Privacy Notice — United Arab Emirates (English)

Document version: 2026-10-22
Controller: Chengdu Xinling Qiyue Network Technology Co., Ltd. ("OutfitMuse", "we", "us", or "our")
Registered address: Room 1601, No. 2 (self-numbered), 16th Floor, Building 1, No. 145 Tiantai Road, Chengdu High-Tech Zone, Chengdu, Sichuan, People's Republic of China
Privacy contact: support@echojoy.cn

This notice applies to OutfitMuse users in the United Arab Emirates. The global Privacy Policy is included in Part 2 of this same page. Where United Arab Emirates law gives you a mandatory protection, that protection applies.

Information, purposes, and choices

We process the account, sign-in, content, profile, city (manually selected or approximately inferred from IP), device, diagnostic, analytics, purchase, subscription, entitlement and support information described in our global Privacy Policy. We receive it directly from you, from your selected third-party sign-in service, and automatically from your device and use of the Services, and from the store used for a purchase for transaction verification and benefit administration.

We use it to create and secure your account, provide the wardrobe, styling, weather-aware, and support features you request, generate an AI result only when you actively request that feature, prevent fraud or misuse, maintain service reliability, and comply with law. Your email and sign-in information are required to create and secure an account. We do not request device location permission or collect precise device location. For city-based weather features, we use approximate city-level location inferred from your IP address or a city you select manually. Photos, prompts, profile preferences, and body information are optional, but a feature that needs a particular input cannot work without it.

Where applicable law requires consent for a processing activity, we obtain the required affirmative consent for that activity. Device permissions and general service acceptance do not replace explicit permission for third-party AI processing. You may withdraw optional permissions in your device settings and may stop using an AI feature at any time. Withdrawal does not affect processing already carried out, and may make a related feature unavailable.

AI, disclosure, and international processing

Before sending personal information for an AI request, we explain the processing and obtain your explicit permission. The photos or image links you choose, which may include your face, and the instructions and relevant preferences needed for the request are sent through a contracted AI gateway to AI model providers for analysis, generation or editing as needed. If you decline, we do not send that AI request and the relevant feature cannot proceed. We use other contracted providers for cloud hosting, storage, authentication, email delivery, crash reporting, and support. They may process information only to provide services to us, subject to contractual and technical safeguards.

Our overseas production environment is hosted primarily in the United States using contracted cloud hosting services. Providers may process information in the United States or other locations needed to provide their services. We use appropriate contractual, organisational, and technical safeguards for cross-border processing as required by applicable law. For the current provider names and their main processing locations, see our Subprocessor List. We do not sell personal information, use it for cross-context behavioural advertising, or use your photos, prompts, profile or body information, or generated images to train our or a third party's AI models.

Purchases and subscription information

We process account, product and transaction identifiers, verification information, purchase amount and currency where available, subscription status and periods, credit usage, refunds and billing-support records to verify purchases, deliver benefits, prevent fraud, reconcile transactions and handle disputes. The app store used for your purchase processes payment credentials under its own terms; through these integrations, we do not receive full card numbers, security codes, payment passwords or authentication codes. The stores also perform certain account, payment and fraud-prevention activities independently. Configured analytics events and identifiers help us understand feature usage.

Retention, security, and your rights

We keep account and saved content data while your account is active unless you delete it earlier. Temporary AI-request copies are deleted from active systems within 30 days unless saved to your account or required for security, legal, or dispute reasons. Operational and diagnostic logs are generally retained for up to 90 days. When the app confirms successful account deletion, you can no longer sign in with that account. This operation does not automatically erase all associated wardrobe content, history, photos or interaction records. To request deletion of remaining personal data, use the privacy contact in this policy; the retention and deletion rules below apply. If the app reports a failure, it does not confirm completion or clear your local sign-in data.

If specific records must be retained by law or are temporarily needed for security audits or dispute resolution, we retain only the minimum necessary information for the shortest necessary period, restrict processing to the permitted purpose, and delete or irreversibly anonymize it when that requirement ends. Where technical limitations temporarily prevent deletion from backups, we securely isolate those copies and limit processing to storage and necessary security protection until they can be deleted or irreversibly anonymized as soon as technically possible. These exceptions do not permit continued use of retained personal data for other purposes. Anonymization means the data can no longer identify or be linked to you and cannot be restored to an identifiable form. See the Account Deletion Instructions for the in-app and backup request paths.

