Privacy Policy
Kiwi is an AI-powered wardrobe and personal stylist app. This policy explains what personal data we collect, why we collect it, and how we use and protect it.
1Who We Are
Kiwi is an AI-powered wardrobe and personal stylist app. When you use Kiwi, the company responsible for your personal data — your "data controller" — is:
Kiwi
Contact: privacy@kiwifits.com
If you are located in the European Economic Area (EEA) or the United Kingdom, and we are not yet established in your jurisdiction, Kiwi acts as the data controller. We are in the process of designating an EU and UK representative as required under GDPR Art. 27 and UK GDPR Art. 27. This will be confirmed before we actively market to users in the EEA or UK.
This policy applies to:
- The Kiwi iOS app
- The Kiwi Android app
- The Kiwi web interface
- Any related services
2What Data We Collect and Why
We only collect data we actually need to run the app and make it useful for you. Here's what that means in practice.
2.1Wardrobe Photos
When you add items to your digital closet, you upload photos of your clothing. These photos may incidentally capture your body, face, hands, or home environment. We send these photos to Google's Gemini AI service, which extracts information about each clothing item (type, color, material, style). We then store the extracted item information in your wardrobe, and the original photo is kept in secure cloud storage.
Why: The core function of Kiwi — building your digital wardrobe and generating outfit recommendations — depends on understanding what clothes you own. Photo analysis is how we do that at scale.
Important: Your photos may capture more than just clothing. Please see our AI & Sensitive Data Processing Addendum for full details on how photos are handled and how to request deletion.
2.2Voice Conversations with Your AI Stylist
When you chat with your AI stylist, we record and store the transcript of every conversation turn — both in your original language and in English (which we use as our internal processing language for the AI). We do not record audio by default. Audio files are only stored during engineering debugging sessions by Kiwi engineers, and only with explicit prior consent.
Why: We need conversation transcripts to power the AI stylist, maintain context between sessions, and allow our team to review conversation quality and fix issues.
2.3Stylist Memory — Your Preferences and Patterns
Your AI stylist learns about you over time. It builds a personal "memory" that captures your style preferences, items you want to avoid, how you describe your style, and patterns it notices across your conversations (including signals about how you feel about your wardrobe). This memory lives in your account and is used to personalize your styling sessions.
Why: Without persistent memory, every conversation with the stylist would start from scratch. The memory is what makes the experience feel like it knows you.
Your right: You can request a copy of your stylist memory or ask us to delete it at any time by emailing privacy@kiwifits.com.
2.4Your Profile Information
During onboarding you tell us your preferred name (optional), gender (used for catalog filtering), age range (used for catalog filtering), and preferred language. You may also add a profile photo.
Why: Your gender and age range are used to filter the product catalog to items relevant to you.
2.5Style Preferences, Swipe Decisions, and Lookbook
As you use the app — swiping through catalog items, saving outfits, logging what you wear — we collect your decisions and preferences. Your lookbook includes outfit combinations, worn dates, and any notes you add.
Why: This is how we learn your taste and improve recommendations over time. It's also the record of your personal style history.
2.6Device ID
When you first install Kiwi, we generate a random identifier for your device (a "Device ID"). This ID is used to link your activity in the app to backend logs and crash reports, so we can diagnose technical issues.
Why: When something goes wrong in the app, the Device ID is our way of finding the relevant log entries and crash data to fix the problem.
2.7Analytics Events
We collect anonymized behavioral data about how you use the app — which screens you visit, which features you tap, and where you drop off in the onboarding flow. This data is tied to your Device ID, not your name or email.
Why: Understanding how people use Kiwi helps us improve it. We use Firebase Analytics for this purpose.
Your right: An analytics opt-out toggle is coming to the app. Until it is available, you can opt out of analytics collection by contacting us at privacy@kiwifits.com.
2.8Crash and Error Reports
If the app crashes or encounters an error, we automatically collect a crash report including the error details, your device model and operating system version, and your Device ID.
Why: Crash reports are how we find and fix bugs to keep the app stable.
2.9Push Notification Tokens
If you grant notification permission, we collect a push notification token to send you notifications (such as stylist responses or outfit reminders). You can revoke notification permission at any time in your device settings.
