Biometric & Body Data Notice

1. Quick Summary

This notice tells you, in plain language, what happens when you use TerzyApp's body-measurement service. Before continuing, please read this short summary. The rest of this notice gives you the legal detail.

• We capture photographs from your device camera, in the iOS app or on the website, and, in the iOS app on supported devices, depth data, to estimate body measurements.
• Computer-vision models turn those captures into derived numerical body measurements.
• Raw photographs and depth captures are deleted as soon as the measurements have been derived, normally within seconds. If a processing job fails part-way through, an automated cleanup removes the images shortly afterwards, and a deletion that does not succeed at the first attempt is logged so that we can remove the file. We do not keep them.
• Only the derived measurement values are stored against your account, so you can reuse them across Orders.
• We do not sell, lease, share for advertising, or train external models with your biometric data.
• You can withdraw your consent and delete the derived measurement values at any time from your account.
• Use of the body-measurement service requires your separate, informed, written consent. If you do not consent, you can still use the rest of the Platform; you just will not be able to use the measurement service.

2. Who Is Asking for Consent

Terzyapp UK Ltd (Company No. 17234484, registered office: Suite 10861, 5 Brayford Square, London E1 0SG, United Kingdom) is the data controller for the biometric data described in this notice. For the European Union, our Article 27 Representative is [EU Representative TBC]. Our Data Protection Lead can be contacted at [email protected].

3. What This Notice Covers

This notice covers "Body Data", which means the following items collected through the body-measurement service:

• Camera photographs of you, captured in poses guided by the on-screen instructions.
• Depth maps or LiDAR captures, where you use the iOS app on a device that supports them. Measurement sessions on the website use photographs only.
• Sensor metadata associated with the capture (timestamp, device model, calibration parameters).
• The derived numerical body measurements produced by our model (for example, chest, waist, inseam, sleeve length).
• A 3D body mesh generated from the derived measurements, where used by the virtual try-on feature.

4. Why We Process Body Data — Purpose

We process Body Data for the sole purpose of estimating your body measurements so that you can shop for and order tailored garments more accurately on the Platform. The derived measurement values are made available to the Seller you contract with for a specific Order, to the extent necessary to produce or fit the item. We do not use Body Data for advertising, automated profiling, fraud scoring, model improvement involving external parties, or any purpose unrelated to fulfilling Orders.

5. How We Process Body Data — Pipeline

When you begin a measurement session, your captures are sent over an encrypted connection and shared, together with the height you enter, with a specialist third-party body-measurement technology partner so that it can derive the numerical measurement values, which are then saved to your account. Raw captures are not retained by us, and this partner is contractually bound not to retain them beyond the derivation step. We work with carefully selected providers and may change this partner from time to time to deliver the best service; the identity of our current measurement partner is available on request. We retain the derived measurement values as described in Section 8.

6. Legal Bases — UK, EU & EEA

If you are located in the United Kingdom, the European Union, or the European Economic Area, our processing of Body Data relies on the following legal bases under UK GDPR and EU GDPR:

• Article 6(1)(a) and Article 9(2)(a) — your explicit consent, given through this notice and the accompanying consent screen.
• Article 6(1)(b) — performance of a contract with you, where you have placed an Order that requires measurements.

7. Illinois — Biometric Information Privacy Act (BIPA)

If you are an Illinois resident, the following applies in addition to Section 6 to satisfy the Illinois Biometric Information Privacy Act, 740 ILCS 14/15:

• TerzyApp is collecting, storing, and using your biometric identifier (camera and depth captures of your body) and the biometric information derived from it (the derived measurement values and the 3D body mesh).
• The specific purpose of the collection is to estimate your body measurements so that you can shop for and order tailored garments through the Platform.
• The length of time for which the biometric identifier is collected, stored, and used is: raw captures are destroyed as soon as the measurement values have been derived, normally within seconds, and where a processing job fails part-way through an automated cleanup destroys them shortly afterwards, and a deletion that does not succeed at the first attempt is logged so that we can remove the file; derived measurement values are stored until you delete them, you close your account, or the initial purpose for collecting them has been satisfied and no Order requiring those values has occurred for one year, whichever happens first.
• We will not sell, lease, trade, or otherwise profit from your biometric identifier or biometric information.
• We will not disclose your biometric identifier or biometric information except (i) to the Seller you have contracted with, strictly as needed to fulfil your Order; (ii) where required by a valid warrant, subpoena, or court order; or (iii) with your separate written consent.
• We protect your biometric data using the reasonable standard of care within our industry, including encryption in transit (TLS) and at rest, role-based access controls, and audit logging.
• Your written informed consent is required and is captured through the consent screen accompanying this notice.

