Privacy policy

Processing of personal data in accordance with the GDPR and the French Data Protection Act.

1. Data controller

The data controller is Emelva, société par actions simplifiée unipersonnelle with share capital of €1,000, currently being registered with the Commercial and Companies Register (RCS) of Compiègne, whose registered office is at 9 rue Notre-Dame de Bon Secours, 60200 Compiègne, France. SIREN and intra-EU VAT number pending allocation. The company is represented by Vincent Darsonville (see the legal notice). For any question about your data: hello@emelva.com.

2. Data collected

• Customer: full-length photo and generated silhouette, looks tried on, size, favourites, messaging exchanges, and, if she asked for it, her consent to hear about a shop’s price drops.
• Shop: business contact details, shopfront information, billing data.
• Shop on the waiting list: shop name, town, e-mail, free-text message, and where the visit came from (the link or campaign that brought it to the site, read from the page address — nothing is stored on the device).
• Individual on the private wardrobe waiting list: e-mail and, if she gives them, first name, town and free-text message; page language and where the visit came from, as above. A list separate from the shops’ one.
• Signing in with Google, if you choose it: Google sends us your name, your email address (and the fact that it is verified) and your profile picture. We only keep the first name and the email address; we have no access to your contacts, your mailbox or any other data in your Google account. Google, for its part, knows that you use this account to sign in to Emelva.
• Technical: connection data and cookies necessary for the service to work (see the Cookie policy).

3. Purposes and legal bases

• Providing the virtual fitting room, performance of the service / consent for the photo;
• Filling the shop’s customer file and enabling the commercial relationship, legitimate interest;
• Managing subscriptions and billing, performance of the contract;
• Sending alerts and reports, consent / legitimate interest;
• Letting a customer know, at her shop’s initiative, that a piece among her favourites has dropped in price (a message in her space and an e-mail), consent given to each shop separately and withdrawable at any time, from her space or in one click from any such e-mail;
• Telling shops on the waiting list when we open, sending them news about Emelva until then (one e-mail a month at most) and knowing which channels bring them, consent;
• Telling individuals on the private wardrobe waiting list in the same way (one e-mail a month at most), consent;
• Complying with legal and accounting obligations, legal obligation.

4. The photo and the silhouette, a special case

The photo provided by the customer is used solely to generate her fitting silhouette and the renderings she asks for. It stays private: Emelva never publishes it — only the customer may choose to share a rendering, and a shop sees only what the customer does in its own space. To produce each try-on, the photo or the silhouette is passed to the artificial-intelligence providers named in section 6, strictly for that generation. Processing is based on explicit consent, obtained before any transmission and withdrawable at any time from the customer’s own space.

5. Retention period

Data is kept for as long as the purposes require: the photo and the silhouette until the account is deleted or after 24 months of inactivity; billing data for the legal retention period; customer-file data for as long as the relationship with the shop is active; waiting-list sign-ups (shops and private wardrobe) until unsubscription or account opening, and at most three years after the last exchange.

6. Recipients and processors

The data is accessible to the publisher and, for the customer file, to the shop concerned. The following processors are involved strictly within the scope of the service, under a GDPR-compliant contract:

• Generating try-ons, imagery and videos: OpenAI (United States), FASHN AI (United States) and Seedance (United States) receive the photo or the silhouette for as long as it takes to produce the requested rendering;
• Hosting and storage: Vercel (application), Neon (database, hosted in the European Union — Frankfurt), Cloudflare (image storage, Western Europe);
• Payments: Stripe — Emelva neither sees nor stores any card number;
• E-mails: Brevo (European Union).

No data is sold to third parties.

7. Your rights

You have rights of access, rectification, erasure, restriction, objection and portability, as well as the right to withdraw your consent and to give post-mortem instructions. A customer can exercise them directly from her own space: “Download my data” (a complete export in JSON format) and “Delete all my data” (immediate erasure of the account, the images and the conversations, with no human involvement). You may also write to hello@emelva.com. You may also lodge a complaint with the French data protection authority, the CNIL (cnil.fr).

8. Security

The publisher implements appropriate technical and organisational measures to protect the data: encryption in transit, access to images subject to authorisation and checked on every request, strict separation between shops, and transmission to AI providers limited to the duration of the requested generation. A customer’s photo is never accessible to her shop.

9. Transfers outside the EU

The database is hosted in the European Union. Generating try-ons, however, involves transferring images to providers located in the United States (OpenAI, FASHN AI, Seedance — section 6), for as long as it takes to produce the rendering. These transfers are covered by appropriate safeguards: the European Commission’s standard contractual clauses and, for certified providers, the EU–US Data Privacy Framework. No other transfer outside the EU takes place.