NOTRE POLITIQUE

PRIVACY POLICY​

Last Updated: 16 JUN 2026

1. Who we are

This Privacy Policy describes how ABODY AI INC. ("Abody", "we", "us", "our") collects, uses, and shares information when you use the Abody mobile application (the "App") and related websites, AI features, and services (collectively, the "Services").

• Legal entity: ABODY AI INC.

• Registered address: 15 Wellesley St. W, Unit 201, Toronto, Ontario, Canada M4Y 0G7

• Contact: privacy@abody.ai

• Data Protection Officer: dpo@abody.ai

We are the data controller for personal data processed through the Services, except where this Policy says otherwise (for example, payment data processed by the app store, or AI processing by Google as a sub-processor).

2. Scope and acceptance

This Policy applies whenever you use the App, create an account, take a body scan, save a photo, generate AI content, subscribe to Abody Track or Abody Studio, or otherwise interact with the Services. By using the Services you confirm you have read this Policy. If you do not agree, do not use the Services.

3. Summary - what we collect at a glance

We do not collect: precise geolocation, contacts, SMS, microphone audio, calendar, browsing history outside the App, or biometric identifiers (we measure your body - we do not run face- or fingerprint-based identification).

4. How we collect personal data

• Directly from you when you register, sign in (email/password, Sign in with Apple, Sign in with Google, Sign in with Facebook), enter height/weight/age/sex, capture body-scan photos, upload progress photos or virtual-closet items, write a feedback message, or buy a subscription.

• Automatically from your device when you use the App: device model, OS, language, time zone, Firebase Installation ID, FCM push token, crash reports, analytics events.

• From third parties:

  • Apple, Google, Facebook (for social sign-in - name, email, social user ID).

  • Apple App Store and Google Play (for purchase receipts and subscription status, via RevenueCat).

  • Cloud sub-processors (described in Section 9).

5. How we use personal data, and the legal basis

Sensitive data - explicit consent

Body measurements, body composition, and progress photos are treated as health data. We process them only with your explicit consent, given when you create an account or run your first scan. You can withdraw consent at any time by deleting the data or your account (Section 12).

6. AI features and AI processing

The App offers four AI-powered features, all of which send your input to third-party AI processors:

Important AI disclosures:

• AI output is machine-generated and may be inaccurate, unflattering, or contain artifacts. It is not medical advice and not a substitute for a tailor's measurement.

• We do not use your photos or measurements to train Abody's own AI models. Inputs sent to Google Cloud AI are processed under Google's enterprise terms and are not used to train Google's foundation models (see Google's policy).

• We do not sell AI-generated images.

• AI-generated images include an invisible watermark identifier that ties the image back to your account for abuse prevention.

7. Photos, camera and on-device storage

• Camera permission is required only when you actively start a body scan or capture a progress photo. We never take photos in the background.

• Photos / Media permission is required only when you pick a photo from your library (closet upload, custom try-on photo, progress photo).

• Local storage: Your scan history, measurement history, virtual closet, lookbook, streak data, and weight log are stored locally on your device in an encrypted SQLite database. They sync to your account on the Abody servers so you can access them from another device.

• Image processing: Body-scan photos are uploaded to Abody's body-shape-estimation service hosted on Google Cloud to compute your measurements and refine the result. Photos used as AI inputs (Real Try-On, Future Body, Surprise Me, Daily Drops) are forwarded to Google Cloud AI.

• 3D body model: When enabled (currently behind a feature flag), a GLB mesh is generated from your measurements and stored to your account for the lookbook feature.

8. Identifiers, analytics, and advertising

• Firebase Installation ID identifies your install for Firebase Analytics, Crashlytics, Remote Config, and A/B Testing. It is reset when you reinstall the App.

• FCM token is used to deliver push notifications. It is reset on reinstall and rotates periodically.

• Crashlytics collects crash stack traces, device model, OS version, app version, and a non-identifying installation ID. We use it to diagnose bugs.

• Firebase Analytics records anonymized events (screen views, feature taps, Magic Credit spends, subscription state, experiment exposure). We use it to understand which features are useful and to run A/B tests on AI models and pricing. Personal identifiers (email, name) are never sent to Analytics.

• Advertising: Abody does not show third-party ads, does not use Google AdMob, does not track you across other apps, and does not share any data with ad networks.

9. Who we share data with (sub-processors)

We share personal data with these processors strictly to operate the Services:

We do not sell or rent personal data, and we do not share data with data brokers.

10. International data transfers

Abody is operated from Canada. Your data may be transferred to and processed in the United States, the European Union, Japan, and other regions where our sub-processors operate. When data is transferred out of the EEA / UK / Switzerland, we rely on EU Standard Contractual Clauses (and the UK Addendum) executed with each sub-processor.

11. Data retention

12. Your rights and choices

Subject to applicable law (GDPR, UK GDPR, CCPA/CPRA, Quebec Law 25, etc.) you have the right to:

• Access your personal data and receive a copy

• Correct inaccurate data (most fields editable in-app)

• Delete your data ("right to erasure")

• Restrict or object to certain processing

• Withdraw consent for AI features, marketing, or sensitive data processing

• Data portability - export your scans, photos, and measurements

• Lodge a complaint with your data protection authority

How to exercise your rights

• From the App: Settings -> Account -> Delete account, and Settings -> Notifications to control push categories.

We will never charge a fee for the first request in a 12-month period, and we will never require you to create an account just to delete data captured before account creation.

13. Account deletion

To delete your Abody account and all associated data:

• In-app: Open Abody -> Settings -> Account -> Delete account. You will be asked to re-authenticate, then confirm. Your account is queued for deletion immediately and removed within 30 days.

When you delete your account we erase: account data, body / health data, scan photos, progress photos, virtual closet items, AI-generated images, streak data, push tokens, and subscription association (purchase receipts retained for financial recordkeeping for the legally required period). Crashlytics and Analytics already-collected anonymized events cannot be retroactively unlinked but expire on their normal retention schedule.

14. Security

• All client/server traffic is encrypted with TLS 1.2+.

• Passwords are stored hashed (bcrypt) - we cannot read them.

• JWT auth tokens are stored on-device using flutter_secure_storage (Keychain on iOS, EncryptedSharedPreferences on Android).

• The local SQLite database is stored in the App's sandboxed data directory; on Android it is excluded from auto-backup.

• We follow OWASP Mobile Top 10 mitigations and run periodic security reviews.

No system is perfectly secure. If you believe an account has been compromised, contact security@abody.ai.

15. Children's privacy

The Services are not directed to children under 13 (under 16 in the EEA). We do not knowingly collect data from children under those ages. If you believe a child has provided us data, contact privacy@abody.ai and we will delete it.

16. Changes to this Policy

We may update this Policy to reflect changes in the Services or in applicable law. The "Last Updated" date at the top of this page shows when the most recent change was made. Material changes will be announced via in-app notice or email at least 14 days before they take effect.

17. Contact

• Privacy questions: privacy@abody.ai

• Data Protection Officer: dpo@abody.ai

• Security disclosures: security@abody.ai

• General support: support@abody.ai

• Postal: ABODY AI INC., 15 Wellesley St. W, Unit 201, Toronto, Ontario, Canada M4Y 0G7