Skip to main content

Dein persönlicher KI-Styling-Assistent — such so, wie du denkst.

mixNmatch

Privacy Policy

Last updated: August 2026

This is a translation of our German „Datenschutzerklärung“ provided for your convenience. In the event of any discrepancy, the German version prevails.

1) Introduction and Contact Details of the Controller

1.1 We are pleased that you are visiting our website and thank you for your interest. Below we inform you about how we handle your personal data when you use our website. Personal data means all data by which you can be personally identified.

1.2 The controller for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is co-fashion UG (haftungsbeschränkt), Homburger Landstraße 383a, 60433 Frankfurt am Main, Germany, tel.: (0151) 23636789, e-mail: info@mixnmatch.app. The controller responsible for the processing of personal data is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

1.3 We have not appointed a data protection officer, as the requirements of Art. 37 GDPR and § 38 BDSG do not apply to us. You can reach us on all data protection matters using the contact details above.

1.4 The supervisory authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (Hessischer Beauftragter für Datenschutz und Informationsfreiheit), Postfach 3163, 65021 Wiesbaden, Germany.

1.5 Our offering is aimed at persons aged 16 and over. If you are under 16, use is permitted only with the consent of a parent or guardian – this applies in particular to features requiring consent under Art. 6 (1) (a) GDPR (e.g. style profile, digital try-on with your own photo, newsletter).

2) Data Collected When Visiting Our Website

2.1 When you use our website for information purposes only, i.e. if you do not register or otherwise transmit information to us, we collect only such data as your browser transmits to our server (so-called „server log files“). When you access our website, we collect the following data, which is technically necessary for us to display the website to you:

  • The page of our website visited
  • Date and time of access
  • Amount of data sent in bytes
  • Source/referrer from which you reached the page
  • Browser used
  • Operating system used
  • IP address used (in anonymised form where applicable)

Processing is carried out pursuant to Art. 6 (1) (f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not passed on or otherwise used. We do, however, reserve the right to review the server log files retrospectively should there be concrete indications of unlawful use.

2.2 For security reasons and to protect the transmission of personal data and other confidential content, this website uses SSL or TLS encryption. You can recognise an encrypted connection by the string „https://“ and the padlock symbol in your browser bar.

3) Hosting

3.1 For hosting our website, operating the database and displaying page content we use the Google Cloud Platform, a service of Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland.

3.2 All data collected on our website is stored and processed exclusively in the europe-west3 region (Frankfurt am Main, Germany) and therefore within the European Union. Processing is carried out to safeguard our legitimate interest in the stable, secure and functional operation of our website pursuant to Art. 6 (1) (f) GDPR. We have concluded a data processing agreement pursuant to Art. 28 GDPR with the provider, which ensures the protection of our visitors' data and prohibits unauthorised disclosure to third parties.

4) Cookies

We use cookies and comparable technologies. We set necessary cookies on the basis of § 25 (2) no. 2 TDDDG without consent; all others only with your consent pursuant to § 25 (1) TDDDG and Art. 6 (1) (a) GDPR, which you can withdraw at any time with effect for the future via the „Cookie settings“ link in the footer.

A complete list of the cookies used, with name, purpose and storage period, can be found in our Cookie Policy.

5) User Account, Registration and Login

5.1 Registration with an E-Mail Address

You can use the website without an account. A user account is required for certain features – permanently saving looks, the style profile and try-on with your own photo. On registration we process your e-mail address, a password chosen by you (stored exclusively as a cryptographic hash), a display name, and the time of registration and of your last login.

The legal basis is Art. 6 (1) (b) GDPR, as the processing is necessary to provide the user account you have requested. We send a verification e-mail to confirm your e-mail address.

