Introduction

This privacy policy explains how Talastron Ltd (trading as Atelier — “we”, “us”, “our”) collects, uses, and protects your personal data when you use our service at myatelier.style and the application at edit.myatelier.style (together, the “Service”).

We take your privacy seriously. Your wardrobe is a personal collection, and the data you entrust to us is treated with the same care.

Who we are

Atelier is a product of Talastron Ltd, a private limited company registered in England & Wales.

Company name: Talastron Ltd
Company number: 15464691
VAT number: GB 463 5874 58
Registered office: The Long Barn, Cobham Park Road, Cobham, Surrey, KT11 3NE, United Kingdom
Previously known as: Orion Data Analytics Ltd

Talastron Ltd is the data controller responsible for your personal data when you use the Service. For all data-protection enquiries, contact us at [email protected].

We are registered with the UK Information Commissioner’s Office (ICO) as a data controller under registration reference ZB804967.

What personal data we collect

We collect only the data we need to provide the Service:

Account data

Email address — required to create your account, sign you in, and contact you about your subscription.
Display name — your name as you choose to display it in the app; helps personalise the Service.
Authentication metadata — sign-in timestamps, sign-in method (Google, magic link), and an account identifier issued by Firebase Authentication.

Wardrobe content

The personal data you choose to upload as you use the Service:

Garment data — items you add to your wardrobe (brand, category, colour, materials, cost, notes, photos).
Wear logs — when you record having worn an item.
Outfits, lookbooks, and saved inspirations — collections you create.
Style profile — answers you provide to the optional style quiz.
Measurements — body measurements you optionally provide (such as height and general sizing) for AI fitting context.

Some photos you upload — inspiration images, or a photo of an outfit as worn — may include images of you or other people. Please only upload photos you have the right to use. We do not run facial recognition on your photos.

You own this content. We do not share it, sell it, or use it to train external machine-learning models.

Calendar data (optional)

If — and only if — you connect your Google Calendar, Atelier reads your upcoming events to give the AI stylist context about your week, so it can suggest outfits suited to what’s actually on (a meeting, a dinner, a quiet day in). Specifically:

We request read-only access to your Google Calendar.
We use the event title, time, and a short description solely to generate styling suggestions inside the app.
We never create, edit, delete, or share your calendar events, and we do not retain a copy of your calendar — events are read on demand and not stored.
You can disconnect at any time in Profile → Account → Calendar, which revokes our access and deletes the stored authorisation token.

Atelier’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Payment data

When you subscribe, payment is processed by our Merchant of Record, Lemon Squeezy (LemonSqueezy Inc., a Stripe company). We do not see, store, or have access to your full card details. We receive only:

Your subscription status (active, cancelled, expired, etc.)
The plan you chose (monthly or annual)
Renewal and cancellation timestamps
The last 4 digits of your card (for your reference in the customer portal)

For Lemon Squeezy’s own privacy practices, see their privacy policy.

Service and AI usage data

To operate the Service, keep it reliable, and manage the cost of AI features, we record:

AI usage and cost records — for each account we log the number of AI requests you make, which feature they came from, and approximate token/cost totals. These are held against your account (not anonymised) and used to enforce fair-use limits and manage our costs.
Rate-limit counters — short-lived counts of recent AI calls, stored in your browser, to enforce per-minute and per-day limits.
Diagnostic information — error messages and basic performance data generated by our infrastructure providers to help us fix faults.

We do not use Google Analytics, advertising trackers, behavioural-profiling tools, or third-party analytics scripts, and we do not track you across other websites.

Location data (optional)

If you use the weather-aware features (such as the daily forecast or the travel packing planner), your device may ask your permission to share your approximate location. If you allow it, your coordinates — or a place name you type — are sent to our weather provider (Open-Meteo) to retrieve a local forecast. We do not store your location on our servers; forecasts are cached only in your browser. You can decline the browser permission and still use the rest of the Service.

