Privacy Policy

Last updated: July 20, 2026

1. Operator (Data Controller)

CabinApp is operated by RA. SOFT LTD, a limited company registered in England and Wales. The CabinApp brand and its related rights and obligations are held by RA. SOFT LTD.

Company number: 17199432
Registered address: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ

Support email: support@cabinapp.co
Privacy: privacy@cabinapp.co

CabinApp ("we", "our", or the "Service") is operated by RA. SOFT LTD. This Policy explains what personal data we collect, how we collect it, every purpose for which we use it, and the service providers with whom it may be shared.

2. Data We Collect and How We Collect It

2.1 Data you provide

Account data: name, email address, and authentication identifiers.
Profile data: age, gender, height, weight, and optional body measurements.
Image data: profile/body photos you capture or select, garment/product images you upload or import, saved model photos, and generated try-on, Studio, angle, and video results.
AI instructions: selected size/model/scene/motion options and any optional free-text instruction you enter.
Support messages and choices you make inside the Service.

2.2 Data collected automatically

Session, device type, app version, language, and basic diagnostic data.
Feature usage, credit/subscription status, generation history, and security logs.
Consent evidence: consent surface, policy version and hash, selected language, timestamp, operation, and limited request metadata.

We receive this data directly from your entries and selected photos, from your use of the app, from Apple/Firebase authentication, and from payment providers. We do not receive or store your full payment-card number.

3. How We Use Data

Authenticate your account and provide customer support.
Create virtual try-on, Cabin Studio, angle, 360, and video results.
Provide an optional AI size recommendation from your saved measurements.
Screen images for safety and prevent unlawful or abusive content.
Store your private library and synchronize it across your account.
Operate subscriptions and credits, prevent fraud, diagnose faults, and secure the Service.
Comply with legal obligations and enforce our terms.

We do not sell personal data or uploaded photos and do not place them in public galleries.

4. Third-Party AI Processing and Your Permission

Before any supported AI action sends personal data outside CabinApp, the app displays a language-matched disclosure naming the data, recipient, and purpose. The AI action remains disabled until you actively check the permission box. Permission is requested for the relevant action; declining it prevents that transfer and does not prevent use of non-AI account features.

4.1 Google LLC — Gemini API and Google Cloud Vision

Data sent: the person/body or model photo, garment/product image, an existing generated result, selected scene/model instructions, and, only for size recommendation, relevant measurements.
Purpose: virtual try-on and Studio image generation, optional size recommendation and Studio backdrop processing (Gemini); image safety screening (Cloud Vision SafeSearch).

4.2 OpenAI, L.L.C. — OpenAI API, only when the server fallback is enabled

Data sent: the person/body image, garment/product image, and generation instruction required for that requested result.
Purpose: image editing/generation if the configured primary generation path cannot be used.

4.3 fal – Features & Labels, Inc. (fal.ai) — video and 360 generation

Data sent: the selected source or generated person image, relevant start/end frames, and selected motion, duration, and scene instructions.
Purpose: produce the video or 360 animation you request.

We do not include your name, email address, authentication credentials, or payment information in AI-generation requests. We require each AI processor to handle the transferred data under contractual, confidentiality, security, and data-protection obligations that provide the same or equivalent protection required by this Policy and applicable law. Provider information: Google Privacy Policy, Gemini API Terms, OpenAI Privacy Policy, fal Privacy Policy, and fal API Services Terms.

5. Other Service Providers

We also use Google Cloud / Firebase (authentication, database, and private storage), Vercel (web/API hosting), Apple and RevenueCat (subscriptions and entitlement status), Stripe where web payments are offered, Resend / Zoho Mail (service email), and limited analytics/diagnostic services. They receive only the data needed to perform their service and may not use it for their own unrelated marketing.

6. Legal Bases

Depending on your location and the operation, we process data to perform our contract with you, on the basis of your explicit permission for third-party AI sharing, to comply with law, and for legitimate interests such as security, fraud prevention, and service reliability where those interests do not override your rights.

7. Storage, Retention, and Deletion

Account/profile data and your private saved photos/results remain while your account is active or until you delete the relevant item.
Account deletion removes associated active-system personal data within 30 days, except records we must retain for legal, fraud-prevention, transaction, or compliance purposes and limited backup cycles.
Google Cloud Vision states that images submitted through its online API are processed in memory and are not persisted as part of that service.
For fal requests, CabinApp disables platform request/response payload storage where the provider supports it. Temporary generated-media delivery files may remain for the provider's operational lifecycle before expiry.
Where OpenAI API abuse-monitoring logs apply, they may be retained for up to 30 days unless law or a security investigation requires longer retention.
Consent records may be retained as needed to demonstrate compliance and defend legal claims; they do not permit a new AI transfer after you decline permission.

8. Security and International Transfers

We use TLS in transit, platform encryption at rest, private object storage, owner-scoped authorization, least-privilege access, and operational reviews. Providers may process data outside your country. Where required, we use lawful transfer safeguards and processor terms designed to preserve equivalent protection. No system can guarantee absolute security.

9. Your Choices and Rights

Decline or leave the AI-sharing checkbox unchecked; no covered AI transfer occurs.
Withdraw permission for future AI transfers at any time by not approving the next action.
Delete individual saved photos/results or request account deletion in Account > My Data.
Request access, correction, deletion, restriction, objection, or portability where applicable.
Complain to your local data-protection authority.

A completed generation cannot be retroactively undone, but withdrawal stops new covered transfers. You may also contact privacy@cabinapp.co.

10. Age Requirement

AI photo-generation features are intended for people aged 18 or older. Do not upload a recognizable third party without the necessary rights and permission.

11. Cookies and Analytics

We use essential session technologies and limited operational diagnostics to secure and keep the service reliable. The iOS app does not send optional app-open, tap, advertising, or cross-app tracking events. Our website may use Vercel Web Analytics and server-side Sentry diagnostics where permitted; these are not used for third-party advertising or cross-app tracking. Website cookie choices can be changed through the available cookie settings.