5.2 Login via Google or Facebook (Social Login)

Alternatively, you can log in using an existing account with Google (Google Ireland Limited, Dublin, Ireland) or Facebook (Meta Platforms Ireland Limited, Dublin, Ireland). If you choose this option, you are first redirected to the respective provider and authenticated there. We then receive the master data required to create the account – regularly a provider-side user ID, your e-mail address and your name – as well as the access token issued by the provider.

The legal basis for processing by us is Art. 6 (1) (b) GDPR. The redirection and authentication there take place on the basis of your consent pursuant to Art. 6 (1) (a) GDPR, which you give by selecting the respective login button. We have no influence on the data processing carried out by the provider during authentication; the provider's privacy notices apply.

5.3 Deleting Your Account

You can remove your account yourself at any time in your profile under „Delete account“. When the account is deleted, the data attached to it is deleted as well – in particular your style profile including any uploaded photo, your saved looks and try-on images, your wishlist and viewing data, and the preferences derived from them.

6) Contacting Us, Feedback and Spam Protection

6.1 Contact and Feedback Forms

Personal data is collected when you contact us (e.g. via the contact form, feedback form or e-mail). Which data is collected when a form is used is apparent from the respective form; in the case of feedback we additionally store the page from which you sent it. To prevent abuse, we also log the IP address from which the submission was made.

The legal basis for processing this data is our legitimate interest in answering your request and in fending off abusive submissions pursuant to Art. 6 (1) (f) GDPR. If your contact is aimed at concluding a contract, Art. 6 (1) (b) GDPR is an additional legal basis. Your data will be deleted once your enquiry has been finally processed, unless statutory retention obligations require otherwise.

6.2 hCaptcha

To protect our forms against automated submissions we use hCaptcha, a service of Intuition Machines, Inc., 350 Alabama St, San Francisco, CA 94110, USA. When the service is loaded, your IP address as well as browser, device and interaction data are transmitted to the provider and evaluated there to distinguish between human users and bots.

The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in preventing spam and automated abuse. For data transfers to the USA we rely on the European Commission's standard contractual clauses pursuant to Art. 46 (2) (c) GDPR.

7) Use of Customer Data for Direct Marketing

7.1 Subscribing to Our E-Mail Newsletter

If you subscribe to our e-mail newsletter, we will regularly send you information about our offerings. The only mandatory detail for sending the newsletter is your e-mail address. Providing further data is voluntary and is used so that we can address you personally. We use the so-called double opt-in procedure for sending the newsletter. This means that we will only send you a newsletter once you have expressly confirmed to us that you consent to receiving it.

By activating the confirmation link you give us your consent pursuant to Art. 6 (1) (a) GDPR. On subscription we additionally store your IP address and the date and time of subscription. The legal basis for this is Art. 6 (1) (f) GDPR; our legitimate interest lies in ensuring that your consent can be demonstrated as required by Art. 7 (1) GDPR and in being able to trace possible misuse of your e-mail address. You can unsubscribe from the newsletter at any time via the link provided in the newsletter or by message to the controller named at the beginning.

7.2 Newsletter Performance Measurement

Our newsletters contain a tracking pixel and individualised links. This allows us to record whether and when an e-mail was opened and which links were clicked; the time, IP address and information about the browser or device used are also stored. We also log delivery failures (bounces) in order to deactivate addresses that can no longer be reached.

This performance measurement is carried out on the basis of your consent pursuant to Art. 6 (1) (a) GDPR, which you give when subscribing to the newsletter and can withdraw at any time with effect for the future – for example by unsubscribing from the newsletter.

7.3 Brevo

Our e-mail newsletters are sent via the following provider: Sendinblue GmbH (Brevo), Köpenicker Str. 126, 10179 Berlin, Germany. We have concluded a data processing agreement with the provider which protects our users' data and prohibits disclosure to third parties.

