The small print, written large.

Everything on this page is a working draft prepared for the founder's review. It describes how the product is built to behave; where the law requires a formal document (the privacy notice, the marketplace terms, the creator agreement), the final text will replace this before anyone outside the team is invited.

Privacy Shoppers Marketplace Creators & stylists Partners Cookies Contact

1. Privacy notice

Who. Does It Fit! is operated by [entity to be confirmed: Luxton London Ltd or Does It Fit Ltd], the data controller, registered in England and Wales at [address]. ICO registration [number].

What we hold, and why

Data	Why	Lawful basis	Kept for
Your brief: the story, where you're going, budget, the sizes you type, colours you never wear	To build your three looks and improve the engine	Contract (guests: legitimate interests)	Briefs 12 months; aggregated statistics indefinitely
Account: your name and email address, a scrambled (argon2id) copy of your password, handle, display name, city, bio, sizes as labels (and a passkey's public key, for accounts made with one)	To keep your saved looks, posts and earnings	Contract	Until you delete the account; money records 6 years after the tax year
Clicks to shops and purchases reported back by shops or affiliate networks (order reference, value, commission)	To pay creators and stylists and to run the business	Legitimate interests; legal obligation (tax)	6 years after the tax year
Marketplace listings, orders, disputes, ratings, and the seller details HMRC requires (name, address, date of birth, NI number or UTR, collected before the first payout)	To run the marketplace and meet the digital platform reporting rules	Contract; legal obligation	Orders 6 years; HMRC data as the rules require
In-store room sessions: the height you type, numbers derived on your phone from two photographs	To tell you your size per brand in that store	Consent	20 minutes unless you save them to an account

What we never hold

Photographs of you. In the measuring room and in the app, landmarks are computed on your phone and only numbers are sent. The API refuses image data. There is nothing to leak.
Passwords. We keep only a one-way scrambled (argon2id) version of your password. Nobody here can read it, and we never email it to you. If you later sign in with Google, Google tells us your name, email and an account id, nothing else.
Card details. Shops take your payment on their own sites; marketplace payments go to Stripe.
The text of a brief that triggers the wellbeing screen. We store only that the screen fired.

Who sees it

Railway (hosting, EU region), Stripe (payments and payouts), the shops and affiliate networks that fulfil your purchase (they receive an anonymous click reference, never your name from us), Anthropic (the model that reads briefs when enabled; briefs are sent without your identity and are not used to train models under our agreement), and Royal Mail or Evri for marketplace labels. No advertising networks. We do not sell data.

Your rights

Export everything from your account page in one tap; delete your account the same way (personal details are erased immediately; money records are kept as the law requires, detached from your name). You can also ask us to correct or restrict data, object to processing on legitimate interests, and complain to the ICO at ico.org.uk.

2. Terms for shoppers

We find outfits; we do not sell clothes from shops. When you buy from a shop, the contract is with the shop, at the shop's price, under the shop's returns policy and your Consumer Rights Act rights against them. We may earn a commission from the shop; it never changes the price you pay or which pieces you see.
Nothing can be paid for a place in a look. The engine ranks on fit to your brief, your budget and stock in your size, and that is all.
Looks are suggestions. Stock and prices are the shop's and can change between our showing a piece and your buying it.
You must be 18 or over to hold an account or use the marketplace.
Be kind. Abuse of stylists, creators or other members ends the account.

3. Marketplace terms (buyer protection)

Peer to peer: the seller is a private individual, not a trader, unless their profile says otherwise. Consumer Rights Act remedies do not apply between two individuals; these terms are the protection.

Listing. Sellers describe honestly, photograph the actual item, grade its condition and give laid-flat measurements. Replicas, worn underwear and swimwear, weapons and weapon-like items, and anything illegal are prohibited and removed.
Paying. Stripe takes the payment and holds it. Does It Fit! never holds your money. The price shown is the item plus tracked postage; the platform fee (10%, minimum 50p) is paid by the seller.
Posting. Sellers post within three working days with the tracking reference entered; tracking drives the order's state.
Confirming. You have 48 hours after delivery to confirm or open a dispute. After 48 hours the order confirms itself and the seller is paid after a further 7-day hold.
Disputes. Not arrived: tracking decides. Not as described or damaged: return at the seller's cost and a full refund once the item is back, or a partial refund by agreement. We arbitrate the rest and our decision on the held money is final between the parties.
Ratings go both ways after confirmation and may not be bought, traded or retaliatory.
Tax. Selling your own used things is not normally taxable. Sellers who exceed 30 sales or about £1,700 in a calendar year are reported to HMRC under the digital platform rules; we will ask for the details the rules require before paying out.
Authenticity. We do not certify items. A seller's claim of authenticity is the seller's; above [£300] we may require an authentication partner's check before release.

4. Creator and stylist terms

Every link you share is an advert. It carries #ad and we add the label; you cannot remove it, and you must not remove it from your own caption either. This meets the ASA CAP Code and the CMA's guidance on influencer marketing.
Shares. Creators receive 30% and stylists 40% of the commission we actually receive from a shop on tracked, validated sales from your look or its refits. Nothing is owed on cancelled, returned or unvalidated orders; a later return of a paid-out sale is deducted from the next payout.
Payouts run weekly through Stripe Connect once each sale's return window has closed; the minimum payout is £5. Stripe's identity checks apply. Your earnings are yours to declare.
No gaming. Buying through your own link, coordinating returns, fake refits or bought ratings end the account and forfeit unpaid earnings.
Your looks are built from live stock and must be under the brief's budget; you grant us a licence to show them with your name on this platform and in our own marketing. Followers' sizes and photos are never shown to you.
Stylists answer only briefs where the shopper opted in, within the budget, and write the reason in their own words; a claimed brief is yours for 30 minutes.

5. Partner terms (outline)

Brands, department stores and labels work with us under a separate agreement. In outline: commission on tracked sales (or network terms where an affiliate programme exists); per-unit pricing plus a per-store API seat for the measuring rail; API and widget keys issued in the portal; no paid placement of any kind; feeds used only to dress people; reports show counts, never individuals.

How we read shops' public catalogues

Before a shop has signed with us we may list pieces from its public online catalogue (for Shopify shops, the public products feed), so that people can find them in outfits. Every piece links straight to the shop's own product page, and photos are shown from the shop's own servers, never copied. Our reader identifies itself as DoesItFit/1.0, follows robots.txt, fetches one shop at a time with pauses between requests, and stops at once if a shop asks it to slow down. A shop can claim its free workspace, or ask to be removed, from the link we send it or by writing to us; a removal takes its pieces out of every look straight away.

6. Cookies and storage

One session cookie (dif_session) once you sign in, and the same token in your browser's storage so sign-in survives browsers that block third-party cookies. Local storage keeps your last brief and budget on your device. No advertising cookies.

Analytics, only if you say yes. If we switch on Google Analytics, a banner asks first and nothing is loaded or set until you press "Accept analytics". Your choice is kept on your device (dif.consent); Google's cookies (_ga, _ga_*) last up to two years and only count visits.

7. Contact

Does It Fit! · [entity] · London · [email]. For data requests, write "data request" in the subject line and we answer within one month.