Necessary purchase, subscription, entitlement and support records may be retained for limited legal, accounting, refund, dispute or fraud-prevention purposes. Deleting your account does not itself cancel store renewal; use the original store's subscription settings to avoid future charges. After the warning, you may still proceed with account deletion without waiting for the paid period to expire. These retention descriptions concern our own systems; provider-specific retention is described in the Third-Party Services List.

Subject to applicable law, you may request information about processing, access to and correction of personal information, deletion or restriction of processing, transfer of information where applicable, or object to certain processing. You may also request a review of a qualifying decision based solely on automated processing. OutfitMuse does not make decisions producing legal or similarly significant effects solely through automated processing.

You can update or delete many items directly in the app. For another request, email support@echojoy.cn with the subject line "UAE Privacy Request" and your account email. We may verify your identity. We use reasonable administrative, technical, and organisational safeguards; if a security incident requires notice, we will provide notice as required by law.

We may update this notice when our practices, Services, or legal requirements change. For a material change, we will give appropriate notice and obtain consent where required before it takes effect.

---

Part 2 — Global Privacy Policy (English)

Document version: 2026-10-22
Controller: Chengdu Xinling Qiyue Network Technology Co., Ltd. ("OutfitMuse," "we," "us," or "our")
Registered address: Room 1601, No. 2 (self-numbered), 16th Floor, Building 1, No. 145 Tiantai Road, Chengdu High-Tech Zone, Chengdu, Sichuan, People's Republic of China
Privacy contact: support@echojoy.cn

This Privacy Policy explains how OutfitMuse collects, uses, discloses, retains, and protects personal information when you use our mobile applications, websites, and related services (collectively, the "Services").

This global Policy applies wherever we make the Services available. Country-specific notices may supplement it for Brazil, Japan, Mexico, India, Indonesia, Malaysia, the United Arab Emirates, Nigeria, or another market. It is not directed to people in the European Economic Area, the United Kingdom, or jurisdictions where we have not made the Service available. We will publish an applicable regional notice before offering the Service in those regions.

Regional privacy notices

Please also read the notice for your country or region, where listed below. A regional notice supplements this global Policy; choosing a different display language does not remove any protections that apply where you live.

• Hong Kong and Taiwan — 繁體中文
• Canada — Français
• Brazil — Português
• Japan — 日本語
• Mexico — Español
• India — English
• India — हिन्दी
• Indonesia — Bahasa Indonesia
• Malaysia — Bahasa Melayu / English
• United Arab Emirates — English
• Nigeria — English

Please read this Policy with our Terms of Service. If you have questions or wish to exercise a privacy right, contact us at the email address above.

1. Information We Collect

We collect information that you provide, information generated while you use the Services, and limited information that is collected automatically.

We do not request device location permission or collect precise device location. For city-based weather features, we use approximate city-level location inferred from your IP address or a city you select manually. You may also deny camera or photo-library permission; however, features that require you to take or upload photos will not be available.

Payments for subscriptions and in-app purchases are processed by the app store used for your purchase. OutfitMuse receives the transaction and subscription information necessary to verify purchases and provide benefits. Through these store billing integrations, we do not receive your full payment-card number, card security code, payment-account password or payment authentication code. The relevant store handles payment details under its own terms and privacy policy.

2. How We Use Information

We use personal information only as needed to:

• provide, maintain, personalize, and secure the Services;
• create and administer accounts; verify sign-ins; prevent fraud, abuse, and unauthorized access;
• receive, store, transform, and return the photos, prompts, and other inputs needed for the AI feature you actively request;
• provide weather-aware outfit recommendations based on your manually selected city or approximate city inferred from your IP address;
• verify and reconcile purchases, provide and synchronize membership and AI credits, prevent payment-related fraud, and handle refunds, billing disputes and necessary transaction records;
• understand app usage through the configured analytics described above;
• respond to support requests and communicate about material service or policy changes;
• diagnose crashes, fix defects, measure service reliability, and enforce our Terms; and
• comply with legal obligations and protect the rights, safety, and security of OutfitMuse, our users, and others.

We do not use your photos, prompts, profile or body information, or generated images to train or improve our or a third party's AI models. We do not use personal information for targeted advertising.

Push notifications and device registration

This section applies only to app versions that include the push notification feature. For versions without this feature, the push-specific device registration and processing described in this section do not apply. Feature availability is separate from whether you grant system notification permission.