8) Affiliate Marketing

We finance our offering through affiliate programmes. Our website contains links leading to offers on the websites of our partners or third parties („partner sites“). We participate in the programmes of the following providers:

  • Admitad GmbH, Heinz-Nixdorf-Straße 6, 74172 Neckarsulm, Germany
  • AWIN AG, Eichhornstraße 3, 10785 Berlin, Germany
  • CJ Affiliate (Conversant Europe Limited), 1st Floor, 40 Dukes Place, London EC3A 7NH, United Kingdom
  • Rakuten Marketing France SAS, 92 Rue de Réaumur, 75002 Paris, France
  • Tradedoubler GmbH, Herzog-Wilhelm-Straße 26, 80331 Munich, Germany

To measure the success of an affiliate link, to evaluate orders generated through it and to account for commissions, the providers use cookies and comparable technologies. These are set on the partner sites, i.e. only after you have left our website; the respective partner is the controller in this respect. In doing so, the provider regularly also processes your IP address and, where applicable, further device information. Consent is obtained via the partner site's consent tool and can be withdrawn there.

We also record how often a product has been clicked on our website. This counting is product-related and not personal.

For transfers to the United Kingdom, an adequate level of data protection is ensured by an adequacy decision of the European Commission.

9) Web Analytics

9.1 TelemetryDeck

This website uses TelemetryDeck, a privacy-friendly web analytics service provided by TelemetryDeck GmbH, Jahnstraße 2, 85049 Ingolstadt, Germany.

TelemetryDeck sets no cookies and stores no identifiers on your device. The analysis is based on pseudonymised or anonymised signals which do not allow conclusions to be drawn about individual users. All data is processed on servers within the EU. The script is only loaded if you have consented to the „Analytics“ category (Art. 6 (1) (a) GDPR); if you withdraw your consent, it is removed.

9.2 No Further Analytics or Tracking Services

Beyond TelemetryDeck we currently use no web analytics, tracking or retargeting services. In particular, we use no Google Analytics, no Google Tag Manager, no Google Signals, no Meta pixel and no cross-device advertising analytics. Should we use such a service in future, we will amend this privacy policy accordingly beforehand and – where necessary – obtain your consent.

10) AI-Supported Features

10.1 Overview

Core features of our platform – style and product search, the assembly of complete outfits („looks“), styling notes, the enrichment of product data and the digital try-on – are provided using artificial intelligence systems. Part of this processing takes place exclusively on our own servers in the European Union; no data is transmitted to third parties in that case. For the remaining features we use AI services from the following providers, which act as processors for us in this respect:

  • Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
  • OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, Ireland

These providers process exclusively the data required for the feature you are using (e.g. search inputs, images, profile data) for the purpose of providing the features described in sections 10.2 to 10.6.

Data processing agreements pursuant to Art. 28 GDPR are in place with both providers. In each case we use paid business accounts whose terms exclude any use of the transmitted content to train the models. Regarding third-country transfers, see section 14.

Which individual models are used within these services, which provider is used for which processing step in detail, and how our search and recommendation procedures are constructed in detail are protected as our trade and business secrets and change continuously. This is irrelevant to your rights: what matters are the recipients named here, the purposes, the legal bases and the categories of data processed. On request we will inform you pursuant to Art. 15 GDPR which data concerning you has been transmitted to which recipients.

10.2 Search and Outfit Recommendations

When you submit a search query or have an outfit assembled, we transmit your input – in the case of image search additionally the image you uploaded – as well as technical context information (e.g. language and the selected presentation format) to one of the AI service providers named in section 10.1. If you are logged in and have created a style profile, the details stored there are also included in the request (see section 10.3). Your identity, your e-mail address and your name are not transmitted.

The legal basis is Art. 6 (1) (b) GDPR, as the processing is necessary to provide the feature you have requested.

We store your search queries together with the result in our database so that you can find earlier looks again and in order to improve the quality of the search. For each search we also create a technical log containing the request sent to the AI service provider and its response; this log is visible only to our staff for troubleshooting. For logged-in users, the search query and log are associated with your account; for visitors who are not logged in, they are not. The legal basis for storing the log is Art. 6 (1) (f) GDPR (legitimate interest in error analysis and quality assurance).

