Our Privacy Policy

Effective date: August 4, 2026
Last updated: September 27, 2026

1. Scope

This Privacy Policy explains how Baroque Labs, Inc. ("Baroque Labs," "Delaits," "we," "us," or "our") collects, uses, and shares information when you use the Delaits mobile app and website (together, the "Service"). It applies to everyone who uses the Service.

Please also read our Terms of Service, which govern your use of Delaits.

2. Who operates Delaits

Delaits is offered by Baroque Labs, Inc. If you have questions about this policy or how we handle your information, contact us at contact@delaits.com.

3. Information you provide

Depending on how you use Delaits, you may give us:

• Account information — the email address and authentication information you use to sign in.
• Mirror-selfie photos — see Section 4, which explains exactly what happens to these before we ever receive anything.
• Context you choose to share — photos and other images, preferences, and other details you provide to help tailor styling responses.
• Spoken input — if you provide information by talking instead of typing. See Section 5.
• Approximate location, local time, and weather — added automatically when you allow it, to make advice more relevant to where and when you are. See Section 6.
• Marketing preference — whether you'd like to receive marketing emails from us. See Section 10.
• Communications and requests — messages, feedback, support requests, notification preferences, and other information you choose to provide when you communicate with us.
• Purchase information — if you make a purchase, we may receive information such as your subscription status, product purchased, transaction identifier, and purchase or renewal date from the platform processing the payment. We do not receive your full payment-card details from an app marketplace.
• Website signup information — if you sign up for Delaits updates on our website, we collect your email address and basic source, device, and connection-derived information, such as how you reached us, browser type, and a coarse country. We do not intentionally save your IP address as part of your signup record, although our hosting and security providers may process connection information when operating and protecting the website.

4. Mirror-selfie processing — our core privacy commitment

This is the most important thing to know about how Delaits handles your information, so we want to be precise about it:

• When you take a mirror selfie, your phone processes the photo before the photo is uploaded to Delaits.
• Your face is blurred on your device, before upload.
• The app also runs an on-device check for sensitive content. If the check flags the image, Delaits blocks the upload.
• The raw, unedited photo never leaves your phone. Our servers only ever receive the cleaned (face-blurred) version.
• Delaits does not use facial information to identify or authenticate you or to create biometric identifiers or face-based profiles.

That is the specific guarantee we make about your mirror selfie, and we want to be equally clear about what it does not mean. It does not mean that no personal information ever reaches our servers — the cleaned photo, and the styling response we generate from it, are stored so the Service can work (see Section 3, Section 6, and Section 11). It does not mean uploaded images are anonymous, or that we can't identify who an image belongs to — your account is linked to your activity, as described in Section 8. And like any online service, we can't promise our systems are perfectly secure or that access to information is never possible (see Section 13). What we do promise is what's stated above: the raw capture stays on your device, and your face is blurred before the cleaned image is ever uploaded.

5. Voice transcription

If you provide spoken input instead of typing, your voice is processed in real time by a transcription provider to produce a transcript. We do not store the audio itself.

We may keep the resulting text transcript and related context extracted from it so we can provide and improve Delaits.

6. Context and session information

To make advice more relevant, Delaits may use:

• Approximate location information (if you allow location access), used to inform styling responses and relevant weather context.
• Local time and time zone, so styling responses can reflect time context.
• Weather information for your area.

These are optional. You can remove or refresh this information through available controls, and location access can be turned off at any time in your device settings.

We also keep styling responses and related session information, including submitted context and your interactions with responses, so Delaits can provide a coherent experience over the course of a session.

7. Information collected automatically

• Account and device identifiers needed to authenticate you and keep your session secure.
• Product usage information — how you use Delaits and move through it, so we can understand what's working and improve the Service.
• Crash and diagnostic information, so we can find and fix bugs.
• Local app storage on your device needed to operate and secure the Service.

We do not use this information to serve you targeted advertising. Our website may use cookies, local storage, or similar technical measures that are necessary to protect forms, prevent abuse, and maintain website security. We do not use these technologies for targeted advertising.

8. How we use information

We use the information described above to:

• Provide styling responses and maintain related sessions.
• Create and secure your account and apply access controls designed to limit each account to its own account-linked data.
• Respond to communications and requests you send us.
• Administer purchases and subscriptions.
• Provide service communications and, if you've opted in, send marketing communications.
• Understand how Delaits is used, fix problems, and improve the product — including developing and training the AI and machine-learning models that power styling responses.
• Detect, investigate, and prevent fraud, abuse, and security issues.
• Meet legal obligations and enforce our Terms of Service.

