Privacy Policy

1. Information We Collect

When you sign in with Google, we receive your:

• Name and email address
• Google profile photo URL
• Google account ID (used as your unique identifier)

This information is used only to create and maintain your account and saved reports.

2. How We Handle Your Photos

When you upload or capture a photo for analysis, it is processed as follows:

• The image is transmitted securely to Google LLC for real-time AI styling analysis. Google LLC is based in the United States. This transfer is covered by Google's Standard Contractual Clauses (SCCs)
• Your input photos and AI-generated output images are stored in Firebase Cloud Storage (Google LLC, United States infrastructure governed by Google's SCCs). Storage is linked to your account and used to build your analysis history and future gallery features
• Stored images are never shared with third parties and never used for AI model training
• You can request deletion of individual analyses or your entire account — all associated images are deleted within 30 days of your request
• Please upload only photos needed for styling analysis and avoid sensitive personal content

Legal basis (GDPR Art. 6(1)(b)): We store your photos solely to deliver the analysis service you requested. The photos are not used for identification or profiling beyond the styling recommendations you asked for.

Google LLC may temporarily log inputs and outputs for safety, abuse prevention, and legal compliance under their own policies.

3. How We Use Your Information

• To authenticate you and maintain your account
• To perform AI styling analysis on your uploaded photos
• To store your analysis history and generated images for gallery and comparison features
• To track usage for free tier limits and Pro subscription management
• To improve the service via anonymized analytics (only with your consent)

4. Third-Party Services

MaxAura AI uses the following third-party services:

• Firebase (Google LLC) — authentication, account data storage, analysis history, and photo storage (Firebase Cloud Storage). Google LLC, United States. Covered by Google's Standard Contractual Clauses.
• Google LLC — AI-powered styling analysis. Limited request/response data may be retained temporarily for trust and safety enforcement under Google's AI usage policies.
• Google Tag Manager (Google LLC) — anonymized usage analytics to improve the service. Loaded only after you give explicit consent.
• Stripe, Inc. / Link (Merchant of Record) — checkout, payment processing, billing, tax calculation and remittance, fraud prevention, and dispute management for Pro subscriptions. Stripe, Inc. is based in the United States. Data transfers are safeguarded by Stripe's Standard Contractual Clauses. Privacy policy

5. Lawful Basis for Processing (GDPR Article 6)

We process your personal data on the following legal bases:

• Contract performance (Art. 6(1)(b)): We process your name, email address, and account data to create and maintain your account and deliver the service you requested.
• Legitimate interests (Art. 6(1)(f)): We use anonymized analytics via Google Tag Manager to understand how the service is used and improve it. You may decline analytics cookies and the service remains fully functional.
• Consent (Art. 6(1)(a)): We only activate analytics cookies and Firebase Performance Monitoring after you give explicit consent via the cookie banner.

6. Your Rights (GDPR)

Under GDPR, you have the following rights regarding your personal data:

• Right of Access (Art. 15): Request a copy of the personal data we hold about you.
• Right to Rectification (Art. 16): Request correction of inaccurate data.
• Right to Erasure (Art. 17): Request deletion of your personal data.
• Right to Data Portability (Art. 20): Request your data in a machine-readable format.
• Right to Restriction (Art. 18): Request that we limit how we process your data.
• Right to Object (Art. 21): Object to processing based on legitimate interests.

To exercise any of these rights, email shirish@alleviatelab.com. We will respond within 30 days.

7. International Data Transfers

MaxAura AI uses services operated by Google LLC (United States). These transfers are safeguarded by Google's Standard Contractual Clauses (SCCs) approved by the European Commission:

• Firebase (Google LLC) — authentication and database
• Google LLC — AI styling analysis
• Google Tag Manager (Google LLC) — analytics (consent-gated)
• Stripe, Inc. — payment processing and billing for Pro subscriptions. Stripe is based in the United States. Transfers are covered by Stripe's Standard Contractual Clauses approved by the European Commission.

8. Data Retention & Deletion

We retain your data for as long as your account is active. You may request deletion at any time by emailing shirish@alleviatelab.com. Upon request we will delete your account, saved analysis reports, stored photos (input and output images), and usage data within 30 days. Analysis history and associated images are retained until you delete them or your account.

9. Children's Privacy

MaxAura AI is not intended for users under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us immediately.

10. Contact & Supervisory Authority

For privacy questions or data requests, contact us at shirish@alleviatelab.com.

You also have the right to lodge a complaint with the Spanish Data Protection Authority (Agencia Española de Protección de Datos — AEPD) at www.aepd.es if you believe your personal data is being processed in violation of GDPR.