Privacy Policy

This policy explains what CORE SHOP Inc., a Delaware corporation ("Core", "we", "us"), collects when you use core.shop and the services that come with it (the "Service"), what we use it for, who receives it and what you can do about it. Core is the data controller for the personal data described here. Questions go to contact@core.shop.

1. Who the Service is for

The Service is for people aged 16 and over, or the higher minimum age that applies where you live. It is not directed at children under 16 and we do not knowingly collect personal data from them. We ask for your age when you create an account. If the answer is under the minimum age, we delete the account and everything entered into it straight away, and keep only an anonymous marker on the device so the sign-up cannot simply be repeated.

If you are 16 or 17, we show you no advertising, we do not sell your personal data, we never record your screen session for analytics, and the Studio, our virtual try-on, stays closed to you until you are 18. Parents and guardians with a question about a teenager's account, and anyone who believes a child under 16 has given us personal data, can write to contact@core.shop with "Parent" in the subject line.

2. What we collect

When you create an account

• Your email address.
• Your name.
• Your username, display name, bio and profile photo, if you add one. These appear on your public profile page, which anyone can see, together with any collections you choose to make public. Collections are private unless you make them public.
• Your password, which is stored hashed by our sign-in provider. We never see it in plain text.

If you sign in with Google

You can use your Google account instead of a password. We ask Google only for its basic sign-in permissions, the "openid", "email" and "profile" scopes, and Google shares with us the email address on your account and whether it is verified, your name as set on Google, the address of your profile picture, and an identifier that lets us recognise you next time. We use these only to create your Core account and sign you in. We never receive your Google password and have no access to any other Google service, such as Gmail, Drive, Contacts or Photos. The data sits in your account record with our sign-in provider, on the same terms as the rest of your account. You can disconnect Core from your Google account at any time at myaccount.google.com/permissions. Disconnecting stops future Google sign-ins; it does not delete your Core account, which you can do yourself as described in section 8.

What you tell us at sign-up, to personalise your feed

• Your age, which is required. We keep it as a date of birth to check the minimum age and to apply age-appropriate settings. It is never shown on your profile.
• Whether you shop womenswear or menswear, which is required.
• The styles you pick, if any.
• Brands you like, if any.
• Sizing and fit details, if you give them: height, shoe size, waist, top size and the fit you prefer. We use them only to make recommendations fit you better.

Photos you upload

• Studio photos. To try clothes on, you upload a photo of your face and, if you want your own build in the result, a photo of your whole body. Both are stored with your account and sent to OpenAI, which makes your avatar. When you try on a look, the avatar and the pictures of the products you picked are sent to Google, which returns a picture of your avatar wearing them. The avatar and the pictures that come back are stored with your account so you can see them again. You can replace or delete your photos and your avatar in the Studio at any time, and all of it is deleted when you delete your account.
• Picture searches. When you search with a photo, a smaller copy of it is turned into a numeric description that runs the search, and the photo is also shown to an AI model that reads what is in it. From a personalised account the copy is kept for up to 60 days in private storage to improve search quality, then deleted automatically. Picture searches from guests and from accounts that have not finished sign-up are processed the same way but not kept.

What we record as you use the Service

• What you save, like and open, and the taste profile we derive from it.
• The searches you run, including ones written in plain language. With your analytics consent, the first 200 characters of a search are also recorded as an analytics event, as described in our Cookie Policy.
• The products you open and the clicks that take you to a retailer.
• Your device, browser, approximate location from your IP address, and similar technical details.
• Cookies and analytics events, as described in our Cookie Policy.

If you use the Service without an account

You can search on our public pages without signing in. Guest searches run against the same catalogue as everyone else's. A photo attached to a guest search is processed by our own image model and not kept. Guest searches are not linked to any account and are not added to the photos we keep to improve search.

What we derive

A taste profile, built from the data above, which shapes your feed and your search results.

