Privacy Policy

Who we are

DRIPT is a product made by Ixalabs ("we", "us"), a sole proprietorship registered in the Netherlands. This Privacy Policy explains what we collect when you use the DRIPT mobile app, why we collect it, and what we do with it.

For privacy questions, write to [email protected].

What we collect

We try to collect as little as possible. Here's the list:

• Account info: email address (when you sign in with Apple, Google, or email), and a unique user ID generated by our authentication provider.
• Outfit photos you submit: the images you scan to get a rating.
• Scan history and AI-generated insights: the ratings, archetype tags, Style DNA signals, and feedback our AI returned for you.
• Subscription status:whether you're on Free, Pro Weekly, or Pro Yearly. Payment itself runs through Apple or Google — we never see your card details, only an anonymous purchase token from RevenueCat (our subscription provider).
• Device and usage info: app version, OS version, device language and region, crash reports, and basic interaction analytics so we can fix bugs and improve the experience.
• Notification permissions:whether you've enabled push notifications (we never read other notification content).
• Local app data: scan history and language preference are also stored on your device for offline access.

We do not collect: precise location, contacts, microphone audio, your camera roll beyond the photo you choose to scan, or any biometric data.

What we do with your photos

This is the part everyone cares about, so we'll be specific.

• Your photo is sent to OpenAI (our AI provider) for analysis. OpenAI processes the image, returns a verdict, and per their API policy does not use it to train their models.
• We send a compressed version of your photo, never the original full-resolution image.
• We do notuse your photos to train any AI model — ours or anyone else's.
• We do not share your photos with advertisers, data brokers, or any third parties besides our AI processor (OpenAI) for the analysis itself.
• We don't build a public profile gallery. Your fits aren't visible to other users.
• We keep a copy of your scanned photos in your private account so you can review your scan history. You can delete any individual scan, or all of them, from your account at any time via Settings → Clear scan history.

Third-party services we use

To run DRIPT we share specific data with the following processors. Each one is bound by a data processing agreement and only processes data on our instructions.

How we use your data

• To provide the rating, Style DNA, Occasions, and Glow Up features.
• To run your subscription and send you transactional emails (receipts, account confirmations).
• To investigate crashes and improve the app.
• To send product updates if you opted in to our newsletter (you can unsubscribe in one click).
• To send push notifications about your streaks or new features (only if you've enabled them).

We don't use your data for behavioral advertising and we don't profile you across other sites or apps.

Legal basis for processing (GDPR)

• Contract: to deliver the app and your subscription.
• Legitimate interest: crash reporting, basic analytics, fraud prevention.
• Consent: push notifications, marketing emails, optional analytics.
• Legal obligation: keeping billing records for tax purposes.

Where your data lives

DRIPT is operated from the Netherlands. Account data is stored in EU data centers (Supabase, Frankfurt region). AI processing happens on OpenAI's servers in the United States. RevenueCat operates from the United States. When data is transferred outside the EU, we rely on the European Commission's Standard Contractual Clauses (SCCs) and additional safeguards.

How long we keep things

• Your scans: until you delete them, or until you delete your account.
• Account info: as long as your account is active. After deletion, residual backups are removed within 30 days.
• Billing records: 7 years (Dutch tax law requires this).
• Crash logs and analytics: up to 90 days.
• Marketing email preferences: until you unsubscribe, plus 30 days.

Your rights

Under GDPR, CCPA, and similar laws, you have the right to:

• Access the personal data we hold about you.
• Correct it if it's wrong.
• Delete it (the "right to be forgotten").
• Export it in a portable format.
• Object to or restrict certain processing.
• Withdraw consent where we relied on it.
• Opt out of "sale" or "sharing" of personal data — note: we don't sell or share your data, but you have this right anyway under CCPA.

You can delete your account directly in the app via Settings → Account → Delete account. For all other requests, email [email protected]and we'll respond within 30 days.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or your local supervisory authority.

Cookies and tracking

The DRIPT app does not use cookies. The dript.app website uses minimal first-party analytics (no third-party trackers, no advertising cookies). We do not use the Identifier for Advertisers (IDFA) on iOS, so the App Tracking Transparency prompt is not required.

Children

DRIPT is not intended for users under 13 (or under 16 in the European Economic Area, where stricter rules apply). We do not knowingly collect personal data from children. If you believe a child has submitted personal data to us, contact [email protected]and we'll delete it within 7 days.

Account deletion

You can delete your account at any time:

• Open DRIPT
• Go to Settings → Account
• Tap "Delete account"

This permanently removes your account, all scans, all AI feedback, and revokes any active subscription (active subscriptions are managed by Apple/Google and you'll need to cancel those separately in your device settings).

Changes to this policy

If we change this policy in a meaningful way, we'll notify you in the app or by email at least 14 days before it takes effect. The latest version will always be at dript.app/privacy.

Contact

Privacy questions, complaints, or data requests: [email protected]
Postal: Ixalabs, [your registered address], Netherlands
Dutch DPA: autoriteitpersoonsgegevens.nl