3Legal Basis for Processing (GDPR)
This section is specifically for users in the EEA, UK, and Switzerland. Under the GDPR (and UK GDPR), we must have a legal basis for every type of data processing we do. Here is ours:
| Processing activity | Legal basis | Notes |
|---|---|---|
| Wardrobe photo analysis | Art. 6(1)(b) — Contract | Core feature you signed up for |
| Wardrobe photo storage | Art. 6(1)(b) — Contract | Required to power your closet |
| Incidental biometric data in photos (body/face) | Art. 6(1)(a) — Consent + Art. 9(2)(a) | An explicit in-app consent screen for photo analysis will be added before our EU launch. |
| Voice transcript storage | Art. 6(1)(b) — Contract | Core stylist feature |
| Transcript quality review by admins | Art. 6(1)(f) — Legitimate interest | Product safety and quality |
| Stylist memory — personalization | Art. 6(1)(b) — Contract | Core personalization |
| Stylist memory — emotional pattern inference | Art. 6(1)(a) — Consent + Art. 9(2)(a) | An explicit in-app consent screen for emotional pattern inference will be added before our EU launch. |
| User profile data | Art. 6(1)(b) — Contract | Account creation |
| Style preferences and lookbook | Art. 6(1)(b) — Contract | Core feature |
| Device ID | Art. 6(1)(f) — Legitimate interest | Debugging and security |
| Analytics events | Art. 6(1)(f) — Legitimate interest | Product improvement. Opt-out available by contacting privacy@kiwifits.com; in-app toggle coming. |
| Crash reports | Art. 6(1)(f) — Legitimate interest | Product stability |
| Push notifications | Art. 6(1)(a) — Consent | You grant this via device permission |
| Debug audio (if enabled) | Art. 6(1)(a) — Consent + Art. 9(2)(a) | Explicit consent required before any audio capture |
Legitimate interest balancing: Where we rely on legitimate interest, we have assessed that our interest in providing a stable, high-quality app is not overridden by your privacy interests, particularly because the data involved is limited in scope and we take steps to minimize it. You have the right to object to legitimate-interest processing at any time (see Section 7a).
4How Long We Keep Your Data
We keep your data for as long as we need it to provide the service, and then delete it.
| Data type | Retention period |
|---|---|
| Wardrobe photos | Duration of account + 30 days after deletion |
| Extracted wardrobe item data | Duration of account + 30 days after deletion |
| Voice transcripts | 12 months |
| Stylist memory | Duration of account + 30 days after deletion |
| User profile | Duration of account + 30 days after deletion |
| Style preferences and lookbook | Duration of account + 30 days after deletion |
| Analytics events | 14 months (Firebase Analytics default) |
| Crash reports | 90 days (Firebase Crashlytics default) |
| Debug audio files | Not collected by default. If collected in engineering debug mode: deleted within 30 days. |
| Backend server logs | 90 days (Google Cloud Logging default) |
| Push notification tokens | Until revoked or token expires |
When you delete your account, we delete your personal data within 30 days, except where we are required to retain it for legal or regulatory reasons.
We are building automated deletion of photo files from cloud storage when an account is deleted. This will be in place before our EU launch. To confirm your photos have been removed after deleting your account, email privacy@kiwifits.com.
5Who We Share Your Data With
We do not sell your personal data. We do not share it with advertisers. We share it only with the technology companies that help us run the app (our "sub-processors"), and only to the extent necessary.
Our Sub-Processors
| Provider | What they do for us | Data they process | More info |
|---|---|---|---|
| Google Cloud Platform (includes Firebase Auth, Firestore, Cloud Storage, Gemini API, Translation API, Text-to-Speech, Cloud Logging, Analytics, Crashlytics, Cloud Messaging) | Database, AI analysis, push notifications, analytics, crash reporting, voice synthesis, translation | All user data, wardrobe photos, conversation transcripts | Google Cloud DPA |
We maintain written data processing agreements (DPAs) with all data processors. Google Cloud services are covered by the Google Cloud Data Processing Addendum.
Legal Disclosures
We may disclose your data to law enforcement, courts, or government authorities if we are legally required to do so — for example, in response to a court order or subpoena. We will notify you of such requests if we are legally permitted to do so.
