Privacy Policy

1. Introduction

This Privacy Policy describes how Mavira AI LLC ("Mavira," "we," "us," or "our") collects, uses, shares, and protects information about you when you use our website at mavira.io and maviraai.com and related services (the "Service").

Mavira operates an AI-powered style discovery service. You upload an image, our AI analyzes its visual style, and we recommend products from partner stores that match. When you click through to a partner store and make a purchase, the partner store handles the transaction directly — we do not process payments.

This policy applies to our website at mavira.io and maviraai.com and any services linked to this policy. Our Shopify App has a separate App Privacy Policy for Shopify merchants.

2. Information We Collect

2.1 Account Information

When you create an account, we collect information through our authentication provider, Supabase. If you sign in with Google, we also receive limited profile information from Google:

• Email address
• Name (if provided by Google)
• Profile picture (if provided by Google)
• A unique user identifier

2.2 Images You Upload

When you upload an image for style analysis:

• We send the image to our AI model, which runs on Replicate's cloud infrastructure, to generate a style embedding — a mathematical representation of the image's visual characteristics used to match against partner products
• We do not store the original image on our own systems: it is discarded once the embedding is generated, and Replicate deletes its copy, along with the model's output, within one hour. The embedding itself is retained to power your recommendations and personalize future results
• Embeddings are a compact mathematical representation of visual features, not a copy of the image. Because we delete the original image after the embedding is generated, the image itself is not retrievable from our systems

We do not use uploaded images to identify individuals or to infer sensitive personal information. Specifically, our model is designed to classify visual style, not to identify individuals. The embedding and predictions we retain represent fashion-aesthetic features, not biometric identifiers. We do not use the model to detect, extract, store, or match facial geometry, body geometry, or other biometric identifiers; we do not use it to identify, authenticate, or distinguish between individuals; and we do not use it to infer racial or ethnic origin, religion, sexual orientation, health, or other sensitive categories. Our training data was deliberately diversified across appearance categories to reduce the influence of personal characteristics on aesthetic predictions. The original uploaded image is deleted after embedding generation, so it cannot be re-analyzed for any of these purposes after the fact.

2.3 Style Profile (Account Holders)

If you have an account, we build and maintain a style profile that aggregates your preferences over time to improve the quality of your recommendations. This profile may include:

• Cumulative style embeddings derived from images you've uploaded
• Style preferences inferred from your interactions (e.g., items you view or click through to)
• Size preferences you provide or that we infer
• Price range preferences you provide or that we infer
• Explicit preferences you configure in your account settings

You can view and update your style profile preferences in your account settings, or request deletion at any time by contacting us.

2.4 Wishlist

Saving items to your wishlist requires an account. If you save items to your wishlist, we store a record of those items associated with your account so you can access them across sessions and devices. You can remove items from your wishlist at any time through the Service.

Separately, items you save from the product carousels in our blog articles are kept only in your browser's local storage. They are never associated with your account, and clearing your browser storage removes them. See our Cookie Policy for details.

2.5 Interaction and Click-Through Data

We collect information about how you interact with the Service:

• Products you view, save to wishlist, or click on
• Click-throughs to partner stores: when you click a product to visit a partner's store, we record which product you clicked, which partner store it belongs to, and the timestamp. This allows us to improve recommendations and, where applicable, attribute subsequent purchases to Mavira for commission calculation
• Search queries and style preferences
• Feedback you provide on recommendations

We do not monitor your browsing after you leave our website. Your activity on a partner's store is governed by that partner's privacy policy, and we receive nothing about the pages you view there, the products you browse, or how long you stay.

There is one narrow exception, and it applies only when all of the following are true: you arrived at the partner's store through a Mavira referral link, that store runs our Shopify App, the mavira_ref referral cookie was set on that storefront (which in the European Economic Area, the United Kingdom and Switzerland requires your consent, elsewhere can be declined, and never happens where your browser sends a Global Privacy Control signal — see Section 6), and you complete a purchase. Where all of that holds, we receive order-level information about that one order:

• The Shopify order ID and order number
• The order subtotal before tax and shipping
• The currency of the subtotal (the store's currency, which may differ from the currency you paid in)
• The timestamp of the order
• The partner store's domain
• The referral code that attributed the order, which identifies Mavira as the referrer, not you

We do not receive your name, email address, billing or shipping address, payment details, IP address, device fingerprint, or a record of the individual items in your order. If the mavira_ref cookie was not set, or you do not complete a purchase, we receive nothing at all. See our App Privacy Policy for details.

2.6 Technical Information

Like most websites, we automatically collect:

• IP address and approximate location derived from it
• Browser type, device type, and operating system
• Referring URL and pages viewed
• Session duration and timestamps
• Cookies and similar technologies (see Section 6 and our Cookie Policy for the complete list)

Some of this information is stored in browser cookies and local storage on your device.

