Privacy notice

01 Controller and contact

The controller responsible for processing your data is PairMuse e.K., owner: Mohammed Hussam Al Turjman, TodoStrasse 1, 11111 Bremen, Germany (“we”). This notice covers PairMuse at https://pairmuse.com, in the browser and as an installed app.

Send questions about data protection and requests about your rights to privacy@pairmuse.com. Our other contact details are in the legal notice (Impressum).

Data protection officer: TodoOfficer (Todo@Todo.com)

Legal notice (Impressum)

02 The essentials

• PairMuse is a fashion platform: wardrobe, posts and profiles, messages and the AI assistants Muse and Stylist. We process your data to provide these features.
• What you write to Muse or Stylist, and the photos and pieces it concerns, we send to an AI provider: OpenAI, Anthropic, xAI or Google. The providers process the data on our behalf and do not use it to train their models.
• We rank the Discover view on Home for you, among other things by your likes, comments and saved posts. You can object to this. The Following view shows posts from the people you follow in time order only.
• Direct messages and channels are end-to-end encrypted. We store only the encrypted text.
• An automated text check reviews captions and intro notes before we publish them, and comments shortly after they appear.
• Some service providers are based in the USA or process data there. Which safeguard applies to each is set out in the section “Transfers to third countries”.
• We do not sell your data and show no third-party advertising.
• You have the right of access, rectification, erasure, restriction, data portability and objection, and you can complain to a supervisory authority.

03 Legal bases

We process your data only where a legal basis allows it. The tables in the following sections name the basis for each purpose. These are the bases:

Contract

Art. 6(1)(b) GDPR: we need the data to provide PairMuse under our terms (AGB) or to answer a request before a contract.

Legal obligation

Art. 6(1)(c) GDPR: a law obliges us, for example to keep invoices (Section 147 AO, Section 257 HGB) or to handle notices under the Digital Services Act (DSA).

Legitimate interest

Art. 6(1)(f) GDPR: we have a legitimate interest in the processing, and your interests and rights do not override it. Each purpose names the interest. You can object (Art. 21 GDPR).

Consent

Art. 6(1)(a) GDPR and, for access to your device, Section 25(1) TDDDG: you have consented. You can withdraw your consent at any time for the future, as easily as you gave it. What happened until then remains lawful.

Strictly necessary

Section 25(2) no. 2 TDDDG: without consent we store on your device only what a feature you expressly use needs.

For an account we need your name, your email address and a way to sign in: a password, a passkey or sign-in through a provider such as Google or Apple. Without these we cannot create an account. Everything else is voluntary, such as pronouns, bio, sizes, budget or style preferences. Without it PairMuse works, only less tailored to you. No law obliges you to give us data.

04 Hosting, servers and logs

PairMuse runs on servers we rent from netcup GmbH; they are in a data center in Nuremberg, Germany. There we also run our own email server, our monitoring (Grafana, Loki, Tempo), our search and our evaluation tool for the assistants (Langfuse).

We deliver images through the CloudFront network of Amazon Web Services. The server closest to you receives your IP address and the requested file. These servers are located worldwide, including outside the EU.

With every request our servers process technical data: IP address, time, the page requested without search terms, browser and operating system. We need it to deliver PairMuse, find errors and fend off attacks. We delete logs and measurements after a few days to a few weeks.

05 Cookies and storage on your device

PairMuse stores on your device only what the features you use need. For that we need no consent (Section 25(2) no. 2 TDDDG). We set no third-party advertising or tracking cookies. Two things are voluntary: analytics and personalization. They run only if you allow them. We do not use personalization yet.

Analytics, only when you allow it

Your browser measures how fast pages load and how smoothly PairMuse responds, and sends the measurements to our own server. They arrive there with your IP address and a pseudonymized identifier of your account, without your name. We remove search terms first, and we evaluate the measurements only in aggregate. Legal basis: consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). Retention: a few days to a few weeks. Recipients: netcup (hosting).

Personalization, only when you allow it

Not in use yet: we record nothing for it, even if you allow it. When we start, nothing is personalized unless the switch for it is on. If you allow personalization, we may then record which products and pieces you spend time on, tie this to your account and use it to tailor suggestions to you. Unless you allow it, this does not happen. Legal basis: consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). Retention: until you withdraw consent or delete your account. Recipients: netcup (hosting).

The cookie banner asks about both on your first visit. You can change or withdraw your choice at any time: when signed in, in Settings under Privacy & data; without signing in, through the cookie settings link in the footer of the page.

