Apparule Privacy Notice

Cuesoft is the controller of everything Apparule holds, as set out in the privacy policy: Cuesoft Inc. and Cuesoft Nigeria Limited, as joint controllers, reachable at hello@cuesoft.io. That includes the records a designer keeps about their own customers in Apparule: those customers are asked for their consent by Apparule directly, not through the designer.

Apparule is open-source software. If you run your own copy, you are the controller of the data it holds, and this notice does not describe it.

Who Can Use Apparule

You can use Apparule from the age of 13. If you are under 18, you may use it only with a parent’s or guardian’s agreement, which also covers the consent for your photos below. See children.

Signing In

• What we collect: you sign in with Google, the only way in. Apparule receives from Google your Google account identifier, email address, name and profile picture address. You then choose a username and, if you like, a display name and the city, state and country you want shown.
• Why: to create your account, keep you signed in and show your profile to the people you deal with.
• Session: a cookie that scripts on the page cannot read, valid for up to 24 hours.
• Legal basis: performing the contract you enter when you create an account (GDPR Art. 6(1)(b), and the equivalent contractual basis under the NDPA).

Body Photos and Measurements

• What we collect: for each capture, a photo of you from the front and one from the side, and your height. Location and camera metadata are stripped from the photos when they upload. From them Apparule computes your measurements, and it keeps any measurement you enter or correct by hand.
• How they are processed: on our own servers, by open-source pose and body-outline models that ship with Apparule. No photo is sent to an outside AI service, and photos are never used to recognise who you are.
• Who sees them: only you. Your vault is private. When you commission a designer, they receive a fixed copy of the measurements you attach to that order, never your photos. The share button builds a text of your latest measurements that you paste wherever you choose; Apparule sends it nowhere itself.
• Improving the measurement model: your photos and measurements are used to measure you and for nothing else, unless you turn on a separate opt-in that lets us use them to improve Apparule’s measurement model. It is off unless you switch it on, and you can switch it off at any time, after which what you gave is removed from our training data. Apparule does not offer that opt-in yet, so nothing you capture today is used this way.
• Retention: a capture you do not save, or one that fails, is deleted with its photos within 24 hours. The photos of a saved capture are deleted 30 days after you save it; the measurements stay until you delete them or your account. Deleted files remain in our storage provider’s recovery copy for up to 7 more days.
• Legal basis: your consent, which Apparule asks for before your first capture (GDPR Art. 6(1)(a), and consent under NDPA s. 25). You can withdraw it by deleting your captures or your account.

Designers, Posts and Social Features

• What we collect: what you post (text and images), your likes, saves, comments and follows, the accounts you block and the reports you make. A designer also adds a bio and the bank details payouts go to: Apparule keeps the bank’s name and code and Paystack’s reference for the account, while Paystack holds the account number.
• Who sees it: posts, comments and profiles are visible to everyone using Apparule. Reports and blocks are seen only by our moderation staff.
• Retention: until you delete them or your account.
• Legal basis: performing the contract (GDPR Art. 6(1)(b)). Reviewing reports rests on our legitimate interest in keeping Apparule safe (Art. 6(1)(f)).

Orders and Messages

• What we collect: the order, its notes and the measurement copy attached to it, and the messages and images you and the designer send in its thread.
• Retention: thread messages are deleted 30 days after the order closes, and in-app notifications after 90 days. The order record itself is kept as a transaction record: see payments.
• Legal basis: performing the contract (GDPR Art. 6(1)(b)).

Payments

Card details never enter Apparule. You pay on Paystack’s hosted checkout under Paystack’s own security certification and privacy policy. Apparule keeps the payment reference, amount and currency of each attempt, and the escrow, refund and payout entries that follow. Those records, like the orders they belong to, are kept for as long as Nigerian tax and company law require us to keep transaction records, and they lose your name and email when you delete your account.

• Legal basis: performing the contract, and our legal obligation to keep transaction records (GDPR Art. 6(1)(b) and (c)).

Email and Push Notifications

• Email: Apparule emails you when money moves on one of your orders: a payment received, an order funded, a payout released or a refund. It sends them through Brevo, which receives your email address and the message.
• Push: if you allow notifications on your phone, Apparule stores your device’s push token and sends notifications through Google’s Firebase Cloud Messaging.
• Legal basis: performing the contract (GDPR Art. 6(1)(b)). Turn push off in your phone’s settings at any time.

Logs and Monitoring

Our servers keep operational logs, and Datadog monitors their health on our instructions. Logs never contain your photos or measurement values. They are kept for no more than 30 days: see retention.

• Legal basis: our legitimate interest in running a secure, working service (GDPR Art. 6(1)(f)); you may object.

Where Your Data Is Held

Apparule’s services and files run on Google Cloud in the United States (Iowa, with the web app served from Virginia), and its databases are run for us by Aiven in DigitalOcean’s San Francisco region. See processors and platforms and international transfers.

Your Rights in Apparule

• Export: download your account, captures, orders, consent records and saved posts from your settings. For anything else, email hello@cuesoft.io.
• Delete: delete your account from your settings once no order is open and no payout is pending. It is removed at the next daily run. An account that never placed an order is deleted entirely; one that did is reduced to an anonymous stub so the transaction records above stay intact.
• Every other right, and how to exercise it, is on your rights.

We do not sell personal data, and Apparule carries no advertising tags.