10.3 Style Profile

Logged-in users can voluntarily create a style profile. In it you can provide details including clothing sizes, height, body shape, perceived age, gender of presentation, preferred styles, colours, patterns, fits, occasions, price ranges, favourite brands and shops, as well as body areas you would rather keep covered.

All of these details are voluntary; the platform can also be used without a style profile. They are used to tailor search results and outfit suggestions to you and are transmitted for this purpose as part of the request to the AI service provider named in section 10.1. The legal basis is your consent pursuant to Art. 6 (1) (a) GDPR, which you give by completing and saving the profile; you can change or delete the profile at any time.

We point out that details of body measurements and body shape may allow conclusions to be drawn about you. We therefore treat them with particular care, do not pass them on to third parties outside the processors named in section 10.1, and do not use them for advertising purposes.

Insofar as individual details in your style profile – in particular regarding body shape or body areas you prefer to keep covered – may in an individual case allow conclusions to be drawn about special categories of personal data within the meaning of Art. 9 GDPR (e.g. details indicating health data or a religious affiliation), we process these exclusively on the basis of your explicit consent pursuant to Art. 9 (2) (a) GDPR. You give this consent separately and in addition to the consent mentioned above, by voluntarily entering the details in question and actively giving the corresponding confirmation in the profile. You can withdraw this consent at any time with effect for the future by deleting or changing the details concerned.

10.4 Digital Try-On with an AI Model

In the digital try-on an image is generated showing the garments of a look worn by a person. If you select one of the AI models we provide for this, we transmit only the image of that model and the product images to one of the AI service providers named in section 10.1. No personal data about you is transmitted in this process. The legal basis is Art. 6 (1) (b) GDPR.

To prevent abuse we limit the number of try-ons per day. For visitors who are not logged in, counting is session-based; for logged-in users it is account-based (Art. 6 (1) (f) GDPR).

10.5 Digital Try-On and Styling Graphic with Your Own Photo

This feature is accessible only to logged-in users and is carried out only after explicit, separate consent. Before your own photo can be selected or uploaded, you must confirm in the selection dialogue that your photo will be transmitted to the responsible AI service provider to generate the try-on image and stored until you remove it. Without this confirmation the file does not leave your device.

The following is processed:

  • the photo you uploaded (stored by us as part of your style profile),
  • the transmission of this photo together with the product images to the AI service providers named in section 10.1 in order to generate the try-on image or personal styling graphic,
  • the generated image, which we store associated with your account.

The legal basis is exclusively your consent pursuant to Art. 6 (1) (a) GDPR. You can withdraw it at any time with effect for the future by removing the photo in your profile; it is then deleted from our servers without undue delay. The lawfulness of processing carried out up to that point remains unaffected.

Visibility: Try-on images generated on the basis of your own photo are visible only to you. For technical reasons they never appear on public overview pages, in the look gallery or on other users' product pages – only try-ons generated with one of our AI models are displayed publicly.

Please upload only photos showing yourself and to which you hold the necessary rights. Uploading photos of other people – children in particular – is prohibited under our Terms of Use.

No biometric identification or biometric categorisation within the meaning of the AI Act takes place: the photo is used exclusively for pictorial representation, not to recognise, compare or classify persons. We create no facial recognition templates and do not match your photo against any database.

10.6 Labelling of AI-Generated Images

Every image we generate that shows a person is labelled as AI-generated in two ways:

  • Visibly, by a notice burned into the image („AI-generated“ or „KI-generiert“), which is retained when downloading or sharing;
  • machine-readably, by the IPTC property DigitalSourceType = trainedAlgorithmicMedia, which we write into the image file as an XMP packet.

In this way we implement the transparency obligations under Art. 50 (2) and (4) of the AI Act (EU) 2024/1689; see also section 17.