6International Data Transfers
Kiwi is a US-based company. Your data is processed and stored primarily in the United States. If you are located in the EEA or UK, this means your data is transferred to a country that the European Commission has not designated as providing an adequate level of protection.
We protect your data during these transfers by using the Standard Contractual Clauses (SCCs) approved by the European Commission (for EEA → US transfers) and the UK International Data Transfer Addendum (for UK → US transfers). These are legal contracts that bind our processors to protect your data to the same standard as in the EU and UK.
All Google Cloud services used by Kiwi are covered by Standard Contractual Clauses (Module 2: Controller to Processor, European Commission Decision of 4 June 2021), incorporated via Google's Data Processing Addendum.
7Your Rights
7a. GDPR Rights (EEA, UK, Switzerland)
If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights under the GDPR and UK GDPR. You can exercise any of these rights by contacting us at privacy@kiwifits.com.
Right of access (Art. 15): You can ask us for a copy of all personal data we hold about you, including your wardrobe data, transcripts, stylist memory, and profile information. An in-app transcript history view is coming before our EU launch. Until then, you can request your full transcript history or ask us to delete it by emailing privacy@kiwifits.com.
Right to rectification (Art. 16): If any of your data is inaccurate or incomplete, you can ask us to correct it.
Right to erasure / "right to be forgotten" (Art. 17): You can delete your account directly in the app (Settings → Delete Account). This deletes your profile, wardrobe, stylist memory, and conversation history. An in-app deletion flow is coming; until then, email privacy@kiwifits.com with subject "Delete my account" and we will process it within 30 days. Some exceptions apply (for example, if we are required to retain data for legal reasons).
Right to restriction of processing (Art. 18): You can ask us to stop processing your data in certain circumstances — for example, if you contest the accuracy of the data while we verify it.
Right to data portability (Art. 20): You can ask us to give you your personal data in a machine-readable format, or to transfer it directly to another controller, where technically feasible.
Right to object (Art. 21): You have the right to object to processing based on legitimate interest (including analytics, crash reporting, and the use of your Device ID for debugging). We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests.
Right not to be subject to solely automated decisions (Art. 22): We do not make decisions about you that produce legal or significant effects based solely on automated processing. Our AI stylist makes outfit recommendations — you always have the final say. See Section 9 and the AI Addendum for more detail.
Right to withdraw consent: Where we rely on your consent as the legal basis for processing (such as for push notifications), you can withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
Right to lodge a complaint: If you are unhappy with how we handle your data, you have the right to lodge a complaint with your local data protection authority:
- EU: Your national DPA (find yours at edpb.europa.eu)
- UK: The Information Commissioner's Office (ICO): ico.org.uk
- Australia: The Office of the Australian Information Commissioner (OAIC): oaic.gov.au
We would appreciate the opportunity to address your concern directly before you contact a regulator — please email us at privacy@kiwifits.com first.
Response timelines: We will respond to all rights requests within one calendar month. In complex cases, we may extend this to three months and will notify you of the extension.
7b. California Rights (CCPA/CPRA)
If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) gives you the following rights.
Right to know (CCPA § 1798.100): You can ask us what personal information we have collected about you in the past 12 months, where we collected it from, why we use it, and who we share it with.
Right to delete (CCPA § 1798.105): You can ask us to delete your personal information. We will do so, subject to certain exceptions (for example, where we need the information to complete a transaction you requested).
Right to correct (CPRA § 1798.106): You can ask us to correct inaccurate personal information we hold about you.
Right to opt out of the sale or sharing of personal information (CCPA § 1798.120): We do not sell your personal information. We do not share it for cross-context behavioral advertising purposes. You do not need to opt out of a practice we do not engage in.
Right to limit use of sensitive personal information (CPRA § 1798.121): You have the right to direct us to limit our use of your "sensitive personal information" to the uses necessary to provide the services you requested. Sensitive personal information we process includes: your device identifier (used for account identification), wardrobe photos (which may reveal characteristics about you), voice transcripts, and inferred personal characteristics (stylist memory including emotional patterns). We use this information only to provide the Kiwi service to you. We do not use it for any secondary purposes without your explicit consent.
Right to non-discrimination (CCPA § 1798.125): We will not discriminate against you for exercising your CCPA rights. We will not deny you services, charge you different prices, or provide a different quality of service because you exercised your privacy rights.