We provide push notifications through a service compatible with your device and app version. The providers and information they process are described under “Push service providers” below. To register an app installation and manage notification delivery, our servers process the installation UUID, push token, notification permission and preference status, language, and time zone. When you are signed in, these records are linked to your account through your authenticated session. The installation UUID identifies an app installation; it is not a hardware serial number.

We use this information to deliver task-result notifications and applicable service notices to the appropriate installation, select the notification language and delivery time, and respect notification settings. Where outfit reminders are enabled, we also use it for those reminders, subject to your preferences and any required consent. Notification permission and acceptance of this policy do not by themselves constitute explicit consent to marketing messages.

You can turn off system notifications in your device settings and manage available reminder preferences in the app. Turning off notifications does not prevent you from using Task Center or viewing results, and does not itself delete existing registration or account records. We retain notification registration and preference records only for as long as necessary for their stated purposes. Account-linked records are covered by the account-deletion rules and limited retention exceptions in this policy. Provider-held records and applicable retention rules are described in the Third-Party Services List.

Push service providers

The applicable push service processes the push token, notification payload, and technical information needed to deliver messages. The service used depends on your device operating system and app version. Provider identities, any service-specific identifiers, processing locations and retention rules are described in our Third-Party Services List.

Community content and interactions

Where community features are available, publishing makes your selected outfit and associated clothing images, nickname and avatar visible to other users. Items and related information you choose to make public with your post are also displayed. Where a public sharing page is provided, anyone with its link can access it. You may also choose to make wardrobe items and related information public and may turn automatic publication of new items on or off. Wardrobe content you have not chosen to make public remains private.

We process account-linked publication, interaction, browsing and report records to provide community features, improve the service and maintain safety. Community try-on uses your photo as described in the AI section of this Policy; results remain private unless you choose to share them.

You can remove your posts and manage interactions and blocked authors. Removing a post ends its community display but may not recall external copies or other users' already-generated try-on results. Account deletion and retention follow this Policy.

3. AI Feature Processing and Your Choices

When you request an AI-powered feature, OutfitMuse sends the photos or image links you choose, which may include your face, and the instructions and relevant preferences needed for the request, through a contracted AI gateway to AI model providers for analysis, generation or editing as needed. Before this personal information is sent, we explain the processing and ask for your explicit permission in the app. If you decline, we do not send that AI request and the relevant feature cannot proceed. Agreeing to general service terms or buying a membership does not replace this permission. Further details are in our Third-Party Services List.

You may stop using an AI-powered feature at any time. The relevant feature cannot operate without the necessary inputs. You can delete uploaded content, generated content, or your account as described in the Account Deletion Instructions.

4. When We Disclose Information

We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

We disclose information only in these limited circumstances:

• Community publication. When you choose to publish content or make wardrobe items public, we display the selected content and author information as described in “Community content and interactions” above.

• Sharing at your direction. When you use the device sharing function, the image you select is sent to the external service you choose, which handles it under its own rules.

• Service providers. We use providers that process information on our behalf for cloud hosting, storage, content delivery, authentication, email delivery, push delivery, AI processing, crash reporting, and customer support. They may use the information only to provide services to us, subject to contractual and technical safeguards.

• App stores and billing. We exchange the identifiers and transaction information needed to verify purchases and administer paid benefits with the store used for your purchase. App store providers also process certain account, payment and fraud-prevention information independently under their own policies; not every store activity is performed solely on our instructions.

• AI providers. When you request an AI feature, the necessary images, prompts, and related request parameters are disclosed to the AI providers described in our Subprocessor List.

• Legal and safety reasons. We may disclose information when we reasonably believe it is necessary to comply with law, enforce our agreements, protect rights or safety, investigate fraud or security incidents, or respond to valid legal process.

• Corporate transactions. If we are involved in a merger, financing, reorganization, acquisition, or sale of assets, personal information may be transferred as part of that transaction, subject to this Policy or notice where required by law.

We do not make your wardrobe, profile photos, body photos, or generated images public by default.

5. International Processing and Data Location

Our overseas production environment is hosted primarily in the United States using contracted cloud hosting services. This includes application infrastructure and storage for overseas account and content data.

Our providers may process information in the United States or other locations necessary to provide their services. When information is transferred across borders, we use appropriate contractual, organizational, and technical safeguards required by applicable law. We will update this Policy before changing the primary data region or materially changing the categories of recipients.

