Privacy Policy

Your photos are yours.

Effective date: 24 July 2026

1. Who we are

ONA is operated by Frederik Randers, a sole trader (živnostník) trading as ONA and acting as the data controller for the personal information described in this policy.

2. Information we collect

Account information

• Name (where provided)
• Email address
• Authentication provider used (Google, Apple or email magic link)
• Authentication account identifier
• Account creation date and account status

User images and content

• Saved personal photos (up to 3)
• Clothing screenshots you upload
• Product references and selected garments
• Generated try-on images and saved looks
• Outfit versions and garment-analysis information

Usage information

• Generation history and status (successful, failed, retried)
• Try-on balances and deductions
• Feature usage and timestamps

Payments

• Product or plan purchased
• Transaction identifiers
• Payment status and subscription status
• Billing history, refunds and chargeback records

ONA does not directly store complete payment-card details. Full payment information is processed by Stripe, our payment provider.

Communications

• Support emails, privacy and billing requests
• Abuse reports and feedback

Technical information

• IP address, browser, device type and operating system
• Application and security logs, timestamps and error information
• Necessary cookie identifiers (see our Cookie Policy)

3. How images are processed

You upload one or more personal photos and 1–3 screenshots of a clothing item. ONA processes these images to generate a virtual try-on preview. To do this, images may be transferred to contracted AI, hosting, storage and infrastructure providers listed in section 5.

Uploaded screenshots may contain retailer interfaces, text or unrelated garments; only the garments you explicitly select are applied. Generated images are AI-created and may contain inaccuracies, artefacts or approximations.

• ONA does not use facial recognition to identify users.
• ONA does not intentionally create biometric identity profiles.
• ONA does not use customer images for advertising, demonstrations or model training without separate, explicit permission.
• ONA does not claim that every provider immediately deletes submitted images unless this is contractually guaranteed.

4. Purposes and legal bases

Performance of a contract

• Creating and managing accounts and authentication
• Saving personal photos and processing clothing screenshots
• Generating try-ons, saving looks and managing outfit versions
• Administering try-on balances
• Processing purchases and managing subscriptions
• Providing customer support

Legitimate interests

• Application security and abuse or fraud prevention
• Debugging and service reliability
• Detecting misuse and protecting users and infrastructure
• Resolving disputes

Consent

• Non-essential cookies (if introduced)
• Optional analytics (if introduced)
• Marketing emails
• Using customer images for marketing, demonstrations or model training

Legal obligation

• Tax and accounting records
• Consumer-protection obligations and regulatory compliance
• Fraud investigations and responses to lawful requests

5. Service providers and recipients

We share information only with providers that help us operate ONA. Each provider is bound by contractual and technical protections.

• Supabase — authentication, database and image storage; authentication emails (magic link, sign-in confirmations) are delivered through Supabase Auth.
• OpenAI — image analysis and generation for the try-on preview.
• Stripe — payment processing, subscription billing and related fraud checks.
• Google and Apple — optional sign-in providers, when you choose them.
• Lovable Cloud — hosting of the published application.
• Professional advisers where legally necessary.
• Public authorities where legally required.

Transactional and authentication emails are delivered through our authentication and infrastructure providers.

ONA does not currently use non-essential third-party analytics or advertising cookies. If this changes, ONA will update this policy and request consent where required.

ONA currently relies on internal application and infrastructure logs for troubleshooting and security. If a third-party error-monitoring provider is introduced, this policy will be updated.

6. International transfers

Some of our providers may process information outside Slovakia, the EEA or the UK, including in the United States. Where required, we rely on appropriate safeguards such as European Commission adequacy decisions, standard contractual clauses and additional contractual and technical protections.

7. Retention

• Temporary files — uploads, intermediate processing files and abandoned generation files are normally deleted within 24 hours after processing or abandonment.
• Security and generation logs — normally retained for up to 90 days, and longer where necessary to investigate fraud, abuse, security incidents, legal claims, payment disputes or service failures.
• Support records — normally retained for up to 24 months after the request is resolved, and longer where required for billing, fraud prevention, legal obligations, dispute resolution or enforcement of agreements.
• Backups — deleted information may remain in encrypted or access-controlled backups for up to 30 days before being overwritten through normal backup rotation.
• Account data — retained while the account is active and for a limited period after deletion where necessary for security, fraud prevention or legal obligations.
• Saved photos and generated looks — remain until you delete them or until your account is deleted.
• Accounting and transaction records — retained for the period required by applicable Slovak law.

8. Your rights

Subject to applicable law, you have the right to access, correct, delete, restrict or object to the processing of your personal information, the right to data portability, and the right to withdraw consent where processing is based on consent.

Send requests to onasupport@gmail.com. Our ordinary support response time is within 48 hours. Formal data-protection requests are handled within the statutory response periods that apply to them, which may be longer than 48 hours.

You have the right to lodge a complaint with the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky). If you live in another country, you may also contact the data-protection authority in your country of residence.

9. Deleting photos, looks and accounts

• Delete a saved personal photo from your Profile page.
• Delete an individual generated look from My Looks.
• Delete your account from your Profile page or by emailing support.
• Request a copy of your data by emailing onasupport@gmail.com.

Some billing, tax and security records may remain after account deletion where retention is legally required.

10. Security

We apply reasonable technical and organisational safeguards, including authenticated access, access controls, encrypted transmission, restricted storage access, logging, infrastructure security, deletion controls and incident investigation. No online service is completely secure, and we do not claim to be impossible to breach.

11. Children

ONA is intended only for users aged 18 or older. You must not upload photographs of minors.

12. Cookies

We use necessary authentication, security, session and payment-related cookies. We do not currently use non-essential analytics or advertising cookies. See our Cookie Policy for details.

13. Changes to this policy

We may update this policy from time to time. Material changes will be communicated through the website, inside the application, or by email where appropriate.

14. Contact

Frederik Randers, trading as ONA · Landererova 7743/8, 811 09 Bratislava, Slovakia · Email: onasupport@gmail.com · Telephone: +421 949 135 549

See also: Terms · Cookies · Refunds & Cancellation · Support