Privacy Policy

1. Introduction

Tarzi ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered fashion design platform ("Service"). Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the Service. Tarzi is operated by an individual, who is the controller of your personal information.

2. Information We Collect

2.1 Personal Information

We may collect personal information that you voluntarily provide to us when you register on the Service, including:

• Account Information: Email address, name, and profile picture (provided through authentication)
• Payment Information: Billing details and transaction history (processed securely by third-party payment providers)
• Communication Data: Any information you provide when contacting us for support

2.2 User-Generated Content

We collect and store content you create using our Service, including:

• AI-generated fashion designs and images
• Text prompts and design specifications you provide
• Images you upload for editing or reference
• Generated photoshoots and videos

2.3 Automatically Collected Information

When you are signed in, our servers record the following about each sign-in and each browser session:

• IP address and the country it belongs to. The country is derived on our own server from an offline database; your IP address is never sent to a third party for this.
• Device family (for example “iPhone · Safari” or “Windows · Chrome”). We do not keep the full browser fingerprint or user-agent string.
• Sign-in times, the time you were last active, and the number of times you have signed in. We also record account exports, bulk design and film deletions, and completed purchases with the time, action details and full IP address when a customer request is available.
• Generation records: what type of design was requested, when, how many credits it cost, and whether it succeeded or failed.
• Error records when something goes wrong on our side, which can include your account id and the page involved.

We do not use third-party analytics or advertising trackers.

Visitor counts on our public pages. Whether or not you are signed in, our public pages (the home page, About, FAQ, Contact and these policies) report each page view to our own server: the page, its language, whether it was the first page of your visit, a coarse device class (phone, tablet or desktop), the website that linked you to us and any campaign tags in the link (such as utm_source). Our server adds the country of your connection and a one-way code derived from your address with a key that changes every day; it keeps neither the address nor your browser details, and the key is deleted after 2 days, so a visitor cannot be recognised from one day to the next. Nothing is reported when your browser sends the Global Privacy Control signal. How you arrived is also kept in your browser for the current tab only; if you create an account during that visit, it is recorded on the new account (for example “came from Instagram”) so we know which channels bring designers to Tarzi. These counts are seen only by our own team.

Feature usage in the studio. When you are signed in, the studio reports to our own server which of its controls you use and from which part of the studio: for example that a film was started from a card's shortcut rather than its menu, which picture ratio, batch size, film length, model preset or photoshoot pack was chosen, and which gallery filters were used. Each report is tied to your account and carries only the name of the control and the option chosen, never what you wrote, searched for, uploaded or made. We use these counts, viewed only by our own team, to decide which features to place where and what to improve. Nothing is reported when your browser sends the Global Privacy Control signal.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Provide the Service: To create and manage your account, process your design requests, and deliver our features
• Improve the Service: To improve design quality and reliability using anonymized and aggregated data
• Process Payments: To handle credit purchases and maintain transaction records
• Communicate: To send service updates, respond to inquiries, and provide customer support
• Security and account-sharing detection: Each account is for one person (see our Terms). We compare the sign-in records above, for example the same account active from two countries at the same time, or many different networks and devices within a day, to flag possible sharing, fraud or compromised accounts. A flag is only reviewed by a human; no account is suspended automatically.
• Service analytics: To understand usage, revenue and reliability. These figures are aggregated on our own servers.
• Legal Compliance: To comply with applicable laws and regulations
• Content review for safety and abuse: Our team may review the designs, films and prompts in an account when an automated content check, a report, an appeal, or unusual activity suggests misuse, or when the law requires it. Each such access is recorded with the staff member and the time; reviews opened through our review tool also record the reason. We do not browse accounts routinely, and we never use your content for marketing.

Where EU or UK data-protection law applies, our legal bases are: performance of our contract with you (providing the Service and processing payments), our legitimate interests (keeping the Service secure, investigating abuse, preventing account sharing and fraud, and understanding how the Service performs), legal obligations (including legal requests, tax and accounting records), and your consent where we ask for it.

4. Third-Party Services

We use the following third-party services to operate our platform:

5. Data Retention

We retain your personal information and generated content for as long as your account is active or as needed to provide you services. Specifically:

• Account Data: Retained until you delete your account
• Generated Designs: Stored while your account is active, unless you delete them
• Payment Records: Records remain while your account is active. After account deletion they are anonymised and deleted once 7 years have passed since each record was created (or on the next hourly sweep if already older).
• Sign-in records and account activity (including IP addresses): deleted automatically after 90 days; prior activity is erased with your account
• Session activity used for account-sharing detection: deleted automatically after 30 days
• Last known IP address on the account: cleared after 90 days without a sign-in
• Security flags: kept while open, then 365 days after review
• Error and uptime records: 30 days
• Support messages: 365 days after they are handled, and deleted with your account
• Deleted designs and films: removed from your account the moment you delete them; the stored files are purged within 7 days, and database backups that may still hold them expire within 14 days. Deleting your account removes everything still in it at once and brings forward cleanup of earlier-deleted files that we can associate with your account.
• Film generation provider: The provider's documentation states that generated media is stored on its side for 14 days. This is separate from retention in your Tarzi account.
• Page-view counts on public pages: kept for 730 days as anonymous counts; the daily key behind the visitor code is deleted after 2 days, after which no count can be matched to a browser
• Feature-usage reports from the studio: kept for 395 days, then deleted; they are deleted at once when you delete your account and are included in your account export

After account deletion, we may retain anonymized data for analytics and service improvement purposes.

6. Data Security

We implement appropriate technical and organizational security measures to protect your personal information, including encryption in transit (HTTPS), secure authentication, and access controls. However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

7. Your Rights (GDPR & CCPA)

Depending on your location, you may have the following rights regarding your personal data:

• Right to Access: Request a copy of the personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data ("right to be forgotten")
• Right to Restrict Processing: Request limitation of how we process your data
• Right to Data Portability: Request transfer of your data in a machine-readable format
• Right to Object: Object to processing of your personal data for certain purposes
• Right to Withdraw Consent: Withdraw consent at any time where we rely on consent for processing

You can exercise the two most common rights yourself, at any time, without asking us: open the studio, choose your profile picture, then Privacy & data.

For every other request (correction, restriction, objection, or questions about a security flag), contact us using the details below. We respond within 30 days. You also have the right to lodge a complaint with your local data-protection authority.

8. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that are different from the laws of your country. We take appropriate safeguards to ensure that your personal information remains protected in accordance with this Privacy Policy when transferred internationally.

9. Children's Privacy

Our Service is not intended for individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal information from a child under 16, we will take steps to delete that information promptly.

10. Cookies and Tracking

We use cookies and similar tracking technologies to:

• Maintain your session and authentication state (a strictly necessary session cookie)
• Remember your preferences (such as dark mode setting) in your browser’s local storage
• Remember, in your browser’s session storage for the current tab only, how you arrived at the site (the referring website and campaign tags), so an account created during that visit can be attributed to it

We set no advertising or third-party analytics cookies, which is why the Service shows no cookie banner.

You can control cookies through your browser settings. However, disabling cookies may affect the functionality of our Service.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

12. Contact Us

If you have any questions about this Privacy Policy, your data, or would like to exercise your rights, please contact us at:

If you are located in the European Union and believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection supervisory authority.