10.7 No Automated Decision-Making

Automated decision-making, including profiling, which produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR), does not take place. Our AI-supported features generate only non-binding suggestions; neither prices are personalised nor are access, creditworthiness or contractual terms determined automatically.

11) Personalisation and Usage Analysis

If you are logged in, we store which products you have viewed and which products or looks you have marked with „Like“, each with a timestamp and counter. From this we automatically calculate a weighting of your category preferences in order to make search results and recommendations more relevant to you.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in a user-friendly presentation of our offering tailored to individual interests. You can object to this processing at any time under Art. 21 (1) GDPR (see section 16.2); we will then discontinue personalisation. This data is not used for advertising purposes and is not passed on to third parties.

12) Saving and Sharing Looks

You can save looks. A saved look comprises the products it contains, the underlying search query, any generated try-on image, and a visibility setting.

For each look we generate a random, non-guessable share link. You decide on visibility: looks marked as „public“ and tried on with one of our AI models may appear in our look gallery and on product pages. Try-ons using your own photo are excluded from this and always remain private (see section 10.5). The legal basis is Art. 6 (1) (b) GDPR or, in the case of public display, your consent pursuant to Art. 6 (1) (a) GDPR, which you can withdraw by changing the visibility.

13) Site Functionality and Embedded Third-Party Content

The fonts, icon and JavaScript libraries and the CSS framework of our website are hosted by us (self-hosting). No data is transmitted to third parties in this process.

When our pages are accessed, one resource is loaded from a third-party server – only if consent has been given:

  • TelemetryDeck CDN – only with analytics consent, see section 9.1.

The legal basis is Art. 6 (1) (a) GDPR (consent).

We also provide buttons allowing you to share a look via WhatsApp or Facebook. These are implemented as simple links: data is transmitted to the respective service only when you actively click the button.

14) Recipients and Transfers to Third Countries

We pass on personal data only insofar as this is necessary to provide our services or you have consented. The categories of recipients are: hosting and infrastructure providers, AI service providers, the newsletter dispatch provider, the analytics provider and the spam protection provider. Agreements pursuant to Art. 28 GDPR are in place with all processors.

Insofar as data is transferred to countries outside the European Economic Area, we base this on an adequacy decision of the European Commission (in particular the EU-US Data Privacy Framework, United Kingdom) or on standard contractual clauses pursuant to Art. 46 (2) (c) GDPR together with supplementary protective measures:

  • Google Cloud EMEA Limited – hosting (europe-west3 region, Frankfurt am Main). Location: Ireland, Germany. Basis: EU/EEA.
  • Google Ireland Limited / Google LLC – AI services. Location: Ireland, USA. Basis: EU-US Data Privacy Framework.
  • OpenAI Ireland Ltd. / OpenAI, L.L.C. – AI services. Location: Ireland, USA. Basis: EU-US Data Privacy Framework or standard contractual clauses.
  • TelemetryDeck GmbH – web analytics. Location: Germany. Basis: EU/EEA.
  • Sendinblue GmbH (Brevo) – newsletter dispatch. Location: Germany. Basis: EU/EEA.
  • Intuition Machines, Inc. (hCaptcha) – spam protection. Location: USA. Basis: standard contractual clauses.

You can obtain a copy of the standard contractual clauses or further details of the safeguards on request using the contact details given in section 1.2.

15) Duration of Storage of Personal Data

The duration of storage is determined by the respective legal basis, the purpose of processing and – where applicable – additionally by the relevant statutory retention period (e.g. commercial and tax retention periods). In detail:

  • Account data, style profile, uploaded photo – on deletion of the account by you; the photo additionally immediately on removal in the profile.
  • Saved looks and try-on images – on deletion of the account or of the individual look.
  • Search queries, analysis logs, viewing and preference data – on deletion of the account; for visitors who are not logged in, without any personal reference.
  • Newsletter data – without undue delay after unsubscribing; evidence of consent until possible claims have lapsed.
  • Contact and feedback enquiries – after final processing, subject to statutory retention obligations.
  • Server log files – once the analysis or security purpose no longer applies.
  • Consent cookie – 1 year, after which you are asked again.

