Privacy Policy

1. Controller

The controller of your personal data is archBO s.r.o., Korunní 2569/108, 101 00 Prague, Czech Republic, company registration number (IČO) 01944711, registered in the Commercial Register kept by the Municipal Court in Prague, file no. C 285018.

You can reach us in all data protection matters at info@looktwin.com or on +420 725 543 392. We have not appointed a data protection officer; the e-mail address above is the contact point for data subjects.

Where this policy says photographs of your face, it means the photographs you upload (references) and, for orders placed before 22 September 2026, also the personal AI model derived from them.

2. Categories of data we process

Account data: e-mail address, authentication identifiers and, if you provide it, the name you give to an order. Created when you register.

Photographs of your face (references): the images you upload and from which your portraits are created. Because they are processed by a specific technical means that produces a mathematical representation of your face, we treat them as biometric data, i.e. a special category of personal data under Art. 9 GDPR.

The trained model (orders placed before 22 September 2026 only): the personal AI model derived from your photographs. It is treated with the same protection as the photographs. No such model is created for newer orders.

Generated photographs: the portraits the Service creates from your references — first a few previews visibly marked LookTwin, after payment a set without the mark. They depict you and are therefore personal data. All of them carry a machine-readable note that they were created by artificial intelligence.

Your choices for the order: what you want to wear, in which setting, and which of the preview portraits you marked. Used only to create your portraits.

A salted hash of the e-mail address used for the preview portraits. We keep it so that one person cannot start the creation of previews an unlimited number of times. We do not store the address itself for this purpose and it cannot be recovered from the hash.

An e-mail address entered before it is verified: we start creating the preview portraits straight after you enter it and send it an e-mail with a verification code and one e-mail saying they are ready — with a link that confirms the address, or deletes the uploaded photographs and the account. If you do not finish the order, we send it one more reminder of the unfinished order (section 3) with an offer to buy the preview portraits, in which the marked preview portraits are shown, and a day later one short reminder of that offer without images. These e-mails include a link that confirms the address and a link to delete; we send each of them at most once a day to one address and never to an address that already belongs to an account with a verified address. If you delete the account with that link, we keep a salted hash of the address, not the address itself, so that we never e-mail it again. We send no other e-mails to an unverified address; the address must be verified before payment.

A salted hash of the IP address together with the date, when preview portraits are created for an e-mail address you have not yet verified. We keep it so that one network cannot create an unlimited number of previews per day for made-up addresses. We do not store the IP address itself for this purpose and it cannot be recovered from the hash. Legal basis: Art. 6(1)(f) GDPR (prevention of misuse).

Payment and transaction data: the record of which package was ordered and whether and when it was paid for, the payment reference from the payment service provider, and the payment data processed by Stripe. We never see and never store your card number.

Order records: which package was ordered, which order it concerns, and whether the generated photographs have already been delivered.

Consent records: your user identifier, the kind and version of the consent, the time it was given, and a salted hash of the IP address from which it was given. We do not store the IP address itself in the consent record.

Usage and technical data: usage events (generation runs, quantities, provider request identifiers), rate-limit counters, and server and error logs generated by our hosting provider, which may contain an IP address.

Record of your journey through the app: which steps of the wizard you opened and when, how long they took, which buttons you tapped (only their label), which error messages were shown to you, when you reloaded or left the page, whether from a phone or a computer, and in what type of browser (for example Safari on an iPhone; no version and no device model). Nothing you type and none of your photographs are stored, and this is not screen recording. Purpose: finding out where customers get stuck and fixing it. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a working service).

Referral data: the advertising click identifier (gclid, wbraid, gbraid, fbclid, msclkid), campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content), the address of the page you arrived on, the address of the page you came from, and your Google Analytics visitor identifier. We record these when you register and when you start a payment, and we store them with your account.

