Privacy Policy
At Bride AI, a brand of THE GROWTH PARTNERS FZCO, available at www.bride-ai.com, protecting our visitors’ privacy is one of our top priorities. This privacy policy explains what kinds of information Bride AI collects and records and how we use it.
If you have further questions or need more information about this privacy policy, please do not hesitate to contact us.
This privacy policy applies solely to online activities related to Bride AI and to visitors to our website with regard to the information they share with Bride AI and/or that is collected there. It does not apply to information collected offline or through channels other than this website.
Consent. By using our website, you agree to this privacy policy and its terms.
1. Controller
The controller responsible for data processing on this website is THE GROWTH PARTNERS FZCO (brand “Bride AI”), Building A1, Dubai Digital Park, Dubai Silicon Oasis, P. O. Box 342001, Dubai, United Arab Emirates (UAE). Email: info@bride-ai.com
2. Overview: the data we process
We only process what is needed for the try-on feature, your account, billing and handling enquiries.
| Data | Purpose | Legal basis |
|---|---|---|
| Email address, password (stored only as a hash), consent records (time, text version) | Account and login | Art. 6(1)(b) GDPR |
| Uploaded photos and generated result images | Virtual try-on | Consent, Art. 6(1)(a) and Art. 9(2)(a) GDPR |
| Dress selection, favourites, credit usage | Providing the service, billing | Art. 6(1)(b) GDPR |
| Order data (payment status, purchased credits) | Crediting purchased credits, accounting | Art. 6(1)(b) and (c) GDPR |
| IP address, time, browser data in server logs | Operation and security | Art. 6(1)(f) GDPR |
| Language choice in the browser | Displaying the page | Section 25(2) no. 2 TDDDG |
| Support requests | Responding to you | Art. 6(1)(b) or (f) GDPR |
| Boutique name, email address, phone number, where applicable contact person, number of dresses, package, message (registration or enquiry from bridal boutiques) | Processing the registration, getting in touch | Consent, Art. 6(1)(a) GDPR, and pre-contractual measures, Art. 6(1)(b) GDPR |
3. Registration and account
You register with your email address and a password; we store the password only as a hash. When registering, you confirm by ticking a box that you are at least 18 years old, accept the Terms and the Acceptable Use Policy and have taken note of the Privacy Policy. As proof we store the time and the text version (Art. 6(1)(c) and (f) GDPR). A password reset is done via an email link. We store this data until your account is deleted.
4. Photos and AI image generation
For the try-on you upload a photo of yourself and choose a dress from the catalogue. We send your photo and the selected dress or background image to an AI image model. Currently we use Google Cloud / Vertex AI for this. The model creates your result image from them; no text entered by you reaches the instructions given to the model. Results are labelled “AI-generated” in the application, and JPEG and PNG files additionally carry an invisible AI label in their metadata. We store the photo and the result in your account so you can view them again later. Bride AI is a brand of THE GROWTH PARTNERS FZCO and is not affiliated with the providers of the AI technology it uses.
The legal basis is your consent. A full-body photo can allow conclusions about specially protected characteristics, such as health or origin. That is why we explicitly ask for your consent before your first upload (Art. 6(1)(a) and Art. 9(2)(a) GDPR). We do not use your photos to identify you and we do not create biometric templates. Without consent, the try-on is not possible. You can withdraw your consent at any time with effect for the future under “Account & privacy” in the application and have your photos deleted (email to info@bride-ai.com). Without valid consent, upload and try-on are blocked. We store your consent and every withdrawal with a timestamp as proof. With every upload you also confirm that the photo shows only yourself – no other people, no minors and no explicit content. Processing carried out until then remains lawful.
Please upload only photos of yourself. Photos of other people, including friends and family, and photos of minors must not be uploaded.
