The Bag Room

Privacy Policy

Last updated: July 22, 2026

This policy explains what we collect, how we use it, and how long we keep it when you use The Bag Room.

Data controller: Bearminds, Gdansk, Poland — contact support@bearminds.com.

What we store

  • Photos you upload — to generate your try-on.
  • Generated images — saved to your history/gallery so you can return to them.
  • Account details — the email or provider identity (Apple, Google) you sign in with, and the name your provider supplies (used only as described under "Sharing" below). Email-code sign-ins provide no name.
  • Purchase records — order and credit history (payments themselves are handled by Lemon Squeezy; we never see your card details).
  • Share links — if you create one: the link token, which result it points to, and when it was created or turned off.
  • Usage analytics — product events (e.g. that a try-on was generated) and, where present, the campaign or link that brought you to us (referrer and UTM link parameters), used to understand and improve the service and to measure our own marketing. We do not profile you for advertising.

We do not use your photos to identify you and do not perform biometric identification. We do not sell your data or use your photos for advertising.

90-day auto-delete

Uploaded photos and generated images are retained for up to 90 days, then automatically and permanently deleted. You are responsible for saving anything you want to keep before then. Deleted content cannot be recovered. Share links expire on the same clock.

How your photo is processed

To create a try-on, your photo and the selected bag reference are sent to our AI image provider (Google Cloud — Vertex AI / Gemini) on a paid tier that does not train on your data. Your photo is stored encrypted, in a private bucket accessible only to your account.

Sharing — what becomes visible if you create a link

Sharing is opt-in, per photo, and confirmed with you before the first link is created. If you create a share link:

  • Anyone with the link can see that page: your original photo, the try-on, the bag name, and — if your sign-in provider supplied one — your first name.
  • Links are unlisted and excluded from search indexing; there is no public directory.
  • You can turn a link off at any time; the page stops working immediately. Messaging platforms (Apple, Meta, Google and similar) may retain link previews already sent in chats — these copies are outside our control.
  • Links expire with the 90-day photo retention, or when you turn them off, or when your account is deleted.

Nothing is ever public unless you create a link.

Legal bases (GDPR)

  • Performance of a contract — processing your photos to deliver try-ons, managing your account, credits, and purchases.
  • Consent — publishing a result to a share link (given per link, revocable by turning the link off), and marketing emails (only if you opted in; unsubscribe any time).
  • Legitimate interests — service security, abuse prevention (e.g. free-try limits), and privacy-respecting product analytics.
  • Legal obligation — retention of purchase records for tax and accounting law.

Service providers (sub-processors)

We rely on the following providers to operate The Bag Room:

  • Supabase — database, authentication, and encrypted file storage.
  • Google Cloud — application hosting (Cloud Run) and AI image generation (Vertex AI / Gemini; paid tier, no training on your data).
  • Lemon Squeezy — payments, as Merchant of Record.
  • PostHog — product analytics.

Some providers process data in the United States. Where personal data leaves the EEA, transfers rely on the EU–US Data Privacy Framework and/or Standard Contractual Clauses.

Cookies

We use only essential cookies — the session cookies required to keep you signed in. We do not use advertising or cross-site tracking cookies. Analytics is configured without advertising identifiers. Should we ever introduce advertising or conversion-tracking cookies, we will ask for your consent through a cookie banner before setting them and update this policy first.

Retention summary

  • Uploaded photos & generated images — 90 days, then permanently deleted.
  • Share links — until turned off, expiry of the underlying photo, or account deletion.
  • Account details — until you delete your account.
  • Purchase records — as long as tax and accounting law requires.

Your rights

Under the GDPR (and similar laws where you live) you have the right to access, correct, delete, and receive a copy of your personal data, to object to or restrict certain processing, and to withdraw consent (for sharing: turn the link off; for marketing: unsubscribe). You also have the right to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (UODO), or the authority in your country of residence.

Erasure requests. To have your account and all associated photos deleted, email [support@bearminds.com](mailto:support@bearminds.com). We delete the account, its stored photos, and any active share links on request; otherwise all photos and generated images are removed automatically after 90 days.

Children

The Bag Room is for adults. We do not knowingly process data of anyone under 18.

Changes to this policy

We may update this policy from time to time. We will post the updated version at this address and update the "Last updated" date; material changes will be notified in the service.