3. Purposes and legal bases

Preview portraits before the order — from the uploaded photographs we create a few portraits visibly marked LookTwin so that you see the result before you pay and can mark the ones that look most like you. Legal basis for processing the photographs of your face: Art. 9(2)(a) GDPR — your explicit consent. Without it the portraits cannot be created, because processing the photographs is their very substance.

Providing the paid Service — creating and running your account, creating the set of portraits according to your choices after payment of the package, storing them for you and delivering them in full size, sending service e-mails such as the notification that the set is ready. Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

Processing the photographs of your face (and, for earlier orders, the model derived from them). Legal basis: Art. 6(1)(b) GDPR for the contract and, in addition and cumulatively, Art. 9(2)(a) GDPR — your explicit consent to the processing of a special category of data. Without that consent we cannot provide the Service at all, because processing the photographs is its very substance.

Security, abuse prevention and protection of the Service — usage limits, quotas, filtering of prohibited requests, logs, investigation of incidents. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure and available service and in preventing misuse of an image-generation tool).

Accounting, tax and record-keeping — the accounting documents for the payment and the records of payments and orders. archBO s.r.o. is not registered for value added tax, so we keep no VAT records about you. Legal basis: Art. 6(1)(c) GDPR (compliance with a legal obligation).

Handling complaints and establishing, exercising or defending legal claims. Legal basis: Art. 6(1)(c) and Art. 6(1)(f) GDPR.

Measuring the effectiveness of our advertising — establishing which campaign a registration and a paid order came from, so that we know which advertising is worth paying for. For this we process referral data together with the fact that an order was paid, its amount and its currency. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in measuring the return on our advertising spend). Storing and reading information on your device for this purpose is done on the basis of your consent under Art. 5(3) of Directive 2002/58/EC as implemented in your country. You may object at any time to processing based on our legitimate interest by writing to info@looktwin.com; we will comply and delete the record.

Sending news and offers by e-mail — only if you tick the box “Send me occasional news by e-mail” at registration. We process your e-mail address for this purpose until you withdraw the consent. Legal basis: Art. 6(1)(a) GDPR (consent) together with the national rules on commercial electronic communications. You can withdraw the consent at any time by writing to info@looktwin.com; withdrawal does not affect the lawfulness of e-mails sent before it.

Reminder of an unfinished order — if you create preview portraits and do not finish your order, we send you at most two e-mails about it: the first reminds you of the order and may offer to buy exactly those preview portraits without marking, the second briefly reminds you of that offer a day later. For this we process your e-mail address and the details of the unfinished order. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in offering you to complete an order you showed interest in). You can object at any time by replying to the e-mail or writing to info@looktwin.com; we will then not send you offers.

We do not use your photographs or generated images for marketing or as references, and we do not sell personal data. We do not profile you and we do not build an individual offer or price from your behaviour (the exceptions are a time-limited discount for new customers, identical for everyone and counted from the first time the price is shown, and the offer to buy your own preview portraits in the reminder of an unfinished order, identical for everyone); the measurement described in the previous paragraph concerns only which advertising campaign brought in an order.

4. How long we keep the data

Uploaded photographs (references): stored in a private bucket and deleted no later than 30 days after upload. They are deleted earlier when you delete the order or when you ask us to. Important: the references are the only thing your portraits are created from — once they are deleted, no photograph can be added to or re-shot for the order; the finished portraits, however, remain available to you for the period stated below.

Preview portraits created before the order: 30 days from creation, then deleted automatically.

Preview portraits you purchased (purchase of previews): a 2K copy kept in private storage and available for at least 12 months from payment; deleted together with the order, the account or on withdrawal of consent.

The salted hash of the e-mail address used for previews: 30 days, then deleted.

The salted hash of the IP address used for previews: 30 days. An e-mail address entered before verification: 30 days; if it stays unverified and nothing is paid, after 30 days we also delete the account with the uploaded photographs and previews (a verified address is part of the account data).

The trained model (orders placed before 22 September 2026 only): kept in private storage for as long as the order exists in your account, at most 12 months from payment. Deleting the order deletes the model weights. The training archive (ZIP) of those orders was deleted immediately after training finished.