5. Processing in Europe, with the US as a fallback
We run AI image generation via Google Vertex AI preferably in a region in Europe, provided the model we use is available there with hosting in Europe. If it is not, we use a region in the United States instead. We check availability regularly. On request, we will tell you which region was used for your images.
| Processing step | Standard | Fallback |
|---|---|---|
| Storage of account, photos and results | EU region | none |
| AI image generation | Region in Europe | US region, only if the model is not available in Europe |
| Payment processing | Payment provider (named in the checkout) | see section 12 |
If processing takes place in the US, the safeguards in section 12 apply.
6. Dress catalogue and favourites
We store your favourites in your account so you can find them again (Art. 6(1)(b) GDPR).
7. Credits and payment
The purchase of credits is handled by a payment provider we use. Which provider that is will be shown to you in the checkout before you buy. Depending on the set-up, the payment provider is your contracting party for the purchase, handles payment processing, invoicing and VAT, and is itself responsible for this data (Art. 6(1)(b) and (c) GDPR). You enter your payment details directly with the payment provider; we do not receive them. From the provider we receive order data, namely payment status, purchased credits, your email address and your country, so we can credit the credits to your account. The payment provider’s privacy notice also applies. Purchased credits do not expire as long as your account exists.
8. Hosting, log files and local storage
The website is hosted by Cloudflare. Server logs are created in the process (IP address, time, page requested, browser). We use them for operation, troubleshooting and security and delete them after 7 to 30 days (Art. 6(1)(f) GDPR).
For login we use technically necessary cookies or stored data. In addition, the page remembers your chosen language in your browser (cookie or local entry “bride_lang”, stored for one year). When you open the home page without a language in the address, our hosting (Cloudflare) automatically redirects you to the matching language version (German, English or Polish) based on your browser language and the country derived from your IP address; the IP address is not stored for this purpose. The legal basis is Art. 6(1)(f) GDPR and Section 25(2) no. 2 TDDDG.
We currently do not use any tracking or advertising cookies. When you open our pages, no fonts or scripts from third parties are loaded that transmit data before you consent.
We store your choice in the cookie banner locally in your browser (entry “bride_consent”) so that we do not have to ask you again on every visit. You can change or withdraw it at any time via “Cookie settings” in the page footer. The legal basis is Section 25(2) no. 2 TDDDG. We would only load analytics services with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).
9. Storage period and deletion
You can request the deletion of your photos, results and your entire account at any time (email to info@bride-ai.com); a deletion function in the application is in preparation. We then delete the data from the active database.
| Data | Storage period |
|---|---|
| Uploaded photos and result images | until deleted at your request |
| Account data, favourites | until the account is deleted |
| Invoice and payment data | statutory retention periods |
| Server logs | 7 to 30 days |
| Registration or enquiry from bridal boutiques | until finally processed; if no contract is concluded, at most 12 months after the last contact; if a contract is concluded, statutory retention periods apply |
| At the AI provider | no long-term storage initiated by us; short-term technical caching under the provider’s terms |
10. No AI training, no automated decisions, AI labelling
No training with your photos. We do not use your photos to train our own models. Our agreement with Google (Vertex AI) provides that your data is not used to train its models. Any use for training would require a separate, voluntary consent from you.
No automated decisions. We do not make decisions that have a legal effect on you or similarly significantly affect you (Art. 22 GDPR).
AI-generated images. Result images are generated by AI. Fit, colour, material and details may differ from the real dress and from your actual appearance. Bride AI is a preselection tool and does not replace trying on in person. Result images are labelled as AI-generated in the app. If you publish them, please keep this label.
11. Recipients and processors
We only pass data on to the following parties, and only as far as necessary for the respective purpose.
