Privacy Policy

1. Who we are and what this covers

17100710 Canada Inc. ("Closynth", "we", "us", "our") is a company incorporated under the Canada Business Corporations Act, with its registered office in Ontario, Canada. We operate an AI-powered platform that generates on-model fashion imagery for ecommerce brands (the "Service").

This Privacy Policy explains what personal information we collect, why we collect it, how we use and share it, how long we keep it, and the rights you have. It applies to our website, our web application, and all related services. It applies to individuals in Canada, the European Economic Area, the United Kingdom, and the United States, including California.

This policy covers personal information. It does not restrict our handling of Customer Content (defined below), which is governed by our Terms of Service.

2. Definitions

• Personal information (or personal data) means information about an identifiable individual (for example, a name, email address, or billing details).
• Customer means the business that holds an account with us (typically a Shopify fashion brand).
• Customer Content means the garment images, collection data, prompts, settings, and other materials a Customer uploads to or configures within the Service.
• Generated Output means the AI-generated on-model images the Service produces from Customer Content.
• AI Models in our Service are synthetic. They are generated by artificial intelligence and do not depict real, identifiable people.

3. Information we collect

Account and identity information. When you create an account, we collect your name, email address, company name, and authentication credentials. Authentication is handled by our provider, Clerk. We do not store your password.

Billing information. When you subscribe, our payment processor, Stripe, collects and processes your payment card and billing details. We do not store full payment card numbers on our systems. We retain records such as your billing name, billing address, plan, and transaction history.

Customer Content. We process the garment images, collection data, prompts, and configuration you upload or set within the Service in order to generate imagery for you, and to improve the Service (see Section 6). Garment images are generally not personal information. If you upload an image that contains a real, identifiable person, that image contains personal information and you are responsible for having the rights and consents required to upload it (see our Acceptable Use Policy).

Usage and technical information. We automatically collect information about how you use the Service, including IP address, device and browser type, log data, timestamps, pages viewed, and actions taken. We collect some of this through cookies and similar technologies (see Section 12).

Communications. If you contact us for support or otherwise correspond with us, we keep those communications and any information you include in them.

4. How we use your information

We use personal information to:

• create, authenticate, and manage your account;
• provide, operate, and maintain the Service, including generating imagery from your Customer Content;
• improve, evaluate, and develop the Service and our AI models (see Section 6);
• process payments and manage subscriptions and invoicing;
• provide customer support and respond to your requests;
• monitor, secure, and improve the Service, including debugging, fraud prevention, and abuse detection;
• send you service-related communications (for example, account, billing, or security notices);
• send you marketing communications where permitted, which you can opt out of at any time; and
• comply with our legal and regulatory obligations.

5. Our legal basis and your consent

We collect, use, and disclose personal information with your consent, or as otherwise permitted or required by law. By creating an account and using the Service, you consent to the practices described in this policy. Where we rely on consent, you may withdraw it at any time, subject to legal or contractual restrictions and reasonable notice, by contacting our Privacy Officer (Section 15). Withdrawing consent may mean we can no longer provide the Service.

Where the EU/UK General Data Protection Regulation applies, we rely on the following legal bases:

• Performance of a contract, to provide the Service you sign up for;
• Legitimate interests, to secure, operate, and improve the Service and to develop our AI models, balanced against your rights and interests;
• Consent, for marketing communications and any optional processing; and
• Legal obligation, to meet our tax, accounting, and regulatory duties.

6. AI processing, Customer Content, and Generated Output

To provide the Service, we send Customer Content to third-party AI providers that generate imagery on our behalf. These currently include Vertex AI / AI Studio. Customer Content processed by these providers is subject to their terms and privacy practices, and these providers may retain data for a limited period for their own abuse-monitoring and operational purposes. We work to limit this retention and to use enterprise configurations that reduce data retention where available.

The AI Models used to produce Generated Output are synthetic and do not represent real individuals. Generated Output does not depict identifiable people, so it does not require a model release.

Automated decision-making. The Service uses AI to generate images. It does not use your personal information to make automated decisions that produce legal or similarly significant effects about you.

Training on Customer Content

We use Customer Content, including your uploaded garment imagery, to train, fine-tune, evaluate, and improve the Service and our AI models. We do this to make the Service more accurate and reliable for you and for all Customers. We do not sell your Customer Content.

Where required, we rely on your consent and our legitimate interests as the basis for this use. You may opt out of the use of your Customer Content for training and model development by contacting our Privacy Officer (Section 15). Opting out does not affect our ability to process your Customer Content to deliver the Service to you.

Please note that once Customer Content has been incorporated into a trained or fine-tuned model, it may not be technically possible to remove its influence from that model. Deleting your account or Customer Content removes it from active processing and storage as described in Section 9, but does not necessarily reverse training already performed on de-identified or aggregated data.