Generated photographs: kept in a private bucket and available to you for at least 12 months from the payment of the package. The application does not currently have a delete button for an individual photograph: you remove generated photographs by deleting the order, which deletes all photographs created from it, or by withdrawing your consent in the Account section, which deletes all orders and all photographs. If you want a single photograph removed, write to info@looktwin.com and we will delete it.

Account data: kept until you delete the account, after which it is removed together with the related storage objects.

Payment records, order records and usage events: kept for as long as required by accounting and tax law.

Consent records: kept as evidence that consent was given (Art. 7(1) GDPR) for as long as the processing based on the consent continues, and afterwards for the period in which claims can still be raised.

Technical logs: kept according to the default retention of our hosting provider and used only to operate and secure the Service.

Record of your journey through the app: 90 days, then deleted automatically; immediately when your account is deleted.

Referral data: the cookie in your browser for at most 90 days; the record in our database for at most 25 months from the day it was created, and in any event only until your account is deleted, with which it expires. Whichever period is shorter applies.

At the AI processor: we instruct fal to retain nothing beyond what is needed to create the photographs. Generated photographs expire at the processor within about an hour of delivery; we copy them into our own private storage, so the copies at the processor are only an intermediate step. For orders placed from 22 September 2026 no model is trained, so nothing permanent is created at the processor; for earlier orders the trained model was deleted at the processor within seven days of being copied to us.

5. Who processes the data for us

fal — Features and Labels, Inc., San Francisco, USA. Operates the artificial-intelligence models that create portraits from your references (and, for orders placed before 22 September 2026, trained a personal model). Acts as a processor under a public data processing addendum which incorporates the EU Standard Contractual Clauses, Module 2 (governed by Irish law), and which is bound by a contractual commitment not to use client content to create, train or develop its own products or services. Processing takes place in the USA.

Supabase (Supabase Pte. Ltd.) — database, authentication and file storage. Our project is hosted in the EU region eu-central-1 (Frankfurt). Data processing addendum with the Standard Contractual Clauses, Modules 2 and 3. Some support functions may be performed from the USA.

Vercel Inc. — hosting and delivery of the application. Certified under the EU-US Data Privacy Framework. Primary processing takes place in the USA.

Resend — sending transactional e-mails (for example the notification that your photographs are ready). We never send photographs by e-mail; e-mails contain only your address, your name if you gave one, and a link into the application behind login.

Stripe — payment processing. For part of the processing (fraud prevention, anti-money-laundering and legal compliance) Stripe acts as an independent controller, not as our processor.

Google Ireland Limited and Google LLC — Google Analytics 4 and Google Ads. We transmit your Google Analytics visitor identifier, the advertising click identifier and the fact that an order was paid, together with the order number, the amount and the currency. We do not transmit your name, your e-mail address or any photograph to Google. The transfer only happens if you have accepted marketing cookies.

Meta Platforms Ireland Limited — measuring the effectiveness of advertising on Facebook and Instagram (Meta Pixel and Conversions API). We transmit the browser identifier assigned by Meta (the _fbp and _fbc cookies), the address of the page you viewed, the fact that you had preview portraits created, and the fact that an order was paid, together with the order number, the amount and the currency. In doing so your browser tells Meta its IP address and browser type. We do not transmit your name, your e-mail address or any photograph to Meta. The transfer only happens if you have accepted marketing cookies.

Cloudflare, Inc. — the Turnstile service, which verifies on our sign-in and sign-up forms that you are not an automated program. In doing so it processes your IP address and technical data about your browser. Without this check no account can be created and no sign-in is possible, so this processing is necessary to provide and to secure the Service.

Each processor is bound by a contract under Art. 28 GDPR. The list of processors in force at any time is available on request at info@looktwin.com.