| Recipient | Task | Place of processing | Basis |
|---|---|---|---|
| Google Vertex AI | AI image generation | Region in Europe, US as fallback | Data processing agreement, section 12 |
| Supabase | Login, database, image storage | EU region | Data processing agreement |
| Payment provider (named in the checkout) | Payment processing | depending on the provider, possibly outside the EU | Data processing agreement or the provider’s own responsibility, section 7 |
| Cloudflare | Website hosting, server logs, forwarding of the registration and enquiry forms (Cloudflare Worker) | global network, section 12 | Data processing agreement |
| Zoho Mail | Sending and receiving emails | Provider’s data centre | Data processing agreement |
| Resend (Resend, Inc.) or alternatively Amazon SES (Amazon Web Services) | Sending the registrations and enquiries from bridal boutiques to us by email | Provider’s data centre, where possible in the EU, otherwise US, section 12 | Data processing agreement |
12. Transfers to third countries
If your images are exceptionally processed in the US (section 5), we rely on the European Commission’s adequacy decision for the EU-US Data Privacy Framework, as far as the provider is certified under it. Otherwise we use the European Commission’s standard contractual clauses and, where necessary, additional safeguards.
The same applies if Cloudflare, as a global network, or our payment provider processes data outside the EU. The basis is adequacy decisions where available, otherwise standard contractual clauses.
Processing outside the EU may also occur with the Cloudflare Worker and with email delivery via Resend (US) or Amazon SES. We then rely on the EU-US Data Privacy Framework, as far as the provider is certified under it, otherwise on standard contractual clauses. For email delivery we prefer an EU region where available.
We ourselves are based in the United Arab Emirates, for which there is no EU adequacy decision. Where we access data from there, we safeguard this through standard contractual clauses or equivalent contractual and technical measures. You can obtain a copy of the safeguards on request.
13. Your rights
You have the right to request from us
- access (Art. 15 GDPR)
- rectification (Art. 16)
- erasure (Art. 17)
- restriction of processing (Art. 18)
- data portability (Art. 20)
- to object to processing based on legitimate interests (Art. 21)
- to withdraw consent with effect for the future (Art. 7(3))
Write to us at info@bride-ai.com.
Supervisory authorities and right to complain. If you believe that we are not processing personal data lawfully, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, your place of work or the place of the alleged infringement (Art. 77 GDPR).
- List of all EU authorities: https://edpb.europa.eu/about-edpb/board/members_en
In any case, you can also contact our data protection officer first. We aim for a straightforward resolution.
14. Registration and enquiries from bridal boutiques
On the “For bridal boutiques” page, boutiques can get in touch through a sign-up pop-up or the contact form. We process the details you enter: boutique name, email address and phone number, and in the contact form also contact person, approximate number of dresses, desired package and message. We also record the package you clicked, the language of the page, the time and the fact that you agreed to the privacy policy. We need the boutique name, email address and phone number to process the registration.
Purpose and legal basis. We use the details to process your registration or enquiry and to get in touch with you by phone or email. The legal basis is your consent by ticking the box (Art. 6(1)(a) GDPR) and the performance of pre-contractual measures at your request (Art. 6(1)(b) GDPR). You can withdraw your consent at any time with effect for the future, for example by email to info@bride-ai.com.
Technical handling. The form data is transmitted in encrypted form to a worker we operate at Cloudflare (Cloudflare Workers). The worker forwards it to us by email. For delivery we use Resend or alternatively Amazon SES (sections 11 and 12). The worker only forwards the data; the form data is not stored permanently in the worker. You do not currently receive an automatic confirmation email; we will get in touch with you personally.
Appointment requests in the application. If you send an appointment request to a bridal boutique in the application, we pass on your details (name, email address, phone number, address where applicable, wedding date and preferred date, companion, message) and – only if you tick the box – your favourites and shortlist to that boutique so that it can contact you. The legal basis is your consent (Art. 6(1)(a) GDPR), which you give by submitting the request and can withdraw at any time by email to us. We store the request in our database and send it by email to the boutique (currently via Resend, later Amazon SES). The boutique then processes your data under its own responsibility. We keep requests for as long as they are needed for processing and delete them on request.
Storage period. See section 9.
15. Data security, minors, changes
Data security. Transmission is encrypted (TLS). Photos and results are kept in non-public storage areas, and access is restricted.
Minors. Bride AI is intended for people aged 18 and over. We do not knowingly process data of minors.
Changes. We will update this policy when features or the legal situation change. For material changes, such as new recipients or different regions, we will inform you in advance. Last updated: 6 November 2026.