If you're in a jurisdiction that requires a stated legal basis for processing (such as the European Economic Area or United Kingdom), we rely on: performing our contract with you (providing Delaits and its styling responses), your consent (for example, marketing emails, spoken input, and location access), our legitimate interests (such as keeping Delaits secure and improving it), and compliance with legal obligations.

9. Service providers and disclosures

We share information with service providers that help us operate Delaits, such as providers of:

• Hosting, storage, and authentication
• AI processing and transcription
• Analytics, diagnostics, and website security
• Location-based context
• App marketplace and payment-processing services

Some Delaits features use third-party AI service providers. When you use those features, information needed to provide the requested feature may be sent to those providers, including processed images, context you submit, and spoken input.

We require these providers to protect personal information and limit their use of it to providing services to us, subject to their agreements with us and applicable law. Their systems may retain information for limited operational, security, legal, or backup purposes.

If you make a purchase, we also share purchase information with the app marketplace or payment provider through which you make the purchase.

We may also disclose information where required by law, to protect the rights, safety, or property of Baroque Labs or others, or in connection with a merger, acquisition, or sale of assets.

We do not sell personal information, and we do not use your information for cross-context behavioral advertising.

10. Marketing communications

You can choose to receive marketing emails from Delaits. That choice is:

• Optional — nothing about using Delaits requires it.
• Off by default.
• Yours to change at any time from within the app.
• Also changeable by using the unsubscribe link included in any marketing email you receive from us.

Turning marketing emails off does not stop us from sending you communications we need to send — like account, service, privacy, or security notices.

11. Data retention

We keep information for as long as it's needed for the purposes described in this policy: to provide the Service, to maintain your account and styling history while your account is active, and to meet legal, security, and operational needs.

When information is no longer needed, we may delete it or convert it into an aggregated or deidentified form. We may retain and use that information as permitted by law and will not attempt to reidentify it except where required or permitted by law.

Delaits does not retain the original, unedited version of a mirror selfie because that version is not uploaded to us. Processed images submitted to Delaits are retained in accordance with the practices described above and the account-deletion practices in Section 12.

12. Account deletion

You can initiate deletion of your Delaits account at any time from within the app. We then delete your account and the data linked to it from our active systems.

Some information may remain for a limited time after that — for example, in backups, security or fraud-prevention logs, records we're required to keep by law, or copies our service providers retain under their own operational or backup processes. We don't use that residual information for anything beyond those purposes, and it isn't restored to an active account.

If information was previously used to develop or improve a model, deleting your account may not automatically reverse changes already made to that model, except where applicable law requires otherwise.

13. Data security

We use administrative, technical, and organizational safeguards designed to protect your information.

No method of transmission or storage is completely secure, and we can't guarantee the absolute security of your information.

14. International data transfers

Baroque Labs is a United States company, and our service providers may process information in the United States and other countries. Where we transfer information out of the European Economic Area, the United Kingdom, or Switzerland, we use appropriate safeguards recognized under applicable law.

15. Privacy rights

Depending on where you live, you may have rights over your personal information, which can include the right to:

• Know what personal information we hold about you and how we use it.
• Access a copy of your personal information.
• Correct inaccurate information.
• Delete your personal information.
• Object to or restrict certain processing.
• Receive your information in a portable format.
• Withdraw consent, where processing is based on consent (for example, marketing emails or location access).

If you live in California or another state in the United States with an applicable consumer privacy law, you may have additional rights under that law. As noted in Section 9, we do not sell personal information or use it for cross-context behavioral advertising.

If you're in the United Kingdom, European Economic Area, or Switzerland, you may have additional rights under applicable data-protection laws, including the right to lodge a complaint with the relevant data-protection authority.

These rights aren't absolute and may be subject to legal limitations.

16. How to submit a privacy request

To exercise any of the rights above, email us at contact@delaits.com. We may need to verify your identity before completing your request, and we'll respond within the timeframe required by applicable law.

17. Children's privacy

Delaits is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has provided us with personal information, contact us at contact@delaits.com, and we will take appropriate steps to delete it.

Users who are under the age of legal majority where they live should use Delaits only with the permission of a parent or legal guardian.

18. Third-party links and services

Delaits may reference or link to third-party services. We aren't responsible for the privacy practices of those third parties, and this policy doesn't cover them.

19. Changes to this Privacy Policy

We may update this policy from time to time. If we make material changes, we'll update the "Last updated" date above and, where appropriate, notify you.

20. Contact information

Questions, concerns, or privacy requests: contact@delaits.com

21. Effective and last-updated dates

This policy is effective as of August 4, 2026, and was last updated on September 27, 2026.