06 Account, sign-in and security

For your account we store your name, your email address, language and time zone, and how you sign in. We store a password only as a hash (Argon2id), never in plain text. Of a passkey we store only the public key; the private key stays on your device. If you sign in through Google, Apple or your organization’s SSO, that provider sends us your email address, an identifier and, if you share it, your name. If someone in your organization invites you, we receive your email address from that person. We also store the two statements every sign-up needs: that you are at least 16, and that you agree to our terms (AGB) and have read this privacy notice.

For each sign-in session we store the IP address, approximate location (country, region, city), network operator, browser, operating system, device type and the device details PairMuse reads from your browser at sign-in (section “Cookies and storage on your device”). From them we compute an identifier of your device that applies to your account only. With it we recognize your device at your next sign-in and warn you when someone signs in from a new device. We derive the location from the IP address on our own server, with a database kept on it. This lets you see all active sessions in Settings under Account and end any you do not recognize. We count failed sign-in attempts per account, IP address and network to fend off attacks.

We record important events such as sign-ins, changes to your account and security settings, exports and deletions in an audit log that cannot be changed afterwards.

07 Profile, posts and connections

Your profile shows your display name, handle, profile photo and cover image and, if you add them, pronouns, bio, city and country. You decide who sees it in Settings under Privacy & data: public to all signed-in members, private to approved followers only, or incognito to no one. Visitors without an account and search engines see no profiles and no posts.

If you publish a piece from your wardrobe, the people allowed to see your profile see it on their Home and in your gallery. Likes and comments are visible to others; what you save only you see. We store your recent searches and filters to suggest them again.

Other members create data about you as well: when they follow you, block, mute or restrict you, comment on your posts, show you in a photo or mention you in a conversation with Muse. We process this to carry out those members’ settings and content (Art. 14 GDPR). We do not tell you that someone blocked, muted or restricted you.

08 Moderation and notices

An automated text check reviews captions, comments and the intro note of a follow request for content such as hate, harassment, violence, self-harm or sexual content. We use OpenAI’s moderation model for this. The check reviews captions and intro notes before we accept them. A caption or an intro note the check cannot clear is not published, and we tell you so when you send it, with the kind of reason. If such a text is clearly not allowed, we refuse it. If the result is unclear or the check is not possible, we hold back a caption, and we do not send a follow request with an intro note. If a text is held because the check could not run, we run the check again automatically and publish the text if the repeated check clears it. A person reviews held texts by the next working day at the latest and publishes or removes them. If the check holds back the changed caption of a published post, we take the post off the feed until the decision; if a person removes a caption, we remove the post it belongs to.

We publish a comment at once, and the check usually reviews it within seconds. If it rates the comment as clearly not allowed, or if the result is unclear, we flag the comment: then only you can see it, and we show you the kind of reason with the comment. Others do not see the replies to a flagged comment while it is flagged. If a person removes a comment that has replies, the replies are no longer shown either. If the check is not possible, the comment stays visible and we run the check again automatically. You can send a flagged comment again in a changed form; it is then checked like any comment. We store when the check rated which of your comments as clearly not allowed. After ten ratings as clearly not allowed, we switch off commenting for your account and tell you so by email.

You can object to a hold at any time by writing to dsa@pairmuse.com, and to a refusal, a flag, commenting being switched off or a removal within four weeks; a person then decides again. A removed text cannot be restored; after a successful objection you can send it again.

A person reads every notice: no automated check reviews the text of a notice, every notice reaches us, and a person decides on each one.

When someone reports content, we process the notice, the reported content and the details of the person reporting, that is, name and email address where given. The person affected learns who reported only where strictly necessary, for example when someone reports that a photo shows them without their consent. If content points to a criminal offense against life or safety, we inform the law enforcement authorities (Art. 18 DSA).

09 Ranking on Home and in Discover

Home has two views. Following shows posts from the people you follow in time order, without ranking by your behavior. Discover shows posts from everyone you are allowed to see and ranks them for you. This is profiling within the meaning of Art. 4(4) GDPR.

For this ranking we use:

• your connection to the person who published a post: whether you reacted to their posts, for example with a like or with “Dislike”, and whether you commented on, saved or reported them
• a score of your connection to each of these people, which we compute on our own server from these interactions; we derive no taste from the categories or features of the posts
• whom you follow and whom those people follow
• how new and how popular a post is
• how often we have already shown you a post

How much each factor counts is set out on the page “Transparency: ranking and AI”.

We base this ranking on our legitimate interest in showing you posts that match your taste (Art. 6(1)(f) GDPR). It has no legal or similarly significant effect on you. You can object to it at any time. The Following view is always open to you regardless.

