Your privacy.

1. Photos, preferences, and AI generation

Your photos and generated looks are private. New looks stay in your account until you delete them. We keep a prepared original for each generation attempt, including failed or blocked attempts. Delete the failed attempt or every look made from the attempt to remove its original.

When you generate a look, we process the uploaded photo, chosen style, optional preference or occasion text, and requested number of images. Cloudflare validates and transforms the reference, removing embedded image metadata from the version sent onward. We save this prepared reference before generation. Failed attempts retain the style, preference text, and requested number of looks so you can restore them in the studio. Successful attempts clear the stored preference text. We do not save the unprocessed upload on our servers. The upload preview stays in browser memory, except for the temporary browser draft used to keep your photo through sign-in, described in section 7.

The prepared reference and instructions pass through OpenRouter to Meta's Muse Image model. If Meta's content filter declines a look, the same reference and instructions are sent once through Vercel AI Gateway to Google's Gemini image model instead. This includes processing the appearance of the person in the photo. Lookremix does not create a facial-recognition database, use the photo to authenticate you, or intentionally infer health, ethnicity, or other sensitive characteristics. Upload only photos you have permission to use and avoid sensitive information in your instructions.

Each generation is a separate request using your uploaded reference and current choices. Previous looks are not automatically sent as conversation history. We process this information to supply your requested generation service (Article 6(1)(b) GDPR).

AI providers may retain data for safety, abuse prevention, or legal obligations under their applicable terms. We do not promise zero retention across the entire processing chain. See OpenRouter's privacy policy, Meta's privacy policy, Vercel's privacy policy, and Google's privacy policy for provider information.

2. Your private library

Generated images and prepared originals are saved in Cloudflare R2. Cloudflare D1 stores their ownership, style, creation time, and generation/credit reference. Failed attempts also store the failure category and outfit settings, including preference text. The app checks your signed-in account before listing, displaying, downloading, or deleting an image; the buckets are not public. Authorised administration and service-provider access may still be necessary to operate the service or resolve support requests.

You can download or delete images in your library. Deletion hides an image immediately and removes its file; temporary storage errors can delay physical deletion while maintenance retries. An original stays available while any look made from that attempt remains; deleting the last look also removes the original. If no looks were saved, the original stays with the failed or blocked attempt until you delete it. Retrying creates a separate attempt with its own saved original. Older looks may have no saved original. Downloaded copies are outside our control. Images created before the library was introduced were not stored and cannot be recovered. Providing the library is based on Article 6(1)(b) GDPR.

Sharing and downloading export a JPEG copy of the image. Stored images stay private. Only an export you choose leaves your account. Copies you send to another app are governed by that app's terms and privacy practices.

Sharing offers your invite link alongside the image. We store which account invited which to grant one free look after the invited account makes its first look, up to 10 rewards per inviter. We compare recent sign-in IP addresses to reject rewards between accounts using the same address within 24 hours. Referral records remain with the accounts for reward limits; they contain no photos.

3. Who is responsible

The controller responsible for personal data processed by Lookremix is:

This notice covers lookremix.app and its studio, accounts, library, and purchases. See also our imprint.

We use Better Auth for email/password and Google sign-in, Stripe for checkout, and Cloudflare, OpenRouter, Meta, Vercel, and Google to run the studio. With your permission, we also use Google Ads to measure advertising results, as explained in section 7.

4. Visiting the site and keeping it secure

Cloudflare hosts and delivers the site. Its infrastructure processes connection and device information such as your IP address, request URL, time, browser information, and response status. Our application logs record route names, status codes, duration, environment, and limited error categories. They do not intentionally contain photo content, preference text, passwords, OAuth codes, or session tokens. See Cloudflare’s privacy policy for its infrastructure processing.

Better Auth stores the sign-in IP address and browser information with your session, and uses IP addresses for short-lived sign-in counters. Worker admission and generation limits use pseudonymous identifiers derived from an IP address or account ID. This supports reliable delivery, abuse prevention, and troubleshooting, based on our legitimate interest in a secure, functioning service (Article 6(1)(f) GDPR).

5. Your account

You can create an account with your name, email address and password. Better Auth manages sign-in and sessions on our infrastructure. We store a salted password hash, never your password in plain text. You must verify your email address before signing in with a password. Cloudflare Email Service delivers verification and password reset links to your address. These links expire after one hour. Resetting your password revokes existing sessions.