How to submit a California privacy request: Email us at privacy@kiwifits.com with the subject line "California Privacy Rights Request" and describe what you would like us to do. We will verify your identity and respond within 45 days. We may extend this by an additional 45 days with notice if needed.
Categories of sources: We collect your personal information (a) directly from you when you use the app, (b) automatically from your device (device identifier, analytics events, crash reports), and (c) through AI analysis of content you provide (wardrobe photos, voice conversations).
Categories of personal information collected: Please see Section 2 for a full description. Under CCPA categories, we collect: Identifiers (Device ID); Personal records (profile, wardrobe data); Characteristics of protected classifications (gender, age range — voluntary, self-declared); Commercial information (style preferences, lookbook, swipe decisions); Internet or network activity (analytics events); Audio/visual information (wardrobe photos, voice transcripts); Inferences drawn to create a profile (stylist memory).
Data "sale" disclosure: We do not sell personal information as defined by the CCPA. We do not share personal information for cross-context behavioral advertising.
8Children's Privacy
Kiwi is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13. By creating an account, you represent that you are at least 13 years old.
We do not currently implement a technical age verification gate. We rely on users' self-representation of age during onboarding. We are evaluating additional age verification measures and will update this section before expanding to markets with stricter children's privacy requirements (such as the UK Age Appropriate Design Code).
If we become aware that we have inadvertently collected information from a child under 13, we will delete that information promptly. If you believe a child under 13 has provided us with personal information, please contact us at privacy@kiwifits.com.
For users aged 13–17: we recommend that you review this policy with a parent or guardian.
9AI and Automated Processing
Kiwi uses artificial intelligence in several core ways: to analyze your wardrobe photos, to power your AI stylist conversations, and to generate outfit recommendations.
We do not use your personal data to train AI models. Our agreement with Google Cloud prohibits Google from using your data to train or improve its AI models. Your wardrobe photos, voice transcripts, and conversation data are used solely to power your personal Kiwi experience.
We do not make any decisions about you that have legal or similarly significant effects based solely on automated processing. All AI outputs — outfit suggestions, style advice, wardrobe analysis — are recommendations that you can accept, ignore, or override. You always retain full control over your wardrobe and styling decisions.
For detailed information about our AI processing, including how Gemini analyzes your photos, how emotional patterns are inferred, how your voice data is handled, and how AI-generated recommendations work, please read our AI & Sensitive Data Processing Addendum.
10Security
We take the security of your data seriously. Here is how we protect it:
- Encryption in transit: All data transmitted between your device and our servers uses TLS encryption.
- Encryption at rest: Data stored in Google Cloud Firestore and Google Cloud Storage is encrypted at rest by Google.
- Access controls: Access to user data is restricted to Kiwi engineers who need it to do their jobs. We use Firebase authentication for all access.
- Signed URLs: Access to your wardrobe photos in cloud storage is controlled via short-lived signed URLs (5-minute expiry). Photos are not publicly accessible.
- Minimal data access: Our admin dashboard reads your data from Firestore to support ops and debugging, but does not write to your personal data.
No security system is perfect. If you believe your account has been compromised or you have identified a security vulnerability, please contact us immediately at privacy@kiwifits.com.
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach (as required by GDPR Art. 33), and notify affected users without undue delay where the breach poses a high risk (Art. 34). We are formalising our internal incident response procedures before our EU launch.
11Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will:
- Update the "Last updated" date at the top of this policy
- Notify you via a push notification or in-app message
- Where required by law, ask for your renewed consent
We encourage you to review this policy periodically. If you continue to use Kiwi after a policy update, that indicates your acceptance of the updated policy, to the extent permitted by applicable law.
The previous version of this policy (if any) is available on request by emailing privacy@kiwifits.com.
12Contact Us
For any questions about this Privacy Policy or to exercise any of your rights, contact us:
Email: privacy@kiwifits.com
If you are in the EU or UK and have a complaint we have not resolved, you may contact your national supervisory authority. Contact details for EU supervisory authorities are available at edpb.europa.eu. For the UK, contact the ICO at ico.org.uk.
Kiwi — AI-powered wardrobe and personal stylist.
Privacy Policy v1.0 | 2026-05-04
AI-assisted draft. Formal legal counsel review required before major market launch.