Legal
Privacy Notice
This notice explains how Tasc Fashion Ltd ("tasc", "we", "us") collects, uses, shares and protects personal data when you use tasc-fashion.ai, the tasc mobile app, our AI stylist Moda, and the related services (together, the "Services").
We are the "controller" of the personal data described in this notice, except where we act as a "processor" for a merchant who installs the tasc Shopify app (see section 12). We comply with the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).
- Company
- Tasc Fashion Ltd
- Contact
- support@tasc-fashion.ai
1. The short version
- We collect what you give us (account, style profile, wardrobe photos, chats with Moda) and what your device sends us (technical and usage data).
- We use it to run the Services, personalise recommendations, keep them secure and, where you agree, understand how they are used.
- tasc does not sell your personal data, and we do not store your payment card number.
- When you click through to buy from a partner brand, you leave tasc. The sale is between you and that brand, and tasc may earn a commission.
- You can delete your account in the app, change cookie choices at any time, and exercise your legal rights by emailing us.
2. Personal data we collect
The data we collect depends on how you use the Services.
| Category | What it includes | Where it comes from |
|---|---|---|
| Account data | Email address, name, username, sign-in method and login credentials (managed by Google Firebase Authentication), account status, membership tier and trial dates. | You, when you sign up or sign in. |
| Style profile | Gender, date of birth, body type and fit preferences, style persona, favourite and least favourite colours, budget preferences per category, brands you dislike, and any other preferences you enter in onboarding or account settings. | You. |
| Moda conversations | The messages you send to Moda, the recommendations returned, and feedback or ratings you give. | You. |
| Wardrobe content | Photos of clothing you upload, the item attributes we derive from them (type, colour, pattern and similar), and outfits we generate or you save. | You, and our systems. |
| Shopping activity | Wishlist, basket, saved outfits, products and outfits you view, click-throughs to partner brands, "notify me when back in stock" requests, and reviews you write. | You, and your device. |
| Membership and payments | Plan, trial and renewal status, and payment confirmation. Card details are collected and held by our payment provider (Stripe); we never see or store your full card number. | You, and our payment provider. |
| Technical data | IP address, device and browser type, operating system, app version, language, pages and screens viewed, timestamps, error logs, and security events such as sign-in attempts (including email, IP address and user agent). | Your device and our servers. |
| Cookie and analytics data | Your cookie choices, and, if you consent, analytics identifiers and usage statistics (see our Cookie Policy). | Your device. |
| Affiliate tracking data | When you click a tasc link to a partner brand, a click identifier, the time, the destination and a one-way (hashed) value derived from your IP address and user agent. If you have accepted functional cookies, a first-party cookie links a later purchase back to that click for up to 30 days. | Your device and the partner brand. |
| Communications | Newsletter sign-up, support emails and anything else you send us. | You. |
We do not ask you for, and ask that you do not give us, special category data (for example health, religion, ethnicity or sexual orientation) in your profile or in chats with Moda. If you volunteer it, we treat it with the same safeguards as other data and use it only to respond to you.
3. How we use your data and our lawful bases
Under UK data protection law we must have a lawful basis for each use of your data. These are ours.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Create and run your account, sign you in, remember your preferences | Account data, style profile | Contract (providing the Services you asked for). |
| Personalise products, outfits and Moda recommendations to your profile | Style profile, shopping activity, Moda conversations, wardrobe content | Contract. You can switch personalisation off in your settings, after which we use generic rankings. |
| Process wardrobe uploads and generate matching outfits | Wardrobe content | Contract. |
| Provide paid memberships and trials | Account data, membership and payment data | Contract; legal obligation (accounting and tax records). |
| Attribute a purchase to a tasc click and calculate partner commission | Affiliate tracking data | Legitimate interests (running a commission-funded service). You can decline cookies; see section 5. Without functional cookies we set no attribution cookie, and the click identifier travels in the link to the brand. |
| Keep the Services secure, prevent fraud and abuse, fix errors | Technical data, security events | Legitimate interests (protecting our users and systems). |
| Analyse use of the Services and improve them | Cookie and analytics data | Consent (analytics cookies and similar technologies); legitimate interests for aggregated, non-cookie measurement. |
| Send service messages (sign-in links, receipts, back-in-stock alerts you requested) | Account data, shopping activity | Contract; legitimate interests. |
| Send our newsletter and marketing | Email address, name | Consent (you can withdraw it at any time using the unsubscribe link). |
| Monitor and improve the quality and safety of our AI features | Moda conversations and AI requests, in the least identifying form we can | Legitimate interests (making AI outputs accurate and safe). |
| Comply with the law, respond to legal requests, and establish or defend legal claims | Any data needed | Legal obligation; legitimate interests. |
Where we rely on legitimate interests, we have balanced them against your rights and interests. You can ask us about that balancing exercise at any time.
4. AI features and automated processing
Moda and our recommendation, outfit-matching and virtual styling features use generative and machine-learning models. To produce a response, the content of your message and the profile preferences relevant to it are sent to our AI providers, currently Google (Gemini models) and, for some features, OpenAI. They process it on our behalf and under contracts that restrict their use of it.
- Do not put sensitive or confidential information in chats or uploads. Content you enter may be used to generate a response and is stored in your chat history.
