Privacy Notice — United Arab Emirates (English)

Document version: 2026-09-09
Controller: Chengdu Xinling Qiyue Network Technology Co., Ltd. ("OutfitMuse", "we", "us", or "our")
Registered address: Room 1601, No. 2 (self-numbered), 16th Floor, Building 1, No. 145 Tiantai Road, Chengdu High-Tech Zone, Chengdu, Sichuan, People's Republic of China
Privacy contact: support@echojoy.cn

This notice applies to OutfitMuse users in the United Arab Emirates. The global Privacy Policy is included in Part 2 of this same page. Where United Arab Emirates law gives you a mandatory protection, that protection applies.

Information, purposes, and choices

We process the account, sign-in, content, profile, city (manually selected or approximately inferred from IP), device, diagnostic, analytics, purchase, subscription, entitlement and support information described in our global Privacy Policy. We receive it directly from you, from Apple or Google when you choose those sign-in methods, and automatically from your device and use of the Services, and from the store used for a purchase for transaction verification and benefit administration.

We use it to create and secure your account, provide the wardrobe, styling, weather-aware, and support features you request, generate an AI result only when you actively request that feature, prevent fraud or misuse, maintain service reliability, and comply with law. Your email and sign-in information are required to create and secure an account. We do not request device location permission or collect precise device location. For city-based weather features, we use approximate city-level location inferred from your IP address or a city you select manually. Photos, prompts, profile preferences, and body information are optional, but a feature that needs a particular input cannot work without it.

Where applicable law requires consent for a processing activity, we obtain the required affirmative consent for that activity. Device permissions and general service acceptance do not replace explicit permission for third-party AI processing. You may withdraw optional permissions in your device settings and may stop using an AI feature at any time. Withdrawal does not affect processing already carried out, and may make a related feature unavailable.

AI, disclosure, and international processing

Before sending personal information for an AI request, we explain the processing and obtain your explicit permission. The photos or image links you choose, which may include your face, and the instructions and relevant preferences needed for the request are sent through Vercel AI Gateway to OpenAI for analysis, generation or editing as needed. If you decline, we do not send that AI request and the relevant feature cannot proceed. We use other contracted providers for cloud hosting, storage, authentication, email delivery, crash reporting, and support. They may process information only to provide services to us, subject to contractual and technical safeguards.

Our overseas production environment is hosted primarily in the United States using Amazon Web Services. Providers may process information in the United States or other locations needed to provide their services. We use appropriate contractual, organisational, and technical safeguards for cross-border processing as required by applicable law. For the current provider names and their main processing locations, see our Subprocessor List. We do not sell personal information, use it for cross-context behavioural advertising, or use your photos, prompts, profile or body information, or generated images to train our or a third party's AI models.

Purchases and subscription information

We process account, product and transaction identifiers, verification information, purchase amount and currency where available, subscription status and periods, credit usage, refunds and billing-support records to verify purchases, deliver benefits, prevent fraud, reconcile transactions and handle disputes. Apple App Store or Google Play processes payment credentials under its own terms; through these integrations, we do not receive full card numbers, security codes, payment passwords or authentication codes. The stores also perform certain account, payment and fraud-prevention activities independently. Configured Firebase usage events and identifiers help us understand feature usage.

Retention, security, and your rights

We keep account and saved content data while your account is active unless you delete it earlier. Temporary AI-request copies are deleted from active systems within 30 days unless saved to your account or required for security, legal, or dispute reasons. Operational and diagnostic logs are generally retained for up to 90 days. When you confirm account deletion in the app, we immediately close your account, stop providing services to that account, and directly delete the associated account information and personal content. You can no longer sign in with the deleted account.

If specific records must be retained by law or are temporarily needed for security audits or dispute resolution, we retain only the minimum necessary information for the shortest necessary period, restrict processing to the permitted purpose, and directly delete it when that requirement ends. Where technical limitations temporarily prevent deletion from backups, we securely isolate those copies and limit processing to storage and necessary security protection until they can be directly deleted as soon as technically possible. These exceptions do not permit continued use of your photos or account content for other purposes, and we do not retain them as anonymized data instead of deleting them. See the Account Deletion Instructions for the in-app and backup request paths.

Necessary purchase, subscription, entitlement and support records may be retained for limited legal, accounting, refund, dispute or fraud-prevention purposes. Deleting your account does not itself cancel store renewal; use the original store's subscription settings to avoid future charges. After the warning, you may still proceed with account deletion without waiting for the paid period to expire. These retention descriptions concern OutfitMuse's own systems; provider security and legal retention is described separately in the Third-Party Services List.

Subject to applicable law, you may request information about processing, access to and correction of personal information, deletion or restriction of processing, transfer of information where applicable, or object to certain processing. You may also request a review of a qualifying decision based solely on automated processing. OutfitMuse does not make decisions producing legal or similarly significant effects solely through automated processing.