When you choose Google sign-in, Google provides a stable account identifier, display name, verified email address when available, and profile-picture URL. We store these with your Lookremix account and create a protected session. We do not receive your Google password or request access to Gmail, contacts, or Drive. OAuth access and refresh tokens are encrypted in our account database.

Your browser may contact Google to display your profile picture. Google processes sign-in activity under its own privacy policy. We use account information to provide the account, private library, and credit balance you request (Article 6(1)(b) GDPR).

6. Purchases and credit accounting

Stripe hosts checkout. We send your account identifier, email when available, selected credit pack, and purchase reference to Stripe. Both the 10-look Starter pack and the 30-look Standard pack use this process. Stripe handles the payment details you enter. We receive payment/refund status and transaction identifiers, and store purchase amounts, currency, credit allocations, and generation reservations. We do not store card numbers or security codes.

Payment processing and credit accounting fulfil your purchase (Article 6(1)(b) GDPR). Required tax/accounting records meet legal obligations (Article 6(1)(c) GDPR). Fraud prevention and resolving payment disputes also serve our legitimate interests (Article 6(1)(f) GDPR). Stripe processes some data for its own compliance and fraud-prevention purposes: Stripe privacy policy.

7. Cookies and browser storage

Lookremix uses these first-party cookies when you choose to sign in. These are Secure, HttpOnly, and SameSite=Lax on the live site:

• __Secure-lookremix.session_token: keeps you signed in for up to 30 days, or until sign-out. Better Auth validates the signed cookie against a session in our database.
• __Secure-lookremix.state: protects Google sign-in against misuse. It expires after 5 minutes and is cleared when sign-in completes. It is checked against a separate sign-in state record in our database, which expires after 10 minutes.

These cookies are necessary for your requested sign-in service (§ 25(2)(2) TDDDG). Associated account and security processing uses Article 6(1)(b) and (f) GDPR respectively. Opening a valid invite link also sets lr_ref, a Secure, HttpOnly, SameSite=Lax cookie lasting up to 30 days. It remembers the inviter for signup and is cleared after account creation. Blocking this cookie prevents referral attribution. Blocking sign-in cookies prevents sign-in. Google and Stripe may use their own cookies on their sign-in and checkout pages, as explained in their policies.

When you start sign-in or account creation from the studio, we temporarily save your selected photo and outfit settings in this browser's IndexedDB storage. A random identifier in session storage lets the same tab restore your draft when you return. Email confirmation links also include that identifier so another tab in the same browser can restore it. The identifier passes through our sign-in and email services; the photo and outfit settings stay in your browser until you generate a look. The draft can be restored for 30 minutes and is deleted from storage when restored, when sign-in completes in the studio, or when you remove the photo or sign out. Expired drafts are removed the next time the studio opens; closing the browser can delay deletion. You can also remove them by clearing this site's browser data. If you verify your email in another browser, return to the original studio tab to continue with your selected photo.

We remember your measurement choice in lr_measurement for 90 days. This cookie is necessary to respect your choice. Fonts are served with the app rather than loaded from Google Fonts. Authentication tokens are not stored in local storage.

Optional advertising measurement starts only when you choose Allow measurement. We then store the first consented visit’s campaign source, medium, campaign name, ad content, search keyword when supplied, Google click identifiers, public landing-page path and referring hostname in lr_attribution for up to 30 days. If you create an account, we attach that attribution and the consent time to your account for up to 90 days after signup. Untagged visits cannot reliably identify a specific ad or search keyword.

When enabled, the Google Ads tag sends Google event information for a verified signup, your first successful look and confirmed purchases, including purchase value and currency, pseudonymous transaction identifiers, campaign information and connection/device information. It can set first-party advertising cookies such as _gcl_au and _gcl_aw, configured for up to 90 days. We keep recently sent event identifiers in browser local storage under lr_sent_conversions to avoid duplicates, expiring entries after 90 days when measurement next runs. We do not send your photos, outfit instructions, name or email in these events. Ad personalization and Google Analytics storage are disabled.

This optional storage and processing relies on your consent under § 25(1) TDDDG and Article 6(1)(a) GDPR. Declining does not restrict the studio. Use Privacy choices in the footer, then Decline, to withdraw at any time. We stop measurement, remove our optional browser storage and, if you are signed in, request deletion of your stored signup attribution. If you withdraw while signed out, contact us to erase attribution linked to an account. Withdrawal does not affect earlier lawful processing or remove records already received by Google. Google Ireland Limited provides this service in the EEA and may process data outside the EEA under its applicable transfer safeguards. See Google’s privacy policy and Google Ads data processing terms.

