Outfits AI

GDPR overview

There is no mention of the GDPR anywhere on the site, and this is a proven absence rather than an unchecked one: the application is a single-route JavaScript site, /privacy and /terms both return 404, and the word does not appear in roughly 450 KB of archived bundles. There is no privacy policy, no legal notice, no data protection contact, no Article 27 EU representative, no stated legal basis for processing and no cookie banner, even though Google Tag Manager is loaded on every visit. No company name, postal address or country of establishment is published either, so a data subject has no identified controller to address a request to. The only contact published anywhere is a Gmail address reachable through an in-app feedback button. For a tool whose core function is processing photographs of identifiable people, this is the single most important reservation about the service.

Who owns the data?

The question cannot be answered from the site, because Outfits AI publishes no terms of service and no privacy policy at all. Route inventory, direct probes of /privacy and /terms and a full text search of the site's JavaScript bundles all return nothing. No document therefore states who owns an uploaded photograph, who owns the generated image, or what the operator may do with either. The only observable behaviour comes from the application itself: renders are written to a per-account store, the generation request marks each render as private, and a user can delete a render from the interface. None of that is a contractual commitment. Ownership of uploaded photos and of the resulting images is, at the time of review, undefined in writing.

Reuse rights

No document on the site grants, restricts or describes any right of reuse. The only reuse statement anywhere is commercial: each plan lists a commercial-use allowance covering one person, or up to four people on the Premium plan, and names fashion designers, personal stylists, fashion students, photographers and influencers as intended beneficiaries. That line appears in the pricing dialog, not in a contract, and it says nothing about what the operator may do with the photograph the user uploads. There is no stated position on whether uploaded images or generated renders feed model training, and no opt-out mechanism is offered or mentioned. Users should treat the commercial-use wording as a marketing claim rather than a licence, and assume nothing beyond it.

Data retention & training

Hosting summary

Outfits AI publishes no hosting information: there is no privacy policy, no legal notice and no trust or security page, so no jurisdiction, region or data centre location is declared. What can be observed from the delivered application is infrastructure, not policy. The domain resolves to an anycast address fronting a common edge platform, which reflects the nearest network node rather than where data actually lives. Static assets and generated images are delivered from Amazon CloudFront distributions. Account data, credit balances and the render library are held in a Google Firebase project, and payments run through Stripe. None of these providers is named on the site as a subprocessor, and no subprocessor list exists. Users in the European Union should note that no transfer mechanism, safeguard or storage location is documented anywhere.