2.7 Analytics

We use two analytics services to understand how people use the Service: Google Analytics and PostHog.

Google Analytics. Google Analytics sets cookies and collects information including your IP address, the pages you view, and session data. It is loaded only after you consent to analytics cookies through our cookie banner; until then, nothing is sent to Google Analytics. Once you accept, it may receive:

• The address of each page you visit, and the page that referred you. Page addresses include any query parameters, such as the style aesthetics on a shared aesthetic card, except on our browse page. There, we remove every query parameter before the address is sent, except campaign-tracking parameters (utm_*, gclid, and fbclid), so Google Analytics does not receive what you type into the browse page's search box or the filters you apply there
• Which products you click, with the product's name, identifier, category, and price, its position on the page, and the part of the Service it was listed in
• Clicking to sign in with Google, whether you are using another app's built-in browser (such as Instagram's), and, if sign-in fails before you are sent to Google, the error message
• Other activity that Google Analytics measures automatically, such as scrolling and clicks on links to other websites

You can also opt out universally by installing the Google Analytics Opt-out Browser Add-on.

PostHog. We use PostHog, hosted in PostHog's EU Cloud (Frankfurt, Germany), for product analytics: understanding which pages and features people use, how quickly our pages load, and where things go wrong. How PostHog runs depends on your cookie choice:

• If you accept analytics cookies, PostHog stores a random identifier in a cookie and in browser storage on your device. This lets us recognize returning visits from the same browser and group the pages you view into visits. The identifier is not linked to your account, name, or email.
• If you decline analytics cookies, have not yet made a choice, or your browser sends a Global Privacy Control signal and you have not accepted analytics cookies while it is on, PostHog runs in cookieless mode. Nothing is stored on your device, and visitors are counted using a hash that is reset daily and cannot be linked to you from one day to the next. See "Cookieless Analytics" in our Cookie Policy for how this works.

In either mode, PostHog may receive:

• The pages you visit, when you leave them, and the page that referred you. We remove query parameters and fragments from page addresses before they are sent, except campaign-tracking parameters (utm_*, gclid, and fbclid)
• Your browser and its version, your operating system, device type, screen size, and language and time zone settings
• Which buttons and links you click, including their visible text
• Where on a page you click and move your pointer, recorded only as positions on the page (for heatmaps), never what was on your screen
• How quickly pages load and respond to you
• How long a page or dialog was visible on your screen
• Specific actions on the Service:
  • starting an upload, and whether you dragged and dropped the file or chose it with the file picker
  • whether an upload succeeded, with the file type and the file's size range, or failed, with the general reason for the failure (such as a timeout or a file that was too large)
  • how long matching took, how many products were recommended, and the names of the style aesthetics matched
  • which products you click, save, remove from your saved items, or click through to a partner store, with the product's name, identifier, and category, the brand's identifier, the price, the product's position on the page, the part of the Service it was listed in, and the style aesthetic it was shown with
  • which aesthetic pages you view and which of our predefined filters you apply
  • which blog posts you read
  • starting or completing sign-up, logging in, and the sign-in method used
  • clicking to sign in with Google, whether you are using another app's built-in browser (such as Instagram's), and, if sign-in fails before you are sent to Google, the general type of failure
  • when you save your profile, which of its settings you changed (such as clothing sizes)
  • starting and submitting our partner application form

If you accept analytics cookies, PostHog also works out your approximate location (such as country or city) from your IP address. In cookieless mode, it does not. In either mode, PostHog does not store your IP address.

PostHog never receives:

• Your name, email address, account identifier, or other account details. We do not link analytics data to your account
• Your uploaded images, the addresses of those images (including temporary browser addresses), their file names, or the metadata embedded in them (such as EXIF data)
• Anything our AI infers about a person in a photo you upload, such as body shape, skin tone, age, or gender
• What you type into forms or search boxes
• Recordings of your screen or session. We have turned off PostHog's session recording and surveys

Neither Google Analytics nor PostHog collects analytics events on the partner dashboard, partner login, or admin pages.

2.8 Messages and Partnership Applications

When you send us a message through the contact form on our website, we collect your email address and message, and your name and the type of inquiry if you provide them. When you apply to become a brand partner, we collect your name, business name, email address, and business website, and the type of products you sell and any additional information if you provide them.

We send each submission to our team's email inbox, which is hosted by Proton, using the email delivery service Resend. We use it to reply to you and, for partnership applications, to review your application under our Partnership Application Terms.

2.9 Information We Do Not Collect

We do not process payments and do not collect payment card information, billing addresses, or shipping addresses. Purchases are made directly on partner stores, which have their own privacy policies.

