The Bag Room
Draft — under legal review

Privacy Policy

This is draft copy for The Bag Room, pending review and finalization by legal counsel — not final legal advice.

This policy explains what we collect, how we use it, and how long we keep it when you use The Bag Room.

What we store

  • Photos you upload — to generate your try-on.
  • Generated images — saved to your history/gallery so you can return to them.
  • Account details — the email or provider identity (Apple, Google) you sign in with.
  • Purchase records — order and credit history (payments themselves are handled by Lemon Squeezy).

We do not use your photos to identify you and do not perform biometric identification.

90-day auto-delete

Uploaded photos and generated images are retained for up to 90 days, then automatically and permanently deleted. You are responsible for saving anything you want to keep before then. Deleted content cannot be recovered.

How your photo is processed

To create a try-on, your photo and the selected bag reference are sent to our AI image provider (Google / Gemini) on a paid tier that does not train on your data. Your photo is not sold or used for advertising.

Sub-processors

We rely on the following service providers to operate The Bag Room:

  • Supabase — database, authentication, and encrypted file storage.
  • Google / Gemini — AI image generation (paid tier; no training on your data).
  • Lemon Squeezy — payments and Merchant of Record.
  • Vercel — application hosting.
  • PostHog — product analytics.

Your rights

Depending on where you live, you may have rights to access, correct, or delete your personal data, and to object to or restrict certain processing (including rights under the GDPR). To exercise these rights, contact us.

Erasure requests. To have your account and all associated photos deleted, email support@bearminds.com. We delete the account and its stored photos on request; otherwise all photos and generated images are removed automatically after 90 days.

To be completed by counsel: the data controller's legal identity and contact address; lawful bases for processing; international transfer mechanisms; cookie details; and the complaints/supervisory-authority process.