6. Transfers outside the European Economic Area

The creation of photographs takes place at fal in the United States, and parts of the hosting and e-mail infrastructure are also operated from the United States. Your photographs therefore leave the European Economic Area.

fal is not certified under the EU-US Data Privacy Framework. The transfer is based on the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module 2 (controller to processor). The same applies to Supabase. Vercel and Stripe are certified under the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795), which provides an adequacy decision for those transfers.

Where a transfer relies on the Standard Contractual Clauses, we prepare and keep under review a transfer impact assessment in line with the recommendations of the European Data Protection Board, and we apply the additional measures available to us: private storage, access only through short-lived links, instructions to the processor to retain nothing beyond what the service requires, and the contractual prohibition on training.

We are honest about the limit of these measures: photographs must reach the AI processor in a readable form in order to create the portraits, so encryption cannot be used to make them inaccessible to the provider. If this residual risk is unacceptable to you, please do not use the Service.

Google and Cloudflare are certified under the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795), which constitutes an adequacy decision for transfers to the United States. The referral data and the order-paid data transmitted to Google contain neither your name, nor your e-mail address, nor any photograph.

You can request a copy of the Standard Contractual Clauses at info@looktwin.com.

7. Your rights

You have the right of access to your data and to a copy of it; the right to rectification; the right to erasure; the right to restriction of processing; the right to data portability; and the right to object to processing based on our legitimate interest.

Where processing is based on consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it.

You can exercise most of these rights yourself: the application lets you delete an order together with its uploaded photographs and all photographs created from it, and the Account section lets you withdraw all your consents and delete every order and photograph at once. Withdrawing consent deletes the orders and photographs but keeps your account, your consent records, your accounting documents and the record of which advertisement brought you here; you remove those with the Delete account button directly below it. For anything else, or to delete your entire account, write to info@looktwin.com. We reply within one month; in complex cases we may extend this by two further months and we will tell you if we do.

You also have the right to lodge a complaint with a supervisory authority. Our lead authority is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, uoou.gov.cz. If you live in Poland you may instead complain to the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl, or to the supervisory authority of your habitual residence.

8. Withdrawing consent and deleting your data

Withdrawing the consent to the processing of the photographs of your face means that we can no longer process your photographs. Withdrawal therefore leads to the deletion of all your orders together with the uploaded references and all portraits created from them, including the previews (and, for earlier orders, the trained model). Download the portraits you want to keep before you withdraw.

You can do this yourself in the application: the Account section contains a single button, Withdraw consent and delete everything, which marks your consent to the processing of the photographs of your face (and any statement you made about the start of delivery before the withdrawal period expired) as withdrawn and deletes every order on your account together with the uploaded photographs and the created photographs. Deleting a single order has the same effect for that order, and when it is your last order your consent to the processing of the photographs of your face is marked as withdrawn as well. You can also write to info@looktwin.com. Withdrawing consent is as easy as giving it and costs nothing.

Once a consent is marked as withdrawn, it no longer counts: no new order can start until you give the consent again, which the application asks for before the next order. Even without withdrawal, the uploaded references are deleted automatically no later than 30 days after upload.

Withdrawing consent does not close your account. Your acceptance of the Terms of Service and your declaration that you are over 18 are not consents under the GDPR but contractual declarations, so they are not withdrawn by this button and the record of them stays: without them the account would have no contractual basis. If you have paid for a package and have generated photographs, withdrawing this consent deletes those photographs as well — download them first. To have the account itself deleted, write to info@looktwin.com.

Data that we must keep for accounting or tax reasons, and the record that a consent was given and later withdrawn, is retained even after deletion, because a legal obligation applies to it.

9. Automated decision-making

The Service generates images automatically, but it does not take decisions about you that produce legal effects or similarly significantly affect you within the meaning of Art. 22 GDPR.

Automated checks that we do run are: quality checks on uploaded photographs in your browser, a filter on the free-text field, safety filtering at the AI processor, and usage limits. Their only consequence is that a specific request is rejected or a photograph is excluded from the references; you can always contact us and have this reviewed by a person.

We do not profile you and we do not set prices individually based on automated processing.

