← Abbina

Abbina - Privacy Policy

Policy version: 2026-07-22

Who we are

Abbina is an AI personal stylist app. You share one photo of yourself, the app turns it into a written style profile, and you chat with an AI stylist about what suits you. Optionally, you can photograph your own wardrobe items to get outfit ideas from clothes you already own.

The data controller (the person responsible for your data) is:

Pelyhe, Aron (independent developer, Hungary)
Registered postal address: available on request via the privacy contact below.
Privacy contact: contact

For any privacy question, or to exercise any of your rights, email the address above. We reply within one month, as GDPR requires.

The short version

• Your photo is analyzed once to describe your coloring, build, and style in text. To do that, it is sent to our AI provider, Anthropic, and then discarded. We never store your photo on our servers.
• Your style profile, chat history, and wardrobe live only on your own device.
• On our servers we keep only an anonymous account (a random ID, no name, no email) and a daily usage count, so everyone gets a fair share of the free AI features.
• No advertising, no analytics trackers, no selling of data. Ever.

Everything we process, in detail

1. Your photo (selfie)

• What happens: when you agree and take or choose a photo, the app shrinks it and sends it over an encrypted connection to our backend, which passes it to Anthropic's vision AI. The AI returns a text description: your coloring, build, colors and style directions that suit you. Our backend then discards the image. The original photo and the text profile stay on your device.
• What this can reveal: a description of skin undertone, hair, and eye color is the kind of information that data-protection law treats as sensitive, because appearance can indicate things like ethnic origin. We treat your selfie as special-category data under GDPR Article 9 and only process it with your explicit consent, which we ask for before the camera ever opens.
• Lawful basis: your explicit consent (Article 6(1)(a) and Article 9(2)(a)). You can decline, and withdraw at any time; the only effect is that the photo-based features will not work.
• Retention: zero on our servers (processed in memory and discarded). Anthropic retains API inputs only for a limited period (currently around 30 days) under our data processing agreement and does not use them to train its models.

2. Wardrobe photos (optional)

• What happens: same path as the selfie: sent once to Anthropic, described as text ("navy wool blazer..."), then discarded. The photo and description stay on your device.
• Please photograph only clothes, not people. Wardrobe analysis is meant for garments.
• Lawful basis: your consent (Article 6(1)(a)), asked separately from the selfie consent. It is optional; you can skip it and still use Abbina.
• Retention: zero on our servers; Anthropic as above.

3. Chat with the stylist

• What happens: your chat messages, together with your text style profile and wardrobe descriptions (never the photos), are sent to Anthropic to generate each reply. Your chat history is saved only on your device.
• A request: please do not share health information or other sensitive personal details in chat; the stylist does not need them.
• Lawful basis: performance of the service you are asking for (Article 6(1)(b)).
• Retention: zero on our servers; on your device until you clear it; Anthropic as above.

4. Your anonymous account

• What it is: on first use we create an anonymous account with our backend provider, Supabase: a random identifier (UUID) and timestamps. No name, no email, no phone number. You can see your account ID in the app (You screen) in case you ever want to quote it in a request to us.
• IP address: Supabase's authentication and rate-limiting layer processes your IP address to keep the service secure. We do not store your IP in our own database.
• Lawful basis: the account is necessary to provide the service (Article 6(1)(b)); IP processing for security is our legitimate interest (Article 6(1)(f)).
• Retention: the account is deleted after 12 months of inactivity, or immediately when you use "Delete my account and data".

5. Daily usage counts

• What it is: one row per day recording how many times your anonymous account used each AI feature. Nothing else: no photos, no profile, no chat content.
• Why: to enforce the daily fair-use limits that keep the app free and prevent abuse.
• Lawful basis: our legitimate interest in preventing abuse and controlling costs (Article 6(1)(f)). You may object (see your rights); note that without limits the service cannot run, so objecting in practice means not using the AI features.
• Retention: 90 days, then deleted automatically.

6. Your consent records

• What it is: a record of what you consented to, which policy version, and when (and any withdrawal). Kept on your device and in our database against your anonymous account ID.
• Lawful basis: our legal obligation to be able to demonstrate your consent (Article 6(1)(c), GDPR Article 7).
• Retention: for as long as your account exists; deleted with the account.

7. What we do NOT collect

No advertising SDKs, no analytics or tracking SDKs, no location, no contacts, no name, no email, no phone number, no payment data. This list is verified against the app's actual code and dependencies for every release.

Who else touches your data (our processors)

Anthropic, PBC (Claude API)

• Role: AI analysis and chat, on our instructions.
• What they receive: the photo (once, then discarded), digested style text, chat text.
• Where: United States.
• Safeguard: EU Standard Contractual Clauses in our data processing agreement; no training on your data.

Supabase, Inc.

• Role: backend hosting: anonymous accounts, database, functions.
• What they receive: anonymous account ID, IP address (auth/rate limiting), daily usage counts, consent records.
• Where: database hosted in the European Union.
• Safeguard: data processing agreement with EU Standard Contractual Clauses covering any US access.

We have data processing agreements with both providers. Neither is permitted to use your data for their own purposes. If we ever add or change a processor, we will update this policy and, where your consent covered the processing, ask again.

Outfit "shop" links may open third-party retailer sites in your browser; those sites have their own privacy policies and are outside our control.

Your rights

Under GDPR you have the right to:

• Access your data (Article 15) and get a copy (portability, Article 20). Most of your data is already visible in the app and stored on your device; you can request a copy of your server-side records by email.
• Erase your data (Article 17). In the app: "Start over" clears your profile and chat; wardrobe items can be deleted individually; "Delete my account and data" deletes everything local AND your server-side account, usage counts, and consent records, immediately and permanently.
• Withdraw consent at any time (Article 7(3)), without affecting past processing. Withdrawing selfie or wardrobe consent stops any further photo analysis; the withdrawal path in the app is the same "Delete my account and data" action, or contact us.
• Rectify inaccurate data (Article 16): your profile text can be regenerated from a new photo, and on-device data is under your control.
• Object to processing based on legitimate interest (Article 21), and ask for restriction (Article 18): contact us.
• Not be subject to solely automated decisions with legal or similarly significant effects (Article 22): Abbina makes none; style suggestions are recommendations you are free to ignore, with no legal or similar effect.

How to exercise them: use the in-app actions above, or email the privacy contact at the top of this page. Because your account is anonymous, please quote your account ID (shown on the You screen) so we can find your records; without it we may genuinely be unable to locate them, which we are obliged to tell you under Article 11.

Complaints: you can complain to the Hungarian data protection authority, which is our lead supervisory authority: NAIH (Nemzeti Adatvedelmi es Informacioszabadsag Hatosag), naih.hu, or to the data protection authority of your own EU country.

Children

Abbina is not directed at children. You must be at least 16 to use the photo features. We do not knowingly process children's data; if you believe a child has used the app, contact us and we will delete the data.

Security

Photos and all traffic travel over encrypted connections (TLS). Photos are processed in memory and never written to our storage. Server-side data is minimal by design: if our entire database leaked, it would contain random IDs, daily counts, and consent timestamps, not your photos, profile, or chats.

Changes to this policy

If we make material changes, especially any change to what happens with photos, we will update the version date above and ask for your consent again in the app before the changed processing happens.

Policy version 2026-07-22. Previous versions available on request.