NDPR & GDPR CompliantEffective: 2026-01-01v2026.2

Privacy & Data Protection Policy

NDPR & GDPR-compliant privacy framework governing your personal, biometric, and transactional data.

Executive Summary

AI-FASHIONISTARCLOTHINGS LIMITED ('Fashionistar', 'we', 'our') is committed to the highest global standards of consumer privacy and data sovereignty. This comprehensive policy governs how we collect, process, encrypt, and store personal and sensitive biometric data across our marketplace and AI scanning applications.

1. Corporate Entity & Scope of Policy

Legal Entity

This Privacy Policy applies to all services, websites, mobile applications, APIs, and AI measurement scanning tools operated by AI-FASHIONISTARCLOTHINGS LIMITED (RC: 7392810), located at A3, Okigwe Road, Umuahia, Abia State, Nigeria.

We act as the Data Controller under the Nigeria Data Protection Act 2023 (NDPA), the Nigeria Data Protection Regulation 2019 (NDPR), and the European Union General Data Protection Regulation (GDPR) for international visitors.

2. Categories of Personal & Sensitive Data We Collect

Data Inventory

We collect information only where necessary to fulfill orders, calculate digital sizing, and maintain secure financial transactions:

Identity & Account Data: Full legal name, email address, telephone number, encrypted password hash (bcrypt), profile avatar.
Delivery & Logistics Data: Physical shipping address, GPS delivery coordinates, recipient contact details.
Sensitive Biometric & Sizing Data: Numerical anatomical measurements (bust, waist, hip, inseam, shoulder span), posture landmarks, and body shape classifications.
Transactional & Financial Data: Payment gateway reference tokens (Paystack, Flutterwave), wallet transaction logs, escrow milestone ledgers. (Note: We NEVER store raw 16-digit debit card numbers or CVVs on our servers).
Device & Technical Data: IP address, browser user-agent, Core Web Vitals telemetry, operating system, and session tokens.

3. Ephemeral Biometric Processing Protocol

Biometric Safeguards

We recognize the deeply personal nature of physical body scans. We have engineered our AI vision architecture around Zero-Storage Ephemeral Processing:

On-Device / Ephemeral Analysis: When you take front and side photos for an AI body scan, the image frames are analyzed temporarily in volatile memory by our MediaPipe pose-detection model.
Immediate Destruction of Raw Images: The moment 3D coordinates and measurement dimensions are extracted, the raw photographic frames are permanently erased from memory.
No Human Viewing of Scan Photos: No staff member, administrator, or tailor has access to or can view your raw scan photos.
Encrypted Vector Storage: Only the resulting numerical measurements (in centimeters and inches) are encrypted and stored in your private Measurement Profile.

4. Data Security & Cryptographic Standards

Encryption Standard

We implement defense-in-depth technical and operational security controls:

Encryption at Rest: PostgreSQL database fields containing sensitive measurement profiles and contact data are encrypted with AES-256 Fernet cryptography.
Encryption in Transit: All data transmission across public networks is secured using Transport Layer Security (TLS 1.3) with strict HSTS preloading.
Role-Based Access Control (RBAC): Strict least-privilege policies ensure only authorized system services can access tokenized customer data.

5. Authorized Third-Party Data Processors

Data Processors

To deliver our services, we share minimal, purpose-specific data with vetted enterprise processors under strict Data Processing Agreements (DPAs):

Payment Gateways: Paystack Payments Limited, Flutterwave Inc. (PCI-DSS Level 1 certified).
Logistics & Couriers: Sendbox Software Technologies, DHL Express Global (Recipient name, shipping address, phone number only).
Cloud Infrastructure & Caching: Amazon Web Services (PostgreSQL RDS), Cloudflare Inc., Redis Labs.
Media Delivery: Cloudinary Ltd. (Catalog product images and brand media).

6. Your Legal Rights & Data Subject Access

Your Rights

Under the NDPA 2023 and GDPR, you have enforceable legal rights regarding your personal data:

Right to Access: Request a full digital export of all personal data and measurement records held in your account.
Right to Rectification: Correct or update any inaccurate personal or measurement details at any time via your dashboard.
Right to Erasure ('Right to be Forgotten'): Request complete deletion of your account, biometric profiles, and historical records (subject to statutory financial audit retention laws).
Right to Withdraw Consent: Revoke consent for marketing communications or biometric processing at any time.

To exercise any of these rights, contact our Data Protection Officer (DPO) at privacy@fashionistar.net or call +234 913 7654 300.