Privacy Policy.

This Privacy Policy explains how Solarisflux Unipessoal Lda, a single-shareholder limited liability company, headquartered in Braga, Portugal, registered with the Portuguese tax authority under NIPC 518304426 (the "Company", "we", "us", "our"), acting as data controller, collects and processes your personal data under Regulation (EU) 2016/679 (GDPR) and Portuguese Law 58/2019. It covers customoutfit.ai and all related services.

For any privacy matter, contact [email protected]. We have not appointed a statutory Data Protection Officer as we are not required to; this address reaches the person responsible for data protection.

1. Categories of data we process

• Account data — email, name, password hash (bcrypt; never stored in plain text), and your Google account identifier if you sign in with Google.
• Order & billing data — shipping name and address, items ordered, amounts, VAT country, invoice data, and the Stripe payment reference (we do not store card numbers).
• Design data — your text prompts, chosen styles, images you upload, and the generated artwork (stored in our Cloudflare R2 bucket). Uploaded source images are deleted shortly after generation.
• Communications — emails and support messages you send us.
• Technical & security data — IP address, browser/user-agent, and request timestamps, kept in security logs for a limited period (see retention).

2. Purposes & legal bases

• Create and manage your Account and provide the Service — performance of a contract (Art. 6(1)(b)).
• Process payments, manufacture and ship orders — performance of a contract (Art. 6(1)(b)).
• Issue invoices and meet tax/accounting duties — legal obligation (Art. 6(1)(c)).
• Prevent fraud, abuse and secure the Service — legitimate interests (Art. 6(1)(f)).
• Respond to your requests and handle complaints — legitimate interests / contract.
• Send service emails (order updates). Marketing emails, if any, are sent only with your consent (Art. 6(1)(a)), which you can withdraw at any time.

3. Recipients & sub-processors

We share data only with processors acting on our instructions, or where legally required:

• Stripe Payments Europe, Ltd. — payment processing (Ireland/EU).
• Replicate, Inc. and the AI model providers (Black Forest Labs, Recraft, Ideogram) — design generation (USA/EU; transfers under SCCs).
• Cloudflare, Inc. — file storage & CDN (EU edge; SCCs where applicable).
• Printful Latvia SIA — order fulfilment and shipping (Latvia/EU).
• Moloni Cloud, Lda. — invoicing (Portugal).
• Render Services, Inc. — application hosting and database (USA; transfers under SCCs).
• Email/auth providers — transactional email and Google sign-in, where used.

We do not sell your personal data.

4. International transfers

Some processors are located outside the EEA. Such transfers rely on European Commission Standard Contractual Clauses and, where appropriate, supplementary technical and organisational measures. You may request a copy of the relevant safeguards.

5. Retention

• Account data — for the life of your Account, then deleted/anonymised after closure (subject to legal retention below).
• Order, billing & invoice data — 10 years, as required by Portuguese tax law.
• Design files — until you delete the design or close your Account, plus up to 30 days in backups.
• Uploaded source images — deleted shortly after the generation completes.
• Security logs — up to 30 days, unless needed to investigate an incident.

6. Automated decisions & AI

We do not carry out automated decision-making that produces legal or similarly significant effects on you. AI models are used only to generate the artwork you request; they do not profile you.

7. Your rights

Under the GDPR you have the right to access, rectification, erasure, restriction, data portability, and to object to processing based on legitimate interests; and to withdraw consent at any time without affecting prior processing. To exercise any right, email [email protected]; we respond within one month (extendable by two months for complex requests). You may also lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Protecção de Dados (CNPD), or your local authority.

8. Children

The Service is not intended for persons under 18 and we do not knowingly collect their data. If you believe a minor has used the Service, contact us so we can delete the data.

9. Security

We apply appropriate technical and organisational measures: TLS encryption in transit, bcrypt password hashing, least-privilege database access over Render's private network, and secrets kept server-side and never exposed to the browser. No system is perfectly secure, but we work to protect your data.

10. Personal data breaches

If a breach is likely to result in a risk to your rights, we will notify the CNPD within 72 hours where required and inform affected users without undue delay when the risk is high.

11. Cookies

We use only strictly necessary and functional cookies and no advertising or analytics cookies. See our Cookie Policy.

12. Changes

We may update this Policy; the revised date appears above and material changes are notified by email to registered users.