6. Retention and Deletion

To delete your account, open Profile → Settings (or directly in Profile in versions without a Settings page) in the app and follow the account-deletion instructions.

We retain personal information only for as long as needed for the purposes in this Policy:

• Account information, wardrobe content, profile information, preferences, and saved generated results are retained while your account remains active, unless you delete them earlier.
• Temporary copies used to complete an AI request are deleted from our active systems within 30 days after completion, unless they are saved as content in your account or must be retained for security, legal, or dispute-resolution reasons.
• Security, diagnostic, and operational logs are generally retained for up to 90 days, unless a longer period is necessary to investigate an incident or comply with law.
• When the app confirms successful account deletion, you can no longer sign in with that account. This operation does not automatically erase all associated wardrobe content, history, photos or interaction records. To request deletion of remaining personal data, use the privacy contact in this policy; the retention and deletion rules below apply. If the app reports a failure, it does not confirm completion or clear your local sign-in data.

If specific records must be retained by law or are temporarily needed for security audits or dispute resolution, we retain only the minimum necessary information for the shortest necessary period, restrict processing to the permitted purpose, and delete or irreversibly anonymize it when that requirement ends. Where technical limitations temporarily prevent deletion from backups, we securely isolate those copies and limit processing to storage and necessary security protection until they can be deleted or irreversibly anonymized as soon as technically possible. These exceptions do not permit continued use of retained personal data for other purposes. Anonymization means the data can no longer identify or be linked to you and cannot be restored to an identifiable form.

Purchase, subscription, entitlement and related support records may be retained after account deletion where and for as long as necessary for legal or accounting obligations, refunds, disputes or fraud prevention. Access is restricted and retention is limited to the relevant purpose. Account deletion does not itself cancel a subscription held with an app store; cancellation is explained in our Membership and Auto-Renewal Terms.

The retention rules above describe our own systems. Provider-specific processing and retention are described in the Third-Party Services List.

For deletion steps and the limited exceptions to deletion, see our Account Deletion Instructions.

7. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information, including access controls, encryption in transit, role-based access, and security logging. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we identify a security incident that requires notice under applicable law, we will provide notice as required.

8. Your Privacy Choices and Rights

Depending on where you live, you may have rights to request access to, correction of, deletion of, or a portable copy of personal information. You may also withdraw optional camera or photo-library permissions in your device settings. You can update or delete many items directly in the app, including saved photos, preferences, and your account.

To make a request that is not available in the app, email support@echojoy.cn with the subject line "Privacy Request." Please include the email address associated with your account and the request type. We may verify your identity before responding. We will not discriminate against you for exercising a privacy right.

9. California Privacy Notice

This section applies to California residents. In the preceding 12 months, we may have collected the following categories of personal information: identifiers (such as email address, account ID, IP address, and device identifiers); customer-record information you provide; commercial information such as purchase history, subscription status and entitlement records; internet or network activity; approximate city-level location inferred from IP and manually selected city information; user content (including photos, prompts, and generated images); and profile information, including body-profile information that you choose to provide.

We collect these categories directly from you, automatically from your device and use of the Services, and from sign-in providers when you choose a third-party sign-in method, and from the store used for a purchase to verify transactions and administer benefits. We use and disclose them for the purposes described in Sections 2 and 4.

We do not sell personal information or share personal information for cross-context behavioral advertising, as those terms are defined by California law. We do not use or disclose sensitive personal information for purposes other than providing and securing the Services and the other permitted purposes described in this Policy. California residents may submit access, correction, deletion, or portability requests through the contact method in Section 8. Authorized agents may submit requests where permitted by law, subject to verification of their authority and your identity.

10. Children

OutfitMuse is not directed to children under 13, and you must be at least 13 years old to use the Services. If you are under the age of majority where you live, you may use the Services only with permission from your parent or legal guardian. We do not knowingly collect personal information from children under 13. If we learn that we collected such information without appropriate authorization, we will delete it.

11. Changes to This Policy

We may update this Policy when our practices, Services, or legal requirements change. For material changes, we will provide notice through the Services or by another appropriate method and, where required, obtain your consent before the change takes effect. The "Document version" date identifies this revision. Any effective date and required notice will be communicated when an update takes effect.

12. Contact Us

Chengdu Xinling Qiyue Network Technology Co., Ltd.
Privacy requests and questions: support@echojoy.cn

If you contact us about a privacy request, please do not send photos, identity documents, or other sensitive information unless we specifically ask for it through a secure channel.