Plain English. No tricks.

Who we are

“Clueless” is a consumer wardrobe service operated by Replica AI, Inc., a Delaware corporation headquartered in the United States. In this policy, “we,” “us,” and “our” mean Replica AI, Inc. We are the business responsible for the personal information described below under the California Consumer Privacy Act (CCPA) as amended by the CPRA, the comprehensive consumer privacy laws of other US states (including Virginia, Colorado, Connecticut, Utah, and Texas), and applicable US federal law.

What we collect

What we use it for

• Providing the service: generating wardrobe previews, sizing, placing orders on your behalf, shipping the box, handling returns and refunds, and communicating with you about your orders.
• Improving the service: internal analytics, debugging, quality assurance, and the development of our sizing, curation, and rendering technology.
• Personalization: recommending wardrobes, outfits, sizes, and communications based on your preferences and past activity.
• Marketing communications about Clueless and other products from Replica AI, Inc. You can opt out of marketing emails at any time (transactional emails about your orders are not optional).
• Detecting and preventing fraud, abuse, and security incidents; enforcing our terms; and protecting our rights, property, and users.
• Complying with legal obligations including tax, accounting, and consumer protection law, and responding to lawful requests from authorities.

We do not sell your personal information for money. We do not share your personal information for cross context behavioral advertising as those terms are defined under California law. We do not use your individual photos to train third party AI models or to develop facial recognition systems for use outside Clueless. We may use aggregated or de identified data derived from your photos and measurements to improve our own sizing, rendering, and curation technology.

De-identified and aggregated data

We may create, use, share, and retain data that has been de-identified or aggregated such that it can no longer reasonably be linked to you. Once data has been de-identified or aggregated in this way, it is not personal information under applicable law and is not subject to this policy.

Who we share it with

We engage a small number of vetted service providers to deliver the service. Each is bound by a written contract and processes your data only under our instructions. We disclose the categories below; we do not sell or rent your personal information.

• · Payment processor for checkout, refunds, and chargeback handling.
• · Cloud infrastructure providers for hosting, database, and encrypted file storage.
• · AI service providers for image rendering and sizing inference, under enterprise contracts that prohibit the use of your data to train their models.
• · Transactional email and customer support providers for order confirmations, account communications, and support tickets.
• · Retailers and carriers for the fulfillment of each specific order, receiving only the data required to place and deliver that order.
• · Professional advisors (lawyers, accountants, auditors) under duties of confidentiality.
• · Authorities and successors where required by law, in response to lawful process, or in connection with a merger, acquisition, financing, or sale of all or a portion of our assets.

We will name any specific service provider on request. Our service providers are headquartered in the United States or operate US facilities subject to US contractual protections.

How long we keep it

We retain personal information for as long as needed to provide the service, comply with our legal obligations, resolve disputes, and enforce our agreements. Indicative retention periods:

• · Sizing photos: typically deleted from our active storage within 30 days after the corresponding order is marked delivered (or 30 days after upload if no order is placed). We may retain photos longer where reasonably necessary to resolve disputes, process returns, investigate fraud or abuse, or comply with legal obligations.
• · Wardrobe preview images: stored for the lifetime of your account so you can return to them, and deleted on account closure.
• · Body measurements: retained on your account to streamline future orders unless you ask us to delete them or close your account.
• · Order records: retained for up to 7 years (or longer where required by law) to comply with US tax, accounting, and consumer protection law.
• · Email logs: typically 30 days with our transactional email provider.
• · Account data (email, preferences): until you delete your account or we close it for inactivity (we will notify you before closing for inactivity).
• · De-identified or aggregated data: may be retained indefinitely.

Your rights

Depending on your state of residence, you may have the right to:

• Know: request a copy of the personal information we hold about you and the categories of third parties with whom we have shared it.
• Delete: have your personal information erased, subject to retention exceptions required for legal compliance, fraud prevention, completion of the transaction for which it was collected, and similar statutory exceptions.
• Correct: ask us to correct inaccurate information.
• Opt outof sale or sharing of personal information. We do not sell or share for targeted advertising. We do use a product analytics tool (PostHog) to understand how the site is used; you can disable all analytics for your browser at any time by clicking “Do Not Sell or Share My Info” in the site footer. Your choice persists across visits on the same browser.
• Limit use of sensitive personal information (California): restrict our use of sensitive personal information to what is necessary to provide the service.
• Non-discrimination: we will not deny service, charge a different price, or provide a different level of service because you exercised your rights.
• Appeal: if we deny a rights request, you may appeal by replying to our decision.

To exercise any of these rights, email admin@myreplica.io. We will respond within 45 days of receipt of a verifiable request. We may extend the response period once by an additional 45 days where reasonably necessary, and will notify you of the extension. We will verify your identity before acting on any request; the level of verification we require is proportionate to the sensitivity of the data and the request. An authorized agent may submit a request on your behalf with written authorization signed by you and proof of the agent’s identity. We may decline requests that are manifestly unfounded, repetitive, or cannot be verified, as permitted by law.

Security

We use reasonable administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit (TLS 1.2+) and at rest, access controls limited to authorized personnel, short lived signed session tokens, and audit logging. No system is perfectly secure, however, and we cannot guarantee the security of information transmitted over the internet.

Children

Clueless is intended for adults. The service is not directed to anyone under 18 and we do not knowingly collect personal information from anyone under 13 (the threshold under the federal Children’s Online Privacy Protection Act). If you believe a minor has used the service, email us and we will delete the account and associated data.

Changes to this policy

We will update the “last updated” date when this policy changes. Material changes will be communicated by posting an updated policy on the site and, where practical, by email to existing users at least 7 days before they take effect. Your continued use of Clueless after the effective date constitutes acceptance of the updated policy.

Contact

Privacy questions, deletion requests, or anything else data related:
admin@myreplica.io
Replica AI, Inc.