3. How We Use Your Information

We use the information we collect to:

• Provide the core Service: style analysis, product matching, and recommendations
• Build and maintain your style profile to personalize recommendations over time
• Save and manage your wishlist across sessions and devices
• Track click-throughs to partner stores to improve recommendations and, where applicable, attribute purchases for commission calculation
• Authenticate you and secure your account
• Communicate with you about the Service, including service announcements and support responses
• Respond to messages you send us and review partnership applications
• Measure, in aggregate, how the Service is used (for example, which pages are visited and where uploads or sign-ups fail) so we can fix problems and improve it
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations
• Improve our AI models and Service through aggregated, anonymized analysis

4. Legal Basis for Processing (EEA/UK Users)

If you are in the European Economic Area or United Kingdom, we process your personal data under the following legal bases:

• Contract: Processing necessary to provide the Service you requested (account creation, image analysis, recommendations), or to take steps you ask for before entering into a contract (reviewing a partnership application)
• Legitimate interests: Responding to messages you send us, improving our Service, maintaining security, preventing fraud, and generating aggregated analytics, including cookieless analytics where you have not accepted analytics cookies (see Section 2.7)
• Consent: Non-essential cookies (analytics cookies set by Google Analytics and PostHog) and any optional features where we ask for your specific permission
• Legal obligation: Where we must process data to comply with applicable law

5. How We Share Information

We do not sell your personal information. We share information only in the following limited circumstances:

5.1 Service Providers

We share information with third-party service providers who help us operate the Service under contractual confidentiality obligations:

• Supabase — authentication and database hosting
• Vercel — web application hosting
• Cloudflare — DNS and image storage (via Cloudflare R2)
• Replicate — runs our AI style model on the images you upload (see Section 2.2)
• Resend — delivers the messages and partnership applications you submit through our website to our team (see Section 2.8)
• Proton — hosts our team's email, where those messages and partnership applications are stored (see Section 2.8)
• Google — authentication (when you sign in with Google) and analytics (when you consent)
• PostHog — product analytics, hosted in the EU (see Section 2.7)
• Upstash — rate limiting to protect our forms and features from abuse, hosted in the EU. Upstash receives a pseudonymized identifier derived from your IP address, never the address itself

5.2 Partner Stores

When you click through to a partner store from a recommendation, we do not transmit your personal information to that partner. Your subsequent activity on the partner's store is governed by their privacy policy. We do use a referral code to track whether your visit resulted in a purchase, for commission calculation purposes. The code identifies Mavira as the referrer and contains nothing about you. It is carried in the URL of the link you click and, where the partner's store runs our Shopify App, is stored in a first-party mavira_ref cookie on that partner's storefront. The cookie is consent-gated: in the European Economic Area, the United Kingdom and Switzerland it is set only with your consent, and elsewhere you can decline it. It is never set where your browser sends a Global Privacy Control signal.

5.3 Legal Requirements

We may disclose information if required by law, regulation, court order, or valid government request, or if necessary to protect the rights, property, or safety of Mavira, our users, or the public.

5.4 Business Transfers

If Mavira is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information is transferred and becomes subject to a different privacy policy.

6. Cookies and Tracking Technologies

We use cookies and similar technologies for:

• Essential cookies: Required for authentication and core functionality
• Functional storage: Browser storage that holds anonymous identifiers and pre-sign-in state (such as the temporary identifier that associates your uploads before you create an account) so your experience remains coherent across pages and sessions
• Analytics cookies: Google Analytics and PostHog (set only after you consent). If you decline, Google Analytics does not load, and PostHog counts visits in a cookieless mode that stores nothing on your device (see Section 2.7)
• Referral attribution cookie (partner storefronts only): When you click through to a partner's Shopify store, our Shopify App may set a first-party mavira_ref cookie on that partner's storefront — not on our website — to attribute a resulting purchase to Mavira. It is consent-gated (in the European Economic Area, the United Kingdom and Switzerland it is set only with your consent, and elsewhere you can decline it), is not strictly necessary, and is never set where your browser sends a Global Privacy Control signal

We recognize Global Privacy Control (GPC) browser signals and treat them as an opt-out of analytics cookies and (where applicable) the sale or sharing of personal information. Under a GPC signal, Google Analytics does not load and PostHog runs in cookieless mode, even if you accepted analytics cookies before your browser began sending the signal. You can still choose to accept analytics cookies while the signal is on, using the "Cookie Settings" link in our footer (see our Cookie Policy). A GPC signal also suppresses referral attribution in full: on a partner's Shopify storefront, no mavira_ref cookie is set, any existing one is deleted, and no purchase is attributed to Mavira. GPC overrides any consent granted through that storefront's consent framework.