You can update or delete many items directly in the app. For another request, email support@echojoy.cn with the subject line "UAE Privacy Request" and your account email. We may verify your identity. We use reasonable administrative, technical, and organisational safeguards; if a security incident requires notice, we will provide notice as required by law.

We may update this notice when our practices, Services, or legal requirements change. For a material change, we will give appropriate notice and obtain consent where required before it takes effect.

---

Part 2 — Global Privacy Policy (English)

Document version: 2026-09-09
Controller: Chengdu Xinling Qiyue Network Technology Co., Ltd. ("OutfitMuse," "we," "us," or "our")
Registered address: Room 1601, No. 2 (self-numbered), 16th Floor, Building 1, No. 145 Tiantai Road, Chengdu High-Tech Zone, Chengdu, Sichuan, People's Republic of China
Privacy contact: support@echojoy.cn

This Privacy Policy explains how OutfitMuse collects, uses, discloses, retains, and protects personal information when you use our mobile applications, websites, and related services (collectively, the "Services").

This global Policy applies wherever we make the Services available. Country-specific notices may supplement it for Brazil, Japan, Mexico, India, Indonesia, Malaysia, the United Arab Emirates, Nigeria, or another market. It is not directed to people in the European Economic Area, the United Kingdom, or jurisdictions where we have not made the Service available. We will publish an applicable regional notice before offering the Service in those regions.

Regional privacy notices

Please also read the notice for your country or region, where listed below. A regional notice supplements this global Policy; choosing a different display language does not remove any protections that apply where you live.

• Hong Kong and Taiwan — 繁體中文
• Canada — Français
• Brazil — Português
• Japan — 日本語
• Mexico — Español
• India — English
• India — हिन्दी
• Indonesia — Bahasa Indonesia
• Malaysia — Bahasa Melayu / English
• United Arab Emirates — English
• Nigeria — English

Please read this Policy with our Terms of Service. If you have questions or wish to exercise a privacy right, contact us at the email address above.

1. Information We Collect

We collect information that you provide, information generated while you use the Services, and limited information that is collected automatically.

We do not request device location permission or collect precise device location. For city-based weather features, we use approximate city-level location inferred from your IP address or a city you select manually. You may also deny camera or photo-library permission; however, features that require you to take or upload photos will not be available.

Payments for subscriptions and in-app purchases are processed by Apple App Store or Google Play, as applicable to your purchase. OutfitMuse receives the transaction and subscription information necessary to verify purchases and provide benefits. Through these store billing integrations, we do not receive your full payment-card number, card security code, payment-account password or payment authentication code. The relevant store handles payment details under its own terms and privacy policy.

2. How We Use Information

We use personal information only as needed to:

• provide, maintain, personalize, and secure the Services;
• create and administer accounts; verify sign-ins; prevent fraud, abuse, and unauthorized access;
• receive, store, transform, and return the photos, prompts, and other inputs needed for the AI feature you actively request;
• provide weather-aware outfit recommendations based on your manually selected city or approximate city inferred from your IP address;
• verify and reconcile purchases, provide and synchronize membership and AI credits, prevent payment-related fraud, and handle refunds, billing disputes and necessary transaction records;
• understand app usage through the configured analytics described above;
• respond to support requests and communicate about material service or policy changes;
• diagnose crashes, fix defects, measure service reliability, and enforce our Terms; and
• comply with legal obligations and protect the rights, safety, and security of OutfitMuse, our users, and others.

We do not use your photos, prompts, profile or body information, or generated images to train or improve our or a third party's AI models. We do not use personal information for targeted advertising.

3. AI Feature Processing and Your Choices

When you request an AI-powered feature, OutfitMuse sends the photos or image links you choose, which may include your face, and the instructions and relevant preferences needed for the request, through Vercel AI Gateway to OpenAI for analysis, generation or editing as needed. Before this personal information is sent, we explain the processing and ask for your explicit permission in the app. If you decline, we do not send that AI request and the relevant feature cannot proceed. Agreeing to general service terms or buying a membership does not replace this permission. Further details are in our Third-Party Services List.

You may stop using an AI-powered feature at any time. The relevant feature cannot operate without the necessary inputs. You can delete uploaded content, generated content, or your account as described in the Account Deletion Instructions.

4. When We Disclose Information

We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

We disclose information only in these limited circumstances:

• Service providers. We use providers that process information on our behalf for cloud hosting, storage, content delivery, authentication, email delivery, AI processing, crash reporting, and customer support. They may use the information only to provide services to us, subject to contractual and technical safeguards.
• App stores and billing. We exchange the identifiers and transaction information needed to verify purchases and administer paid benefits with the store used for your purchase. Apple and Google also process certain account, payment and fraud-prevention information independently under their own policies; not every store activity is performed solely on our instructions.
• AI providers. When you request an AI feature, the necessary images, prompts, and related request parameters are disclosed to the AI providers described in our Subprocessor List.
• Legal and safety reasons. We may disclose information when we reasonably believe it is necessary to comply with law, enforce our agreements, protect rights or safety, investigate fraud or security incidents, or respond to valid legal process.
• Corporate transactions. If we are involved in a merger, financing, reorganization, acquisition, or sale of assets, personal information may be transferred as part of that transaction, subject to this Policy or notice where required by law.