- AI output can be wrong or out of date. Sizing, fit, availability and price information is indicative only and should be checked with the partner brand before you buy.
- Virtual models and virtual try-on previews are synthetic images used for styling reference. Partner product photographs show the real goods.
- We do not use AI to make decisions that produce legal or similarly significant effects about you. Personalisation affects what is shown to you and in what order, not your access to the Services or the price you pay.
- We use conversation and request data, in the least identifying form we can, to measure and improve the quality of our AI features. We do not use your content to train third-party foundation models.
6. Partner brands and affiliate links
tasc does not sell products or take payment for them. When you choose to buy, we send you to the partner brand, directly or through an affiliate network such as Awin or Rakuten Advertising. The brand (and the network, where used) then collects and uses your data under its own privacy notice, including for your order, delivery and returns.
We do not share your name, email address, style profile or Moda conversations with partner brands. We receive back from the brand or network confirmation that a sale occurred, its value and the commission due.
8. International transfers
Our infrastructure is hosted with Google Cloud in the United States, and several of our providers are based in or process data in the United States. Where we transfer personal data outside the UK, we do so only with a lawful transfer mechanism: an adequacy regulation (including the UK-US data bridge for certified recipients), or the International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses, together with appropriate safeguards. You can contact us for details of the safeguards for a particular provider.
9. How long we keep your data
We keep personal data only as long as we need it for the purposes in this notice, and then delete or anonymise it. The periods below are those we apply today.
| Data | How long |
|---|---|
| Account and style profile | While your account is open. When you delete your account in the app, your sign-in credentials and profile details are removed. We keep a minimal deactivated account record (identifier, email address and name) until you ask us to erase it; email us and we will. |
| Moda conversations and wardrobe content | While your account is open, so you can return to earlier conversations and items. You can ask us to delete them at any time. |
| Security and authentication logs | For as long as needed for security and fraud prevention, which we keep under review. |
| Affiliate click and commission records | Up to six years from the end of the financial year in which they arose, to meet tax and accounting obligations. |
| Payment and invoice records | Six years from the end of the financial year (UK tax law). |
| Newsletter subscription | Until you unsubscribe, then a suppression record so we do not email you again. |
| Analytics data | In line with our analytics retention setting, and in any case no longer than 14 months. |
| Support correspondence | Up to three years after the matter is closed. |
10. How we protect your data
We use measures appropriate to the risk, including encryption in transit (HTTPS), encryption at rest in our cloud infrastructure, authentication through a managed identity provider, role-based access so that only staff who need data can reach it, hashing of IP and user-agent values in affiliate click records, and logging of administrative actions. No online service is completely secure. If a breach is likely to put your rights at risk, we will tell you and the Information Commissioner's Office as the law requires.
11. Your rights
Under UK data protection law you have the right to:
- be informed about how we use your data (this notice);
- access a copy of your personal data;
- correct data that is inaccurate or incomplete;
- erase your data in certain circumstances;
- restrict our use of your data in certain circumstances;
- data portability, to receive data you gave us in a structured, commonly used format;
- object to processing based on legitimate interests, and to direct marketing at any time;
- withdraw consent at any time, where we rely on it, without affecting earlier processing; and
- not be subject to a decision based solely on automated processing that has legal or similarly significant effects.
To exercise a right, email support@tasc-fashion.ai, or use the account settings to edit your profile or delete your account. We may need to verify your identity first. We will respond within one month, which we may extend by up to two further months for complex requests, telling you why. There is normally no charge.
If you are unhappy with how we handle your data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk, telephone 0303 123 1113.
12. Merchants and the tasc Shopify app
If a store installs the tasc Shopify app, we act as a processor on that merchant's behalf for the store data we receive, and the merchant is the controller. Our responsibilities are set out in our Merchant Data Processing Terms. In summary:
- Catalogue data. We read product data (title, description, price, images, SKU, variants and inventory status) to sync the merchant's catalogue. The app reads your products, orders and inventory, and has limited write access to products and files, which tasc Studio uses only when you or your staff edit a product or add images from Studio. It does not create or edit orders.
- Order attribution. Where a merchant enables order attribution, we receive order notifications from Shopify and keep only the order identifier, order total and currency, and each line item's product, quantity and price, to match a sale to an earlier widget click. We do not store the shopper's name, email address, telephone number or shipping or billing address.
- Merchant staff. When a store staff member uses the app, Shopify gives us basic details of that user (such as name, email address, locale and whether they are the account owner) so we can sign them in. For this limited account data we are an independent controller and use it under this notice.
Shoppers on a merchant's store who have questions about that store's data should contact the merchant. We will help the merchant respond to requests.
13. Children
The Services are not directed at anyone under 16, and you must be at least 16 to create an account. If we learn that we hold data about a child under 16 without a parent or guardian's consent, we will delete it. If you believe this has happened, please contact us.
14. Changes to this notice
We may update this notice as the Services or the law change. The date at the top shows when it was last updated. If we make a material change, we will tell you by email or in the Services before it takes effect.
15. Contact us
Questions or requests about your personal data: support@tasc-fashion.ai. General enquiries: support@tasc-fashion.ai.