Some browsers offer a "Do Not Track" (DNT) signal. There is no industry consensus on how to respond to DNT signals, and we do not currently respond to DNT browser signals. The opt-out mechanisms we do honor are our cookie banner and the Global Privacy Control signal described above.

Most browsers let you block or delete cookies. Blocking essential cookies will prevent parts of the Service from functioning. For the complete list of cookies and browser storage we use, see our Cookie Policy.

7. Data Retention

We retain personal information only as long as necessary for the purposes described in this policy:

• Account information: For as long as your account is active
• Uploaded images: Not stored on our own systems; discarded once the embedding is generated (typically within minutes). Replicate deletes its copy within one hour
• Style embeddings and style profile: For as long as your account is active, to maintain recommendation quality
• Wishlist: Until you remove items, or until you delete your account
• Messages and partnership applications: For as long as needed to respond to you and keep a record of our correspondence
• Click-through and interaction data: For as long as your account is active, for personalization and commission attribution; commission attribution records may be retained longer where required for accounting and dispute resolution
• Analytics data: Kept in Google Analytics for up to 14 months and in PostHog for 1 year
• Rate-limiting data: Deleted automatically within one hour
• Records required for legal or accounting purposes: As required by law (generally up to 7 years)

When you delete your account, we remove your personal information within 30 days from active systems and within 90 days from backup systems, except where retention is required by law. See our Data Deletion page for details on how to request deletion.

8. Your Privacy Rights

Depending on where you live, you may have the following rights:

• Access: Request a copy of your personal information
• Correction: Request correction of inaccurate information
• Deletion: Request deletion of your personal information
• Portability: Receive your data in a machine-readable format
• Objection: Object to certain processing based on legitimate interests
• Restriction: Request that we limit how we process your information
• Opt-out of sale or sharing (where applicable)
• Non-discrimination for exercising these rights

To exercise any of these rights, email team@maviraai.com. We will respond within 30 days. Full instructions and regional details are on our Data Deletion page.

California Residents (CCPA/CPRA)

In the 12 months preceding this policy, we have collected the following categories of personal information as defined by the CCPA: identifiers (account identifier, name, email, user ID, and the random identifiers set by analytics cookies where you accept them); commercial information (wishlist items, click-through activity to partner stores, stated size and price preferences); professional information (business name, website, and product type from partnership applications); internet and network activity (session data, search queries, interactions with the Service, including the product-analytics events described in Section 2.7); and inferences drawn from the foregoing (style embeddings, inferred style and size preferences making up your style profile). We do not collect sensitive personal information as defined by the CCPA. We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. California residents have the right to know, delete, correct, and opt out (though no opt-out is required since we do not sell or share), and the right to non-discrimination. California enforcement of these rights is shared between the California Privacy Protection Agency (CPPA) and the California Attorney General.

EEA, UK, and Swiss Residents

In addition to the rights above, you have the right to lodge a complaint with your local supervisory authority (find yours at edpb.europa.eu). We encourage you to contact us first so we can try to resolve your concern directly.

9. International Data Transfers

Mavira is based in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States. For transfers from the EEA, UK, or Switzerland, we rely on Standard Contractual Clauses approved by the European Commission, or equivalent mechanisms, to provide appropriate safeguards. Our product-analytics provider, PostHog, and our rate-limiting provider, Upstash, store their data in the EU (Frankfurt, Germany). Google Analytics, which runs only if you accept analytics cookies, may process data in the United States and other countries where Google operates.

10. Data Security

We use industry-standard technical and organizational measures to protect your information, including encryption in transit and at rest, access controls, and regular security reviews. No system is perfectly secure, and we cannot guarantee absolute security.

If we experience a data breach affecting your personal information, we will notify you without undue delay and, where required by law, within 72 hours.

11. Children's Privacy

The Service is not directed to children under 13, or under the applicable minimum age in your jurisdiction (which may be as high as 16 in certain EEA member states). We do not knowingly collect personal information from children. If you believe a child has provided information to us, please contact team@maviraai.com and we will promptly delete it.

12. Automated Processing

We use AI and automated processing to generate style embeddings, infer style and size preferences, build your style profile, and produce product recommendations. This processing does not produce legal or similarly significant effects on you. If you disagree with a recommendation or with any inferred preference in your style profile, you can update your preferences in your account settings or ignore the recommendation; recommendations are suggestions, not decisions. You may contact us at any time to request human review of any automated decision.

13. Third-Party Services

The Service links to partner stores and may contain links to other third-party websites. We are not responsible for the privacy practices of third parties. We encourage you to review their privacy policies before providing any personal information.

14. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will provide at least 30 days' notice before the updated policy takes effect, via email to the address associated with your account or through a prominent notice on the Service. The updated policy will include a revised effective date.