The Discover tab in the navigation shows products from the shops in your shopping country, most recently found first. This order does not depend on your behavior, only on your filters and your shopping country.

Transparency: ranking and AI

10 Wardrobe, style and shopping

In your wardrobe you keep pieces with photos, name, category, color and material and, if you like, brand, price, tags, description and a personal note. Pieces you save in Discover land there too. What you do not publish only you see.

After you save a piece, an AI reads its photos and fills in details such as material and care. For this we send the photos and the details of the piece to one of our AI providers (OpenAI, Anthropic, xAI or Google). We scan uploaded files for malware on our own server.

In Settings under Shopping you record style and shopping preferences: style direction, colors, occasions, the department you shop in, sizes, fit, price ceiling, secondhand and sustainability, materials, shops and your shopping country. Muse and Stylist use them for their suggestions.

Search in your wardrobe, in posts and in products runs on our own servers; search terms and photos do not leave PairMuse for it.

The products in the catalog come from publicly accessible product pages of the shops. An OpenAI model finds them with its web search, an AI model checks whether the photos show the product, and we store the photos on our servers to show them with the product. If the photos show people, such as models, we process the photos only as product images; we do not analyze who the person is. The legal basis is our legitimate interest in showing members products with their images (Art. 6(1)(f) GDPR). We cannot inform the people shown individually because we do not know who they are (Art. 14(5)(b) GDPR). Anyone who recognizes themselves in a product photo can object and ask us through the notice form to remove the photo.

11 Muse and Stylist (AI assistants)

Muse and Stylist are AI assistants. Muse advises you on outfits and looks for suitable pieces; Stylist gives a second opinion on a single piece. Their replies are generated by AI. They can be wrong.

When you write to Muse or Stylist, we send the AI model of one of our providers your message with attached photos, the pieces from your wardrobe and the products it concerns, and your style and shopping preferences. We decide which provider answers depending on the task.

For a live search, an OpenAI model uses its web search to search the shops you selected in Settings. For this OpenAI receives a description of the pieces sought, derived from your brief. We add the products found to the catalog.

The providers process the data on our behalf (Art. 28 GDPR) and do not use it to train their models. How long they keep requests and where is set out in the sections “Recipients” and “Transfers to third countries”.

We store your conversations with Muse and Stylist so that you can open them again. If you delete a conversation, we hide it at once; we remove it for good when your account is deleted.

To run the service we record trace data for every reply: steps, times, model, usage, cost and the identifiers of account and conversation, without content. With the setting “Improve PairMuse for everyone” in Settings under Privacy & data you also allow us to keep the full text of your conversations and attached images in our evaluation tool Langfuse to make the assistants better. The setting starts off. It involves no training of AI models. Langfuse deletes trace data and content at the latest 30 days after they were recorded.

Share in conversations only what you want to share. Muse and Stylist do not need special categories of personal data, such as data on health, religion or ethnic origin (Art. 9 GDPR), for their suggestions. We do not analyze your messages and photos for them, and we do not store such data that a model derives from them. If you mention them yourself, they are kept only as part of your conversation. We claim no legal basis for processing such data.

12 Messages and channels

Direct messages and channels are end-to-end encrypted, with nothing for you to set up. Your browser encrypts text and attachments before sending them; we store and transmit only the encrypted version. So that your devices receive the keys automatically when you sign in, we keep a key bundle that we hold only in encrypted form.

What we can read are the circumstances of a message: who takes part in a conversation, who sent something when, read receipts and typing indicators unless you turn them off, your status and when you were last online. Search in messages works with search keys your browser derives from the text; we do not see the text itself.

If you delete a conversation, we remove it for good after 30 days, unless a legal obligation requires us to keep it longer. If you report a message, you can send us its text or a screenshot; only then do we learn its content.

13 Notifications and emails

We show notifications in PairMuse under the bell. We delete notifications you have seen after 30 days.

If you turn on background notifications, your browser registers a push subscription with its maker’s push service, for example Google for Chrome, Apple for Safari and Mozilla for Firefox. We store the address of this subscription and send notifications there encrypted; the push service cannot read the content. A notification about a message names the sender and the conversation, never the text of the message. The subscription stays in place when you sign out; you end it in Settings under Notifications.

We send emails through our own mail server: confirmation codes, security notices, invoices, notices about your plan and replies to your requests. Our emails contain no tracking pixels and no personalized links with which we track whether and when you open them.