8. How long we keep data

• Original photos: we keep the prepared, metadata-stripped version until you delete the failed attempt, every look made from a successful attempt, or request account closure. We do not save the unprocessed upload on our servers. The browser preview disappears when you replace it, sign out, refresh, or leave, apart from the sign-in draft described in section 7. That draft can be restored for 30 minutes; expired drafts are deleted when the studio next opens. We keep preference text while generation runs and for failed or blocked attempts until you delete the attempt. Successful generation clears the stored preference text.
• Generated images: kept until you delete them or request account closure. Maintenance removes incomplete output uploads after their request expires. An interrupted generation with a saved original becomes a failed attempt in the library.
• Account and credit records: kept while the account is provided. Request closure by email. Records needed to fulfil remaining obligations, comply with retention laws, or establish or defend legal claims may be retained for those purposes.
• Session and sign-in records: sessions expire after 30 days at most; sign-in state after 10 minutes. Expired records are removed during sign-in or scheduled maintenance. Sign-out revokes the current session immediately.
• Rate-limit counters: one-minute generation and Better Auth windows, and ten-minute Worker sign-in windows. Expired counters are removed automatically.
• Application logs: up to seven days in Cloudflare Workers Logs. Infrastructure security records also follow Cloudflare’s applicable retention practices.
• Problem reports and ideas: submissions in the app are stored in our database for up to 180 days. Email copies follow our correspondence retention practices.
• Accounting documents: German statutory periods depend on the document category: generally eight years for booking vouchers, six years for business correspondence, and ten years for books and certain records, calculated from the relevant year-end. Legal holds or ongoing tax matters can require longer retention. These duties do not require keeping your photos or generated images.

Deleted database records can remain in restricted disaster-recovery history for up to 30 days with Cloudflare D1 Time Travel. This is separate from R2 image files. Retention of independently processed Google, Stripe, OpenRouter, Meta, or Vercel data follows their applicable policies and legal obligations.

9. Recipients and international processing

Providers include Cloudflare (hosting, delivery, image processing, storage, security, authentication email), OpenRouter and Vercel (AI Gateway), Meta and Google (image generation), Google (sign-in and profile pictures), Stripe (payments), and our email service provider (correspondence). We may disclose necessary records to professional advisers, courts, or authorities where required by law or to handle a legal claim. We do not sell your photos or account information.

Data may be processed outside the European Economic Area, including in the United States; we do not promise EU-only processing. Where a transfer requires GDPR safeguards, the providers’ applicable data-transfer terms use mechanisms such as the European Commission’s Standard Contractual Clauses; an adequacy decision may apply where its requirements are met. See the Cloudflare data-processing terms, Vercel data-processing terms, Stripe data-processing terms, and the linked Google, OpenRouter, and Meta policies. Contact us for information about the safeguards applicable to your data or a copy of the relevant safeguards.

10. Contact and your rights

Use Help & ideas to send a private problem report or feature idea without signing in. We store your chosen category, message, optional email address and submission time in Cloudflare D1, and send an email copy to the Lookremix team through Cloudflare Email Service. We use your message to handle your request and improve Lookremix. An email address is only needed if you want a reply. Photos and account details are not attached automatically. Please do not include passwords or payment details.

Email lookremix@avayne.de for support, account closure, or privacy requests. We process your contact details and message to respond: Article 6(1)(b) GDPR for service/purchase enquiries, Article 6(1)(c) for statutory privacy requests, and Article 6(1)(f) for other legitimate correspondence. Do not email passwords or card details.

Subject to legal conditions, you can request access, correction, deletion, restriction, and portability. You may object to processing based on legitimate interests for reasons relating to your particular situation. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing. We may need proportionate identity verification to protect your account.

We normally respond to GDPR requests within one month. If a legally permitted extension is necessary, we will explain this within that month. You can complain to a supervisory authority, including where you live, work, or believe an infringement occurred. Our local authority is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany; poststelle@ldi.nrw.de.

11. Your choices and automated processing

You can browse public pages without an account. Email/password or Google sign-in is required for an account, and a reference photo for personalised generation; preference text is optional. Buying credits requires the checkout information requested by Stripe. You may choose not to provide this information, but the corresponding feature cannot then be supplied.

AI creates outfit images and automated checks protect the service and account for credits. We do not use your images to make decisions producing legal or similarly significant effects about you within Article 22 GDPR.

12. Changes to this notice

We update this notice when the service or its processing changes. The revision date appears above. Contact us using the details in section 3 with questions about this version.