This policy describes the processing actually implemented by StylR when you use the website and its services.
1. Controller and data processed
StylR is the controller for the processing described here. You can contact it through the website contact page. Depending on the features you use, the following data is processed:
- Account and onboarding: email address, hashed password, language preferences, goals, style information, optional profile data and marketing consent. This data is used to create, secure and personalise the account.
- Photos and results: a selfie or garment photo, visible colours and characteristics extracted for colour, morphology and Style Assistant analyses. Photos are needed to provide the requested result.
- Technical and usage data: visit identifier, security logs, browser information, pages and journey events. This supports security, service operation and, with your consent, audience measurement.
- Purchases and billing: selected offer, payment status, history, billing details and payment references. This data is used to complete purchases, provide records and meet applicable obligations.
2. Cookies and similar technologies
Necessary cookies support the session, security, analysis journey and storage of your consent choices. They cannot be disabled in the banner.
- Necessary cookies: authentication, security, service operation and storage of the consent choice.
- Audience measurement: Google Analytics 4 loads only on stylr.fr over HTTPS, outside administration, after your analytics consent.
- Marketing: the banner offers a marketing choice, but the configured GA4 integration denies advertising storage and advertising personalisation.
You can accept, reject or customise your choice in the cookie banner, and later change it in your browser. Withdrawing consent does not affect processing already carried out before withdrawal.
3. Third-party services and data sharing
StylR does not sell your personal data. The providers below receive the data necessary for their role. Image analyses are performed by StylR to provide the requested service and analysis photos are not sent to an external AI provider.
- Railway: application hosting and execution.
- Supabase: application database, including accounts, results, billing and journey data.
- Cloudflare R2: private storage for photos and images associated with analyses. They are served through controlled application access.
- Stripe: payments, subscriptions and payment methods. StylR does not directly process full card numbers.
- Brevo: transactional emails and CRM synchronisation. Marketing emails rely on the marketing choice recorded in StylR.
- Google Analytics 4: consent-based audience measurement including viewed pages, login state, a session identifier and journey events.
- Pinterest: StylR administration may publish its own editorial content through the Pinterest API. This integration is not for StylR users. Analysis photos and user personal data are not sent to Pinterest in this context.
Some providers may be established in, or process data outside, the European Economic Area. For questions about these transfers, contact StylR through the contact page.
4. Legal bases for processing
- Contract performance: to provide the services you request.
- Consent: for optional cookies, marketing, or optional data uses.
- Legal obligations: to comply with applicable laws and regulations.
- Legitimate interests: to secure, maintain, and improve our services.
5. Data retention
Account data, analyses and photos are retained for the period in which the account is used or until they are deleted. Analyses and images can be deleted through the features provided for that purpose. You can request deletion of your account or data through the contact page, subject to applicable legal obligations, including billing obligations.
6. Your rights
You can request access, rectification, erasure, restriction, objection and portability of your data, and withdraw consent where processing relies on it. To exercise your rights or request deletion of your photos and account, contact us through our contact page . You can also lodge a complaint with the CNIL.
7. Security and transfers
Some account and billing data, including email, name and billing address, is encrypted before storage. Passwords are hashed and access to photos is controlled. These measures reduce risk but do not guarantee an absence of risk. Potential transfers outside the EEA are described in the providers section.
8. Policy updates
This policy may change when processing changes. The date below is the date of its last published update.
Last update: October 8, 2026