privacy policy

i spy (“i spy”, “we”, “us”, “our”) operates the i spy mobile application, websites, and related services (together, the “Service”). This Privacy Policy explains what information we collect, how we use it, and the choices you have. By creating an account or using the Service, you acknowledge this Policy. If you do not agree, do not use the Service.

The product itself is the i spy app (iOS and Android). Our marketing website at ispyplatform.com is a landing / support site only — it is not a full web product.

1. Who we are

The data controller for the Service is I Spy Platform Ltd (company number 17089652), a private limited company registered in England and Wales. Registered office: 167–169 Great Portland Street, 5th Floor, London, England W1W 5PF. We trade as “i spy”.

The Service is operated for fashion discovery and shopping inspiration. Contact for privacy requests: support@ispyplatform.com. We may update this Policy; the “Last updated” date will change. Material changes may also be highlighted in the app or by email where appropriate.

2. Information we collect

• Account data: email address, display name/handle, password or sign-in credentials via Apple/Google (we receive identifiers and profile fields those providers share with your consent).
• Profile content you choose to add: bio, avatar, social links, preferred region/currency, public/private settings.
• Service content: boards, saved products, outfit photos you upload, style preferences, search and visual-search inputs (including images you submit for matching), and product alerts you configure.
• Transaction and commerce context: retailer/affiliate product links you open, in-app purchase or subscription status (e.g. Pro via the App Store / Google Play and our billing partner), and related receipts we need to unlock features — we do not store full payment card numbers.
• Device and usage data: app version, device type/OS, coarse diagnostics, crash logs, performance metrics, IP address, approximate location derived from IP or region preference (not continuous GPS tracking unless you later grant that for a specific feature).
• Communications: messages you send to support, and records of transactional and (where applicable) marketing emails.
• Cookies/SDK identifiers: authentication session tokens, analytics and crash reporting IDs, push notification tokens, and similar technologies needed to run and secure the Service.

3. How we use information

• Provide, personalise, and improve the Service (including visual search, boards, recommendations, and account features).
• Authenticate you, secure accounts, prevent fraud/abuse, and enforce our Terms.
• Send transactional and service messages that are necessary to operate your account (e.g. sign-in links, password resets, security alerts, material changes to terms, critical service notices).
• Send product news, tips, launches, and promotional emails (the “mail list” / email updates) to the email on your account, as described under “Marketing emails & mail list” — on by default for new accounts, with clear opt-out.
• Process subscriptions and feature entitlements.
• Respond to support requests and investigate issues.
• Comply with law, respond to lawful requests, and protect rights, safety, and property.

4. Marketing emails & mail list

• Marketing and promotional emails are ON by default for new accounts (marketing_emails_opt_in defaults to true) when you create an account and accept these Terms / this Privacy Policy. That preference is stored on your user profile.
• You may opt out at any time in Account → Email updates (or equivalent settings). You can also use the unsubscribe link in any marketing email. Opting out does not stop necessary transactional/service emails.
• While opted in, we (and our email delivery processors acting on our instructions) may send product news, feature launches, style inspiration, and related promotional messages to the email on your account.
• Every marketing email will include a working unsubscribe mechanism or clear instructions.
• We do not sell your email address. We do not share your email with third parties for their own independent marketing without a lawful basis and, where required, your consent.
• If you delete your account, we stop marketing to that account email except where we must retain minimal records for legal compliance (e.g. proof of prior consent/unsubscribe).

5. Push notifications

• Push notifications (e.g. product alerts) require OS-level permission and, where applicable, in-app toggles. You can disable them in system settings and/or app notification preferences.
• Push is separate from the email mail list. Disabling one does not automatically disable the other.

6. Cookies (marketing site)

i spy is an app. Almost everything you do in the product (visual search, boards, shopping links) happens in the iOS or Android app — not as a full web product. App privacy is also covered by the App Store / Google Play listings and your device settings.

This cookie section only applies when you visit our marketing and support site at ispyplatform.com (home, guides, legal pages, brand/creator forms, and similar).

On that site we may use:

• Essential — only if needed for the page to work (for example session cookies if you use any web sign-in on this site).
• Basic site analytics — Vercel Analytics, so we can see which marketing pages are visited. It is not used to run ads on this site.

We do not currently use Google Analytics or Meta Pixel on ispyplatform.com. If you leave our site (for example to a retailer, Instagram, or TikTok), those services may use their own cookies under their own policies.

You can block or delete cookies in your browser settings. For questions, email support@ispyplatform.com.

7. Legal bases (EEA/UK where applicable)

• Contract: to provide the Service you request.
• Legitimate interests: security, improvement, fraud prevention, limited analytics, and (where permitted) soft opt-in style service communications to existing customers about similar products/features — balanced against your rights and always with easy opt-out.
• Consent: where we rely on consent (including certain device permissions, or marketing where consent is required in your region); you may withdraw consent anytime via Account settings or unsubscribe.
• Legal obligation: where we must retain or disclose information.

8. Sharing

• Service providers (processors) who host infrastructure, send email, process analytics/crashes, enable auth (e.g. Apple, Google, Supabase), payments/subscriptions (e.g. Apple, Google, RevenueCat), and support tools — under contracts that limit use of your data to providing services to us.
• Retailers and affiliate networks when you choose to visit or buy via outbound product links; their sites have their own policies.
• Other users: content you make public (e.g. public boards, public profile) is visible as you configure.
• Legal and safety: if required by law, or to protect users, us, or others from harm.
• Business transfers: if we are involved in a merger, acquisition, or asset sale, information may transfer under appropriate protections.

9. International transfers

We may process data in the United Kingdom, European Economic Area, United States, and other countries where our providers operate. Where required, we use appropriate safeguards (such as standard contractual clauses) for cross-border transfers.

10. Retention

We keep account and content data while your account is active and for a reasonable period afterward if needed for backups, disputes, security, or legal obligations. Marketing preference/unsubscribe logs may be retained as needed to demonstrate compliance. You can delete your account in Account settings; residual copies in backups are purged on a rolling schedule.

11. Security

We use industry-standard measures (encryption in transit, access controls, secure authentication). No method of transmission or storage is 100% secure; you are responsible for keeping credentials confidential and for device security.

12. Your rights

• Access, correct, or update profile information in the app.
• Export or request a copy of certain data by contacting support@ispyplatform.com.
• Delete your account and associated personal data from Account settings (subject to legal retention).
• Object to or restrict certain processing, and withdraw marketing consent / opt out of the mail list at any time.
• Lodge a complaint with a supervisory authority if you are in the EEA/UK or another region with such rights. In the UK, that is the Information Commissioner's Office (ICO) at www.ico.org.uk. Please contact us first at support@ispyplatform.com so we can try to help.
• California and similar US state residents may have additional rights regarding “sale”/“share” of personal information; we do not sell personal information for money. To exercise rights, email support@ispyplatform.com.

13. Children

The Service is not directed to children under 13 (or the minimum age required in your country, if higher). We do not knowingly collect personal information from children under that age. If you believe a child has provided data, contact us and we will take appropriate steps to delete it.

14. Third-party links and services

The Service links to retailer sites, payment platforms, and other third parties. Their privacy practices are their own. Review their policies before providing them information.

15. Contact

For privacy questions, data requests, or marketing preference help, contact us at support@ispyplatform.com.