovestly.com
Phone: +1 (505) 278-9455
Mailing address: Vision Publishing LLC, 2105 Vista Oeste NW Suite E #3990, Albuquerque, NM 87120, USA