If you bought a paid plan, we also tell you about our own similar offers by email as long as you do not object (Section 7(3) UWG). We point this out when you order and in every such email. We send no news about PairMuse today, and without a paid plan no notices about similar offers either. If we start, we will ask for your consent first; without it you receive no such emails.

14 Paid plans and payments

Stripe handles payments for Pro and Max. You enter your card details directly with Stripe; we do not receive them. We store your plan, the status of your subscription, your invoices, your credit usage and, about your card, only the card type, the last four digits, the expiry date and the name on the card.

Stripe processes the payment on our behalf. For fraud prevention, anti-money laundering checks and its work with banks, Stripe is a controller in its own right; Stripe’s privacy policy applies to that.

Stripe privacy policy

We keep invoices and payment records for eight years, books for ten years and business letters for six years (Section 147 AO, Section 257 HGB, Section 14b UStG). After your account ends we block these data from any other use.

15 Help and requests

If you write to us through the help form or by email to help@pairmuse.com, we process your request, your contact details and attached files to answer you. A person writes the replies. If you rate a help article, we store your rating.

16 Exporting and deleting your account

In Settings under Account, “Export my data” gives you a copy of your account and settings data as a JSON file. After you confirm with a code, we email you a download link that stays valid for seven days. The export does not yet include your wardrobe, messages or photos. You can get these and a full copy under Art. 15 GDPR on request to privacy@pairmuse.com.

“Delete account” in the same place deletes your account. It needs a sign-in with a second factor; signing in with a passkey is enough. If you cannot sign in that way, you can request deletion by email to privacy@pairmuse.com. Once you confirm, you are signed out everywhere and others no longer see your account. If you have a paid plan, it ends with its current billing period and is not renewed. For 30 days you can undo the deletion through the link in our email; if you restore your account that way, you can resume the plan in Settings under Billing while that billing period runs. After that we delete your data across PairMuse. The assistants’ trace data and the conversation content we keep in Langfuse with your consent are not deleted at once: they expire within 30 days of your last activity.

After deletion we keep only what we must keep or need as proof: a deletion record with the account identifier, organization, email address and the dates of joining and deletion, invoices and records for the statutory periods, and the audit log.

17 Recipients

We pass on data only where one of the purposes above requires it. These service providers work for us or receive data under their own responsibility:

netcup GmbH, Karlsruhe, Germany

Hosting of our servers in a data center in Nuremberg. Processor.

Amazon Web Services

Delivery of images through CloudFront, with servers worldwide. Processor; the parent company Amazon Web Services, Inc. is based in the USA.

Stripe Payments Europe, Ltd., Dublin, Ireland

Payments. Processor for payment processing, independent controller for fraud prevention and anti-money laundering checks. Stripe passes data to Stripe, Inc. in the USA.

OpenAI Ireland Ltd, Dublin, Ireland

AI models for Muse and Stylist, the live search, reading photos and the text check. Processor. Where we have configured it, OpenAI processes requests in its EU region. We have applied to OpenAI for zero data retention; until it covers all requests, OpenAI by its own account keeps requests and replies for up to 30 days to detect abuse. OpenAI also processes data in the USA.

Anthropic Ireland, Limited, Dublin, Ireland

AI models that, depending on the task, generate replies from Muse and Stylist or read photos. Processor. By its own account Anthropic deletes requests and replies after 30 days; content that may breach its usage policy Anthropic keeps for up to two years. Processing also in the USA.

xAI Corp., USA

AI models that, depending on the task, generate replies from Muse and Stylist or read photos. Processor. By its own account xAI deletes requests and replies after 30 days.

Google Ireland Limited, Dublin, Ireland

AI models of the Gemini API, in the paid service only, that, depending on the task, generate replies from Muse and Stylist or read photos. Processor. By its own account Google keeps requests and replies for a limited period to detect abuse and does not use them to improve its products. Under Google’s terms the Gemini API is intended for people aged 18 or over. Processing also by Google LLC in the USA.

Browser makers’ push services

Google, Apple, Mozilla or another maker, depending on your browser. They deliver encrypted notifications. Your browser chooses the service, not we; the makers are responsible for it themselves.

Your sign-in provider

Google, Apple or your organization’s SSO, if you sign in through them. Independent controller.

Authorities and courts receive data where a law obliges us. Email delivery, monitoring, search and the evaluation tool Langfuse we run ourselves on our servers.

PairMuse is technically prepared to exchange data with other servers (federation). This feature is not in operation; we exchange no data with other servers. Before that changes, we will inform you.

