Privacy Policy

1. Information we collect

We collect the following categories of information.

• Account details: your name, email address, and a password (stored only as a salted hash). If you sign in with Google or Apple, we receive your name, email and profile identifier from them.
• Mirror scan data: images captured by your camera during a scan, your height, and body measurements and a body profile derived from them (your "Mirror ID").
• Try-on and activity data: garments you try on, favourites, brands you browse, and the try-on images generated for you.
• Device and usage data: IP address, browser and device type, language, pages viewed, and approximate location derived from your IP address.
• Outbound click data: the garments you choose to view on a merchant’s site. We do not process payments or collect payment card details, which stay between you and the merchant.
• Communications: messages you send us and your email preferences.

2. Camera access

Mirror only uses your camera during a scan, and only after you grant permission in your browser or device. You can revoke permission at any time in your browser settings; you will then be unable to complete a scan, but you can still browse.

3. How we use your information

• create and secure your account and Mirror ID;
• process your scan and generate try-on previews and size guidance;
• show you garments and brands that are relevant to you;
• send service messages such as email verification, password resets and security alerts;
• operate, maintain, troubleshoot and improve the Service, and measure how it is used;
• prevent fraud and abuse, and comply with legal obligations.

We do not sell your personal information, and we do not use your scan images or measurements for advertising.

4. Legal bases (where GDPR-style laws apply)

Where the GDPR, UK GDPR or similar laws apply, we rely on: your consent (for camera access and for processing body images and measurements, which you can withdraw at any time); performance of our contract with you (providing the Service); our legitimate interests (securing and improving the Service); and legal obligation.

5. Who we share information with

• Service providers that host our infrastructure, store images, send email or provide analytics, acting on our instructions.
• Sign-in providers (Google, Apple) when you choose to use them.
• Merchants and brands, but only the garment, size and colour you choose to try on or buy, which is what is needed to send you to the right product page. We do not give them your scan images or body measurements. Once you leave OAKFORM for a merchant’s site, the merchant’s privacy policy applies.
• Authorities or advisers where required by law, to protect rights and safety, or in connection with a merger, acquisition or sale of assets (we will notify you of any change in control that affects your data).

6. How long we keep it

We keep account information while your account is active. Scan images are kept only as long as needed to generate and refresh your try-on previews, and you can ask us to delete your scan data at any time. When you delete your account we delete or anonymise your personal information within 30 days, except where we must retain it by law (for example, purchase records) or to resolve disputes.

7. Security

We use encryption in transit, access controls, and short-lived signed session tokens to protect your information. No system is perfectly secure, so please use a strong, unique password and tell us right away if you suspect misuse.

8. Cookies and similar technologies

We use cookies and similar storage to keep you signed in, remember preferences, protect the Service, and understand how it is used. You can control cookies in your browser; blocking essential cookies may stop sign-in from working.

9. Your choices and rights

Depending on where you live, you may have the right to access, correct, delete or obtain a copy of your personal information, to opt out of certain processing, and to withdraw consent. Residents of California (CCPA/CPRA) and of other states with comprehensive privacy laws, such as Colorado, Connecticut, Virginia, Texas and Oregon, have these rights and the right not to be discriminated against for exercising them. We do not sell personal information or share it for cross-context behavioural advertising. If we deny a request you may appeal by replying to our response, and you may also contact your state attorney general. Residents of the EEA and UK may also lodge a complaint with their data protection authority.

To exercise any of these rights, email [email protected]. We may need to verify your identity first. You can also update your details and unsubscribe from marketing email at any time.

10. Children

OAKFORM is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child has given us information, contact us and we will delete it. Users under the age of majority should use Mirror only with a parent or guardian.

11. International transfers

OAKFORM is based in the United States and your information is processed and stored there, and in other countries where our providers operate. If you use the Service from outside the United States, you understand that your information will be transferred to the United States, which may have different data protection laws from your country. Where required, we use safeguards such as standard contractual clauses.

12. Changes to this policy

We may update this policy as the Service evolves. We will change the "Last updated" date and, for material changes, tell you by email or in the app before they take effect.

13. Contact us

Questions or requests about privacy? Email [email protected].