Where processing is based on consent pursuant to Art. 6 (1) (a) GDPR, the data concerned is stored until you withdraw your consent. Where processing is based on Art. 6 (1) (f) GDPR, the data is stored until you exercise your right to object under Art. 21 GDPR, unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims. Otherwise, stored personal data is deleted when it is no longer necessary for the purposes for which it was collected.

16) Rights of the Data Subject

16.1 Applicable data protection law grants you the following data subject rights vis-à-vis the controller with regard to the processing of your personal data:

  • Right of access pursuant to Art. 15 GDPR
  • Right to rectification pursuant to Art. 16 GDPR
  • Right to erasure pursuant to Art. 17 GDPR
  • Right to restriction of processing pursuant to Art. 18 GDPR
  • Right to notification pursuant to Art. 19 GDPR
  • Right to data portability pursuant to Art. 20 GDPR
  • Right to withdraw consent given pursuant to Art. 7 (3) GDPR
  • Right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR

An informal message to info@mixnmatch.app is sufficient to exercise these rights. You can also delete your account and the data attached to it yourself at any time in your profile (section 5.3).

16.2 RIGHT TO OBJECT

IF WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST FOLLOWING A BALANCING OF INTERESTS, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THIS PROCESSING WITH EFFECT FOR THE FUTURE ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION. THIS CONCERNS IN PARTICULAR THE PERSONALISATION DESCRIBED IN SECTION 11.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED. FURTHER PROCESSING REMAINS RESERVED, HOWEVER, IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FUNDAMENTAL FREEDOMS, OR IF THE PROCESSING SERVES TO ASSERT, EXERCISE OR DEFEND LEGAL CLAIMS.

IF YOUR PERSONAL DATA IS PROCESSED BY US FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH ADVERTISING. YOU CAN EXERCISE THE OBJECTION AS DESCRIBED ABOVE. IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.

17) Information Pursuant to the AI Act (EU) 2024/1689

17.1 You are interacting with an AI system. The search, outfit assembly, styling texts and digital try-on are provided by AI systems. We inform you of this pursuant to Art. 50 (1) of the AI Act. The results are non-binding suggestions and may be inaccurate or incomplete; they do not replace professional advice.

17.2 Labelling of synthetic content. All images we generate and the product and styling texts generated by AI are artificially created. Images carry a visible label as well as a machine-readable marking within the meaning of Art. 50 (2) of the AI Act (IPTC DigitalSourceType = trainedAlgorithmicMedia). Further details in section 10.6.

17.3 Pictorial representation of real persons. A try-on image based on your own photo shows you in clothing you have not actually worn. Such an image may qualify as a „deepfake“ within the meaning of Art. 3 (60) of the AI Act. We therefore disclose, pursuant to Art. 50 (4) of the AI Act, that the image was artificially generated, and label it visibly in the image file itself so that the disclosure is retained when downloading and passing it on.

17.4 Classification of the systems. The AI systems we use serve product search and fashion inspiration. They do not fall under the prohibited practices of Art. 5 of the AI Act and are not among the high-risk use cases listed in Annex III. In particular, no remote biometric identification, no biometric categorisation and no emotion recognition takes place.

17.5 Human oversight and complaints. You can ignore any AI-generated result, have it regenerated, or report it to us. If you disagree with a result or consider an image inappropriate, please contact info@mixnmatch.app; we will review the matter by a human and remove content complained about.

18) Changes to This Privacy Policy

We adapt this privacy policy when the procedures or service providers we use, or the legal situation, change. The version published on this page at the relevant time applies; the date of the last update can be found at the top of the page. If a change requires your involvement – for example new consent – we will obtain this separately.