How we use your data

We use your personal data only for the following purposes:

To provide the Service — store your wardrobe, sign you in, render the app
To process your subscription and payments (via Lemon Squeezy)
To send transactional emails (sign-in links, receipts, important service notifications)
To provide AI features that operate on your own wardrobe (styling suggestions, item identification)
To provide calendar-aware styling, only if you connect Google Calendar (read-only; see “Calendar data” above)
To enforce our Terms of Service and protect against fraud or abuse
To respond to your support requests
To meet our legal obligations (e.g., tax records, regulatory requests)

We do not use your data for marketing emails unless you explicitly opt in, and we do not sell, rent, or share your personal data with third parties for their own purposes.

If you subscribe to our newsletter (the Atelier letter), we ask you to confirm your subscription by clicking a link in a confirmation email (double opt-in). We process your email address on the basis of your consent, which you can withdraw at any time using the unsubscribe link in any newsletter or by emailing us. We do not add you to the newsletter as part of signing up for the Service — it is always a separate, optional choice.

How AI features use your data

Atelier’s AI features are powered by Google’s Gemini models, accessed through Firebase AI Logic (part of Google Cloud). When you use a feature like item identification, styling, gap analysis, the travel planner, or the Concierge chat, the relevant content is sent to Google’s Gemini models to generate a response. Depending on the feature, this can include:

photos you provide (for example, a garment, a clothing label, a receipt, or an inspiration image);
a summary of your wardrobe (item names, brands, categories, colours, materials);
your style profile and, where relevant, the measurements you have provided;
your Concierge chat messages and, if you have connected it, brief details of upcoming calendar events.

Google processes this content to return a result to you and, under our Firebase AI Logic terms, does not use it to train its own models. Your Concierge conversation history is stored in your account so the chat retains context; you can clear it at any time from within the chat. We never send your email address, name, or payment details to the AI models.

We process your personal data on the following legal bases:

Performance of a contract — most processing is necessary to provide the Service you’ve contracted with us
Legitimate interests — diagnostic logging, fraud prevention, service improvement
Legal obligation — tax records, responding to lawful requests from authorities
Consent — for any optional features that go beyond the above (you can withdraw consent at any time)

Third parties we use to operate the Service

We rely on a small number of carefully chosen providers. Except for Lemon Squeezy (see below), each acts as our data processor and is contractually required to protect your data and use it only for the purposes we instruct:

Google / Firebase (Google Ireland Limited and Google LLC) — authentication, database (Firestore), image storage (Firebase Storage), serverless functions, hosting, bot/abuse protection (Firebase App Check / reCAPTCHA), sign-in and magic-link emails, and AI features via Firebase AI Logic (Gemini). Our Firestore data, image storage, and functions are configured to run in Google’s UK/EU region.
Lemon Squeezy (Lemon Squeezy, LLC) — our Merchant of Record. Lemon Squeezy sells the subscription to you, takes payment, and handles billing, invoicing, and sales tax/VAT. For that payment and tax data, Lemon Squeezy acts as an independent data controller under its own privacy policy. We receive only the limited details described under “Payment data” above.
Open-Meteo — weather forecasts. Receives your approximate location or a place name on demand when you use weather features (see “Location data” above).
Microlink (microlink.io) — when you paste a product link to add an item, we send that URL to Microlink to fetch the product’s title, description, and image.
Image proxy — to display retailer images that block direct browser loading, image URLs may be fetched via our own server or, as a fallback, a public image-proxy service. Only the image address is sent; none of your account data is shared.
Cloudflare (Cloudflare, Inc.) — DNS, CDN, and content delivery for the marketing site.
Microsoft 365 (Microsoft Corporation) — email infrastructure for our contact@ mailbox.
MailerLite (MailerLite Limited) — our email newsletter provider. If you subscribe to the Atelier letter, your email address (and the page you signed up from) is stored in MailerLite so we can send you the newsletter. Used only with your consent; unsubscribe at any time via the link in any email.

Each provider has its own privacy practices. Where your data is transferred outside the UK — for example to Google or Lemon Squeezy in the United States — we rely on appropriate safeguards required under UK GDPR, such as the UK International Data Transfer Agreement or Addendum, Standard Contractual Clauses, or the provider’s certification under the UK Extension to the EU–US Data Privacy Framework.

