Privacy Policy

La Mia Stilista is a brand of Bottino AS, org.nr. 938 619 735, Oslo, Norway. Bottino AS is the data controller. Questions or requests: hello@lamiastilista.com.

Beta notice: La Mia Stilista is in open beta. This policy describes what we do today.

1. What we collect and why

If you use the service without an account (signed out)

• Your brief (occasion, destination, trip length, budget, sizes, styles, colours, restrictions and any free-text notes) so we can create your looks.
• A random device ID and a secret key stored in your browser, so that you can reopen and edit your own looks and so that we can apply daily usage limits.
• Your IP address, for usage limits and abuse prevention.
• Looks created without an account expire 24 hours after they are created and are then deleted automatically, normally within 48 hours.

If you create an account

• Email, hashed password, user ID and the time you accepted the terms.
• Optional profile: name, clothing and shoe sizes, height, preferred brands, styles, budget and currency.
• Saved looks and products you choose to keep.
• Your access status (currently free beta access).

Technical data

• IP address and device ID for usage limits and abuse prevention, stored only in scrambled (hashed) form. Normally kept for up to 2 days.
• Bot protection: we use Cloudflare Turnstile on the signed-out service to stop automated abuse. Cloudflare may process your IP address and browser information for this purpose.

Feedback

• If you give feedback on a look (thumbs up or down), we store your vote, the reasons you choose and any comment you write, together with the occasion and which page you started from. We do not store your name, email or IP address with feedback. Please do not write personal details in the comment field.

Which page you started from

• We record which page you started from (for example the home page or a wedding guest page) with each brief, to see which parts of the service are useful. This is counted, not used to profile you.

Please do not write health information or other sensitive details in the free-text fields.

Optional fit preferences (for example "Relaxed fit" or "Easy front opening") are stored with the edit and deleted with it.

La Mia Maternity: if you use La Mia Maternity or choose bump-friendly fit, this preference is stored only with that edit – never on your profile or account – and is deleted together with the edit after 24 hours, or immediately if you delete your account. It is not shared with product search, AI or partner shops.

Photo inspiration is currently unavailable. If we switch it on, you will need to sign in, and we will update this policy first.

2. Legal basis

• Providing the service you ask for (contract / steps before a contract): your brief, account, profile and saved looks.
• Legitimate interest in keeping the service safe, available and affordable to run: usage limits, bot protection and abuse prevention.
• Legitimate interest in improving the service: feedback and counts of which pages people start from.
• Legal obligation where applicable (for example accounting records once paid plans exist).

3. AI processing

Your brief is analysed by an AI model to understand your request and to rate and select products. We send styling information (occasion, destination, budget, sizes, styles and notes). We do not send your name or email, but anything you type in free-text fields is part of the brief, so please do not include personal details there. AI provider: OpenAI, reached through the Lovable AI Gateway. We use a zero-data-retention setup: OpenAI does not keep your data after the request and does not use it to train models. Lovable keeps only technical metadata about each AI request (time, model, usage and cost), not its content.

AI suggestions may contain mistakes. They are not professional advice and no decision with legal or similarly significant effect on you is made automatically.

4. Who processes data for us (data processors)

• Lovable — hosts the app and database (EU, Frankfurt) and runs the AI gateway.
• OpenAI — AI model provider (zero data retention).
• Channel3 — product search and shop links. Receives search terms only, not personal identifiers; when you tap "Shop", see section 5.
• Cloudflare — bot protection (Turnstile).

5. Shop links and affiliate tracking

When you tap "Shop", you are sent through our product search provider's (Channel3) tracking link to the retailer. Some of these are affiliate links: we may earn a commission at no extra cost to you. Channel3, the affiliate network and the retailer may record the click, including your IP address, browser information and which product you clicked, to attribute purchases and pay commissions, under their own privacy policies. We are not responsible for the retailer's site.

6. Transfers outside the EU/EEA

Some providers may process data in the USA. We rely on the EU–US Data Privacy Framework or the EU Standard Contractual Clauses.

7. Browser storage and cookies

We store your session, your optional size preferences, and (signed out) your device ID and edit key in your browser. These are needed for the service to work and for usage limits. We use no analytics, advertising or tracking cookies. Retailers may set their own cookies after you leave our site.

8. How long we keep data

• Signed-out looks and briefs: expire after 24 hours and are deleted automatically, normally within 48 hours.
• Account data: until you delete your account.
• Technical data for limits: normally up to 2 days.
• Feedback: up to 24 months, then deleted. Feedback is not linked to your name or email.
• Backups may keep copies for a short time after deletion.

9. Age

You must be 16 or older. Accounts of younger users are deleted when we find them.

10. Your rights

You can ask for access, correction, deletion, restriction or a copy of your data, and you can object to processing based on legitimate interest.

• Signed in: Profile → "Download my data" and Profile → "Delete my account".
• Otherwise email hello@lamiastilista.com. We reply within 30 days.

You can complain to Datatilsynet (the Norwegian Data Protection Authority), datatilsynet.no.

11. Security

We use encryption and access controls. If a personal-data breach affects you, we will notify you and the authorities as the law requires.

12. Payments

We collect no payment data today. Before paid plans start, we will update this policy.

13. Changes

We will tell you before material changes take effect.