We do not make your wardrobe, profile photos, body photos, or generated images public by default.

5. International Processing and Data Location

Our overseas production environment is hosted primarily in the United States using Amazon Web Services. This includes application infrastructure and storage for overseas account and content data.

Our providers may process information in the United States or other locations necessary to provide their services. When information is transferred across borders, we use appropriate contractual, organizational, and technical safeguards required by applicable law. We will update this Policy before changing the primary data region or materially changing the categories of recipients.

6. Retention and Deletion

We retain personal information only for as long as needed for the purposes in this Policy:

• Account information, wardrobe content, profile information, preferences, and saved generated results are retained while your account remains active, unless you delete them earlier.
• Temporary copies used to complete an AI request are deleted from our active systems within 30 days after completion, unless they are saved as content in your account or must be retained for security, legal, or dispute-resolution reasons.
• Security, diagnostic, and operational logs are generally retained for up to 90 days, unless a longer period is necessary to investigate an incident or comply with law.
• When you confirm account deletion in the app, we immediately close your account, stop providing services to that account, and directly delete the associated account information and personal content. You can no longer sign in with the deleted account.

If specific records must be retained by law or are temporarily needed for security audits or dispute resolution, we retain only the minimum necessary information for the shortest necessary period, restrict processing to the permitted purpose, and directly delete it when that requirement ends. Where technical limitations temporarily prevent deletion from backups, we securely isolate those copies and limit processing to storage and necessary security protection until they can be directly deleted as soon as technically possible. These exceptions do not permit continued use of your photos or account content for other purposes, and we do not retain them as anonymized data instead of deleting them.

Purchase, subscription, entitlement and related support records may be retained after account deletion where and for as long as necessary for legal or accounting obligations, refunds, disputes or fraud prevention. Access is restricted and retention is limited to the relevant purpose. Account deletion does not itself cancel a subscription held with Apple or Google; cancellation is explained in our Membership and Auto-Renewal Terms.

The retention and deletion rules above describe OutfitMuse's systems, not an unconditional promise of immediate deletion of every third-party copy. AI-service security or abuse-monitoring records and legally required retention are described separately in the Third-Party Services List.

For deletion steps and the limited exceptions to deletion, see our Account Deletion Instructions.

7. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information, including access controls, encryption in transit, role-based access, and security logging. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we identify a security incident that requires notice under applicable law, we will provide notice as required.

8. Your Privacy Choices and Rights

Depending on where you live, you may have rights to request access to, correction of, deletion of, or a portable copy of personal information. You may also withdraw optional camera or photo-library permissions in your device settings. You can update or delete many items directly in the app, including saved photos, preferences, and your account.

To make a request that is not available in the app, email support@echojoy.cn with the subject line "Privacy Request." Please include the email address associated with your account and the request type. We may verify your identity before responding. We will not discriminate against you for exercising a privacy right.

9. California Privacy Notice

This section applies to California residents. In the preceding 12 months, we may have collected the following categories of personal information: identifiers (such as email address, account ID, IP address, and device identifiers); customer-record information you provide; commercial information such as purchase history, subscription status and entitlement records; internet or network activity; approximate city-level location inferred from IP and manually selected city information; user content (including photos, prompts, and generated images); and profile information, including body-profile information that you choose to provide.

We collect these categories directly from you, automatically from your device and use of the Services, and from sign-in providers when you choose Apple or Google sign-in, and from the store used for a purchase to verify transactions and administer benefits. We use and disclose them for the purposes described in Sections 2 and 4.

We do not sell personal information or share personal information for cross-context behavioral advertising, as those terms are defined by California law. We do not use or disclose sensitive personal information for purposes other than providing and securing the Services and the other permitted purposes described in this Policy. California residents may submit access, correction, deletion, or portability requests through the contact method in Section 8. Authorized agents may submit requests where permitted by law, subject to verification of their authority and your identity.

10. Children

OutfitMuse is not directed to children under 13, and you must be at least 13 years old to use the Services. If you are under the age of majority where you live, you may use the Services only with permission from your parent or legal guardian. We do not knowingly collect personal information from children under 13. If we learn that we collected such information without appropriate authorization, we will delete it.

11. Changes to This Policy

We may update this Policy when our practices, Services, or legal requirements change. For material changes, we will provide notice through the Services or by another appropriate method and, where required, obtain your consent before the change takes effect. The "Document version" date identifies this revision. Any effective date and required notice will be communicated when an update takes effect.

12. Contact Us

Chengdu Xinling Qiyue Network Technology Co., Ltd.
Privacy requests and questions: support@echojoy.cn

If you contact us about a privacy request, please do not send photos, identity documents, or other sensitive information unless we specifically ask for it through a secure channel.