3. What we use it for

• To run your account and provide the Service.
• To build and keep improving your recommendations and search results.
• To send you emails about your account, such as a sign-in code.
• To measure and improve the Service through analytics, only with your consent where the law requires it.
• To keep the Service secure, prevent abuse and comply with the law.

AI features

To run search and the Studio we send what each feature needs, such as your search text or the photos you upload, to AI providers through their business services. At present that is OpenAI, which reads searches, writes the short sentences shown with results and makes your Studio avatar from the photos you upload, Modal, which runs our own image model on the photo you attach to a search, and Google, whose Gemini API makes the pictures of your avatar wearing the products you pick. Your feed and your search results are ranked by our own systems from your taste profile. Under those providers' terms, what we send is used to return a result to us and not to train their models. We send only what the feature needs.

4. Our legal grounds, for people in the EEA and the UK

• Performing our contract with you, to create your account and provide the Service.
• Your consent, for analytics cookies and for any optional information you choose to give. You can withdraw consent at any time.
• Our legitimate interests, to improve and secure the Service, where your rights do not outweigh them.

5. Who receives your data

We do not sell your personal data. We share it only with the providers that run the Service for us, listed here, and in the few situations described after the table.

This list changes as the Service does. The current version is always on this page.

We may also disclose data to comply with the law, to enforce our Terms, to protect rights and safety, or as part of a merger, acquisition or sale of assets, in which case you will be told that your data has changed hands.

The retailers you visit receive nothing from us beyond the ordinary referral information that a click on a link carries.

6. Where your data is processed

We are based in the United States and most of our providers are there, as the table in section 5 shows. If you use the Service from the EEA, the UK or anywhere else, your data is transferred to and processed in the United States. Where the law requires it, we rely on safeguards such as the European Commission's Standard Contractual Clauses and the EU-U.S. Data Privacy Framework.

7. How long we keep it

We keep your personal data while your account is active and for as long as the Service needs it. You can delete your account yourself at any time in Settings, under Account, with Delete account, or ask us to do it at contact@core.shop. Deleting your account removes your profile, your Studio photos, avatar and pictures, your taste profile, your likes, saves, collections and looks. A few records, the picture-search logs and the outbound-click statistics, are kept with the link to you removed, and we may keep data where the law requires it or to prevent fraud.

• Picture-search photos are deleted automatically after 60 days.
• Studio photos, your avatar and the pictures made with it are kept until you replace or delete them, or delete your account.
• Your age is kept while your account is active. A sign-up under the minimum age is deleted at once, together with the age entered, and only an anonymous marker stays on the device.
• Your taste profile and activity are kept while your account is active and deleted with it.
• Analytics session recordings are kept by our analytics provider for 30 days, as described in the Cookie Policy.

8. Your rights

In the EEA and the UK, you can ask to see the data we hold about you, correct it, delete it, restrict or object to how we use it, take a copy of it with you, and withdraw any consent you gave. You can also complain to your data protection authority.

In California, you can ask what personal information we collect, see it, delete it, correct it, and opt out of its "sale" or "sharing". We do not sell or share personal information in the sense those words have under California law. Using these rights never changes how we treat you.

To use any of these rights, email contact@core.shop. We check that the request comes from you and answer within the time the law allows. Deletion needs no request at all. You can delete your account yourself in Settings, under Account, with Delete account.

9. Cookies

We use cookies and similar technologies as described in our Cookie Policy. In the EEA and the UK, cookies that are not strictly necessary, including analytics, are set only after you agree to them in our cookie banner.

10. Security

We protect your data with standard measures, including encryption in transit and hashed passwords. No way of sending or storing data is completely secure, and we cannot promise that it is.

11. Changes to this policy

We may update this policy. The current version is always on this page with its date at the top, and we will tell you about important changes where the law requires it.

12. Contact

CORE SHOP Inc.
2093 Philadelphia Pike #1702
Claymont, DE 19703
United States
contact@core.shop