10. Security

Your uploaded photographs and the created photographs (and, for earlier orders, your model) are stored in private storage that has no public addresses. They are made accessible to you only through short-lived signed links.

Database access is restricted by row-level security so that a logged-in user can read only their own rows. Writes that affect orders are performed only by our server using a service-role key that is never exposed to the browser.

Transport is encrypted with TLS and storage providers encrypt data at rest.

We do not claim any certification. We describe here only the measures that are actually implemented in the Service.

11. Children

The Service is intended solely for adults. We do not knowingly process the data of persons under 18 and we do not permit the uploading of photographs of children under any circumstances.

If you believe that a child's photograph has been uploaded to LookTwin, write to info@looktwin.com and we will delete it without undue delay.

12. Cookies, local storage and analytics

Strictly necessary cookies, which cannot be refused because the Service does not work without them: the Supabase sign-in cookies (sb-*), which keep you logged in, and the Cloudflare Turnstile cookies, which verify that a form is not being submitted by an automated program.

Analytics and marketing cookies, which we only set once you accept them in the consent banner: the Google Analytics cookies (_ga and _ga_*), valid for at most two years, the Meta cookies (_fbp and _fbc), valid for at most 90 days, and our own lt_zdroj cookie, valid for at most 90 days, in which we record the advertising click identifier and the campaign parameters when you arrive from an advertisement. Until you give consent none of them is set, Google Analytics stores nothing on your device and the Meta measurement code is not loaded into the page at all.

You can withdraw your consent at any time by deleting these files in your browser settings; we will ask you again on your next visit.

Local storage of your browser: we store your language preference and your choice in the consent banner there. This data never leaves your browser.

We also use Vercel Analytics to measure aggregate traffic. According to the provider it does not use cookies and does not track individual visitors across sites.

13. Changes to this policy

We may update this policy when the Service, the processors or the law change. Every version carries a version number and an effective date.

If a change materially affects how we process your data, we will inform you by e-mail before it takes effect, and where the change concerns processing based on consent, we will ask for your consent again.

14. Effective date

This version 2.8 of the Privacy Policy applies from 11 October 2026; compared with version 2.7 it adds the type of browser to the record of your journey through the app (section 2); version 2.7 (applicable from 2 October 2026) compared with version 2.6 added a second e-mail about an unfinished order (sections 2 and 3); version 2.6 (applicable from 27 September 2026) compared with version 2.5 added the measurement of advertising effectiveness on Facebook and Instagram (Meta) to the recipients of data and to the cookies (sections 5 and 8); version 2.5 (applicable from 25 September 2026) compared with version 2.4 added the reminder of an unfinished order also to an unverified e-mail address (section 2); version 2.4 compared with version 2.3 added the e-mail address entered before it is verified and the salted hash of the IP address used for previews (sections 2 and 4); version 2.3 compared with version 2.2 added the record of your journey through the app (sections 2 and 4), and version 2.2 compared with version 2.1 added the reminder of an unfinished order (section 3), and version 2.1 compared with version 2.0 (applicable from 22 September 2026) added the retention period for purchased previews. Compared with version 1.6 it describes the new way portraits are created: for orders placed from that date no personal model is trained from the uploaded photographs — they serve as references from which artificial intelligence creates new photographs; a few preview portraits with a visible mark are created before the order. It newly lists the salted hash of the e-mail address used for previews (30 days) and a retention of 30 days from upload for the references. For orders placed earlier, the previous rules for the trained model continue to apply for as long as it is stored.

This version 1.4 of the Privacy Policy applies from 3 September 2026. Compared with version 1.3 it shortens the retention of uploaded photographs (training selfies): we delete them no later than 30 days after the model has been trained, and unfinished uploads within 48 hours. The retention of the trained model and the generated photographs is unchanged. Version 1.3 (effective 25 August 2026) added the description of advertising effectiveness measurement, listed Google and Cloudflare among our processors, and replaced the earlier statement that we do not use advertising or tracking cookies.