18 Transfers to third countries

Some recipients process data outside the EU and the European Economic Area, mainly in the USA. These safeguards apply:

We will send you a copy of the standard contractual clauses on request to privacy@pairmuse.com.

19 Retention

We keep data only as long as we need it for the purpose or a law requires it. The tables above give the periods in detail. The most important:

• Account data: until you delete your account, then a 30-day waiting period.
• Deletion record after deletion: account identifier, organization, email address, dates of joining and deletion, with no fixed period, as long as we need the proof.
• Invoices and payment records eight years, books ten years, business letters six years (Section 147 AO, Section 257 HGB).
• Deleted conversations: removed for good after 30 days.
• Conversations with Muse and Stylist: until your account is deleted.
• The assistants’ trace data in Langfuse: up to 30 days; conversation content there only while your consent to “Improve PairMuse for everyone” lasts, and also up to 30 days.
• Server logs and measurements: a few days to a few weeks.
• Audit log: seven years.

Statutory retention periods start at the end of the calendar year in which a record was created. Once a period has passed, we delete.

20 Your rights

You have these rights against us:

• Access to your data and a copy of it (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability in a common, machine-readable format (Art. 20 GDPR)
• Objection to processing based on a legitimate interest and to direct marketing (Art. 21 GDPR, see the next section)
• Withdrawal of consent for the future (Art. 7(3) GDPR)

Write to privacy@pairmuse.com. We answer within one month and free of charge. We ask for identification only if we have reasonable doubt that the request comes from you.

You can also complain to a data protection supervisory authority (Art. 77 GDPR), for example in the country where you live. The authority competent for us is the State Commissioner for Data Protection and Freedom of Information of the Free Hanseatic City of Bremen (Der Landesbeauftragte für Datenschutz und Informationsfreiheit der Freien Hansestadt Bremen), Georgstraße 122 bis 124, 27570 Bremerhaven, Germany, office@datenschutz.bremen.de.

21 Your right to object

22 Automated decisions and profiling

Whether we publish or hold back a caption and whether we send a follow request with an intro note are first decided automatically by the text check. For a comment, the text check decides automatically after publication whether only you can see it. After ten ratings of your comments as clearly not allowed, commenting is also switched off for your account automatically. These are automated decisions within the meaning of Art. 22(1) GDPR. They are permitted because they are necessary for the contract with you (Art. 22(2)(a) GDPR): only this way can we check captions and intro notes before others see them, and comments shortly after they appear.

This is how the check works: a model rates how likely the text is to contain hate, harassment, violence, self-harm or sexual content. If a score is high, we refuse a caption or an intro note; if it is moderate or the check is not possible, we hold back a caption and do not send a follow request with an intro note. In these cases the text does not appear. If a score for a comment is high or moderate, we flag the comment and only you can see it; if the check is not possible, it stays visible. Whether we switch off commenting depends only on how often comments of yours had a high score. No other data about you goes into the check.

You have the right to have such a decision reviewed by a person, to express your point of view and to contest it (Art. 22(3) GDPR). To do so, write to dsa@pairmuse.com; the notice under the input field opens this email with your text, and for a flagged comment the notice shown with it links to this address. A person then decides again.

• The ranking of the Discover view is profiling, but it has no legal or similarly significant effect on you. How it works is set out above in the section on ranking and on the page “Transparency: ranking and AI”.
• Muse and Stylist make suggestions you can accept or dismiss. They decide nothing for you.
• A person always decides on suspending an account. The only thing switched off automatically is commenting, as described above; everything else in the account stays usable.

23 Children and young people

PairMuse is for people aged 16 or over. Only members aged 18 or over can take out a paid plan. When you register, you confirm that you are at least 16; if you create your account through Google, Apple or your organization’s SSO, you confirm it when you first sign in. We need no ID and no date of birth for this.

If we learn that an account belongs to a person under 16, we delete it. Consent from a person under 16 is not valid without their parents’ consent (Art. 8 GDPR).

24 Security

We protect your data with technical and organizational measures (Art. 32 GDPR): connections are encrypted with TLS, messages end to end, passwords exist only as a hash, we manage keys in a dedicated key service, and our services talk to each other only over encrypted, mutually authenticated connections. Only the people who need access for their task have it.

If a breach of the security of your data happens nonetheless, we report it to the supervisory authority and inform you if it poses a high risk to you (Art. 33 and 34 GDPR). Report security vulnerabilities to security@pairmuse.com.

25 Changes to this notice

If the way we process data changes, we update this notice. We tell you about material changes, such as new purposes or new recipients, in advance in PairMuse or by email. The version and date are at the top of this page; we will send you earlier versions on request.