7. How we share your information

We do not sell your personal information. We share it only as follows.

Service providers (sub-processors). We use trusted third parties to operate the Service. They may process personal information only on our instructions and for the purposes we specify.

Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction. We will require the recipient to honour the commitments in this policy.

Legal and safety. We may disclose personal information where required by law, to respond to lawful requests, to enforce our agreements, or to protect the rights, safety, and property of Closynth, our Customers, or others.

8. Cross-border transfers

Closynth is based in Canada. A few of our service providers are located outside Canada, including in the United States. When your personal information is processed outside your province or country, it is subject to the laws of those jurisdictions, and foreign governments, courts, or authorities may be able to access it under those laws. We take reasonable steps to ensure any provider we use protects your information to a standard comparable to this policy and applicable law.

If you are in the EEA or UK, we transfer your personal data outside your region only where a lawful transfer mechanism applies, such as an adequacy decision or Standard Contractual Clauses (and the UK Addendum where relevant), together with any additional safeguards required. If you are in Quebec, we assess the protection your information will receive before transferring it outside the province.

9. How long we keep your information

We keep personal information only as long as necessary for the purposes described in this policy, or as required by law.

• Account information: for as long as your account is active, and for [12] months after closure, unless a longer period is required by law.
• Billing and tax records: for [7] years, to meet Canadian tax and accounting requirements.
• Customer Content and Generated Output: for as long as your account is active. On account closure, we delete or de-identify Customer Content within [30] days, subject to backup retention cycles. [Adjust to match your actual data-lifecycle.] See Section 6 regarding data already used for model training.
• Usage logs: for [12] months.

When we no longer need personal information, we delete or de-identify it using reasonable measures.

10. How we protect your information

We use administrative, technical, and physical safeguards designed to protect personal information against loss, theft, and unauthorized access, use, or disclosure. These include encryption in transit, access controls, authentication through Clerk, and payment handling through PCI-compliant Stripe. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

If we become aware of a breach of security safeguards involving your personal information that creates a real risk of significant harm, we will notify you and the relevant authorities as required by applicable law.

11. Your rights

Subject to applicable law, you may:

• access the personal information we hold about you;
• correct information that is inaccurate or incomplete;
• withdraw consent to our collection, use, or disclosure of your information;
• opt out of the use of your Customer Content for model training (Section 6);
• request deletion of your information; and
• ask questions or complain about how we handle your information.

To exercise any of these rights, contact our Privacy Officer (Section 15). We will respond within the timeframe required by law. We may need to verify your identity before acting on a request.

11. A) Additional rights for Quebec residents (Law 25)

If you are in Quebec, you also have the right to data portability (to receive your computerized personal information in a structured, commonly used technological format) and the right to request that we stop disseminating your information or de-index a link where the law allows. We have designated a Privacy Officer responsible for our compliance, whose contact details are in Section 15. Where we transfer personal information outside Quebec, we assess the protection it will receive before doing so.

11. B) Additional rights for individuals in the EEA and UK (GDPR)

If the GDPR or UK GDPR applies to you, you also have the rights to restriction of processing, to object to processing (including to processing based on legitimate interests, such as model development), to data portability, and to lodge a complaint with your local supervisory authority. Our legal bases for processing are described in Section 5.

11. C) Additional rights for California residents (CCPA/CPRA)

If you are a California resident, you have the rights to know what personal information we collect and how we use and disclose it, to request deletion and correction, to opt out of the sale or sharing of your personal information, and to be free from discrimination for exercising your rights. We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under California law. To exercise these rights, contact us using the details in Section 15.

12. Cookies and similar technologies

We use cookies and similar technologies to keep you signed in, remember your preferences, secure the Service, and understand how it is used. Essential cookies are required for the Service to function. You can control non-essential cookies through your browser settings or any cookie controls we provide. Disabling essential cookies may prevent parts of the Service from working. [If you use analytics or marketing cookies, list categories here or link to a separate Cookie Policy. Note that the EU/UK generally require prior consent for non-essential cookies, so a consent banner will be needed for those visitors.]

13. Children

The Service is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under the age of majority in their jurisdiction. If you believe a minor has provided us personal information, contact us and we will delete it.

14. Changes to this policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date above and, for material changes, provide additional notice through the Service or by email. Your continued use of the Service after an update means you accept the revised policy.

15. Contact us and Privacy Officer

We have designated a Privacy Officer who is responsible for our compliance with applicable privacy laws. To ask a question, exercise a right, or make a complaint, contact:

Privacy Officer
Closynth
2727 Steeles Ave West

Unit 103-786
Toronto, ON
M3J 3G9
privacy@closynth.com

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada, or, if you are in Quebec, the Commission d'accès à l'information du Québec. If you are in the EEA or UK, you may contact your local data protection supervisory authority.