Where your data is stored

Wardrobe data is stored in Firestore (Google Cloud), configured to run in Google’s UK/EU region.
Photos are stored either within your wardrobe records in Firestore or in Firebase Storage (Google Cloud), also in Google’s UK/EU region.
Authentication data is held by Firebase Authentication (Google Cloud).
Payment data is held by Lemon Squeezy in their own systems.

Shared links. If you create a public share of an outfit or lookbook, the shared card (including a copy of the relevant item images) is stored so that anyone with the link can view it without signing in. Treat a share link as public — anyone you send it to, or who obtains it, can open it until you delete the share.

We do not maintain our own database servers.

How long we keep your data

While your subscription is active: we retain your data so you can continue using the Service.
After cancellation: your account remains accessible for the remainder of your paid period. After that, we retain your data for 30 days in case you wish to resubscribe and resume where you left off, then permanently delete it unless you’ve requested otherwise.
Trash bin: items you delete from your wardrobe are soft-deleted for 30 days (recoverable from the Trash view), then permanently removed.
Concierge chat history: kept in your account so the assistant retains context, until you clear it or delete your account.
AI usage and cost records: retained for as long as your account is open, so we can enforce fair-use limits and manage costs.
Public shares: shared links remain available until you delete them (see “Your rights” below).
Payment records: Lemon Squeezy retains billing records as required by law; any invoice or tax data we hold is kept as required by UK tax law (typically 6 years).

You have the following rights regarding your personal data:

Right of access — request a copy of the personal data we hold about you
Right to rectification — correct inaccurate or incomplete data (most can be updated directly within the app)
Right to erasure — request deletion of your personal data (“right to be forgotten”)
Right to data portability — receive your data in a structured, machine-readable format
Right to object — to processing based on legitimate interests
Right to restrict processing — temporarily limit how we use your data
Right to withdraw consent — where processing is based on consent
Right not to be subject to automated decision-making — including profiling that has legal effects

To exercise any of these rights, email [email protected]. We will respond within one month.

Deleting your account. You can permanently delete your account and its data from within the app (Profile → Account), or by emailing us. Deletion removes your wardrobe, photos, outfits, Concierge history, and integration tokens from our systems. Please note:

Cancel your subscription first. Deleting your account does not automatically cancel billing with Lemon Squeezy — cancel via the customer portal to stop future charges.
Public shares you have created are not removed automatically, because they are designed to work without sign-in. Delete any shares you no longer want before closing your account, or ask us to remove them.
We may retain the minimum records we are legally required to keep (for example, tax records) and a record of the deletion request itself.

You also have the right to lodge a complaint with the UK Information Commissioner’s Office at ico.org.uk.

Cookies and similar technologies

The Service uses only a minimal set of cookies and browser storage that are strictly necessary to run it, or that you switch on yourself. We do not display a cookie banner because we do not use any advertising or analytics cookies that would require your consent.

We use:

Sign-in session — set by Firebase Authentication to keep you signed in.
App preferences and rate-limit counters — stored in your browser to remember settings and enforce fair-use AI limits.
Bot and abuse protection — Google’s Firebase App Check / reCAPTCHA runs to confirm requests come from the genuine app and may set a cookie for that security purpose.

Some features ask your device for permission before they run, and you can decline any of them:

Location — for weather and travel features (see “Location data”).
Notifications — optional reminders if you install the app to your home screen.
Camera / photos — to add items by photo.

We do not use advertising cookies, tracking pixels, or analytics services that share data with third parties.

Children’s data

The Service is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children. If you believe someone under 18 has provided us with personal data, please contact us and we will delete it.

Security

We take appropriate technical and organisational measures to protect your personal data, including:

Encryption in transit (HTTPS / TLS) for all data
Encryption at rest for all data stored in Firebase
Role-based access controls (Firestore Security Rules) that strictly limit data access to authorised accounts
Cryptographic signature verification on all payment webhooks
Multi-factor authentication options for administrators

No system can guarantee absolute security, but we work to minimise risk and respond promptly to any incident.

Changes to this policy

We may update this privacy policy from time to time. Material changes will be communicated via email to active subscribers and posted prominently on this page. The “last updated” date at the top reflects when changes were last made.

How to contact us

For any privacy questions, data requests, or concerns, please contact:

Email: [email protected]

We aim to respond to all data-protection enquiries within five working days.