8. Texas — Capture or Use of Biometric Identifier (CUBI)

If you are a Texas resident, the following applies in addition to Section 6 to satisfy Texas Business and Commerce Code §§ 503.001 et seq.:

• We provide you with this notice before capturing your biometric identifier.
• We obtain your informed consent through the consent screen accompanying this notice.
• We will not sell, lease, or otherwise disclose your biometric identifier except (i) to the Seller you have contracted with, strictly as needed to fulfil your Order; (ii) where required by law, warrant, subpoena, or court order; or (iii) to a law-enforcement agency in response to a warrant.
• We will destroy your biometric identifier within a reasonable time, and not later than the first anniversary of the date the purpose for collecting it expires. Raw captures are destroyed as soon as the measurement values have been derived, normally within seconds, and where a processing job fails part-way through an automated cleanup destroys them shortly afterwards, and a deletion that does not succeed at the first attempt is logged so that we can remove the file. Derived measurement values are destroyed when you delete them, you close your account, or one year after your last interaction with the Platform, whichever is sooner.

9. Retention

Retention periods for each item covered by this notice are:

• Camera photographs and depth captures (raw): deleted as soon as the measurement values have been derived, normally within seconds. Where a processing job fails part-way through, an automated cleanup deletes them shortly afterwards, and a deletion that does not succeed at the first attempt is logged so that we can remove the file. We do not back up raw captures.
• Derived measurement values: stored until you delete them in your account, or you close your account, or the periods described in Sections 7 and 8 elapse, whichever happens first.
• 3D body mesh used by virtual try-on: deleted along with the derived measurement values, or 30 days after the last try-on session, whichever is sooner.
• Consent records (which version of this notice you accepted, when, and how): retained for 3 years after withdrawal or last consent, to evidence compliance.
• Logs of access by our staff to your biometric data: retained for 2 years for audit purposes.

10. Sharing & Disclosure

We share Body Data only as follows: (a) with the Seller you have contracted with for a specific Order, to the extent strictly necessary to produce or fit the item; (b) with the third-party and partner companies that operate our Platform — for example, cloud hosting and AI service providers — each under data-processing terms compliant with UK GDPR Article 28, EU GDPR Article 28, and equivalent state laws; (c) with a specialist third-party body-measurement technology partner, which receives your body photographs and entered height solely to derive the measurement values and acts on our documented instructions under an Article 28-compliant data-processing agreement (its current identity is available on request); (d) where required by law, warrant, subpoena, or court order. We do not share Body Data for advertising, model training by third parties, or any other purpose.

11. AI System Transparency

The body-measurement service is an AI system within the meaning of the EU Artificial Intelligence Act and applicable AI-transparency laws. You are interacting with an AI system, and its outputs (the derived measurement values and any virtual try-on imagery) are estimates produced by a machine-learning model. In the app, measurement values derived by the model are labelled "AI-estimated" where they are shown to you, and a try-on result is labelled "AI-generated". A result you save to your device or share outside the app may not carry that marking, because the marking is part of the screen rather than of the image file itself. The outputs are intended to support tailoring and shopping decisions; they are not medical, clinical, or diagnostic and should not be relied upon as such.

12. Children

The body-measurement service is not available to persons under 18. We do not knowingly collect Body Data from minors. If we become aware that we have collected Body Data from a minor, we will delete it promptly.

13. Your Rights

In addition to the rights described in our Privacy Policy and in the US Addendum, you may:

• Withdraw your consent to the body-measurement service at any time, by deleting your body measurements, by removing the biometric consent recorded for a family member you have added, or by closing your account. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Delete the derived measurement values at any time, from your account.
• Request a copy of the records evidencing your consent, by emailing [email protected].
• Request that we destroy any retained Body Data ahead of the periods in Section 9, subject to overriding legal obligations (for example, a pending Order that strictly requires the measurements).
• Lodge a complaint with your data-protection regulator (UK ICO, EU/EEA supervisory authority, Illinois Attorney General, Texas Attorney General, or another competent authority).

14. How Consent Is Captured

Before your first measurement session, we show you a consent screen that summarises this notice, links to it in full, and states the retention period that applies to you. You must switch on an explicit consent control on that screen before any capture begins. We record the version of this notice you accepted, the timestamp, your account identifier, whether you accepted in the iOS app or on the website, the network address of that request, and the jurisdiction we determined applies to you. We will not begin a measurement session without this record. You can withdraw your consent afterwards at any time, by deleting your body measurements, by removing the biometric consent recorded for a family member you have added, or by closing your account.

15. Changes to This Notice

We may update this notice from time to time. Where a change is material — for example, a change in retention, purpose, recipients, or legal basis — we will request your fresh consent before processing further Body Data. Non-material changes (clarifications, corrections, formatting) take effect when published. The "Last updated" date reflects the current version.

16. Contact

Questions about this notice or your Body Data can be sent to [email protected] or in writing to Terzyapp UK Ltd — Data Protection, Suite 10861, 5 Brayford Square, London E1 0SG, United Kingdom. We will acknowledge your message within 5 business days. This notice is written and executed in English. Any translations are for information only; in case of conflict, the English version prevails.