AISLE — Privacy Policy

Version: 0.1 — DRAFT Last updated: 2026-04-28 Effective: _________________________

1. Who We Are

AISLE is a wedding-dress discovery web and mobile app operated by Carcamo Ben, operating as "AISLE" (TODO-COUNSEL: confirm legal entity at launch).

• Privacy questions: privacy@aisle.app
• Postal address: _________________________________________
• Privacy Officer / DPO: Ben Carcamo (acting). For EU representative, see §10.
• For UK / EU representative under GDPR Art. 27: TODO — appoint before EU launch.

2. Scope

This Policy explains what personal information AISLE collects when you use our website, mobile app, and email/SMS communications (the "Services"), how we use it, who we share it with, and your rights. Boutiques and designers featured in AISLE have their own privacy practices and are independent controllers of any personal information you give them directly.

3. Personal Information We Collect

[CONFIRM-AGAINST-HANDOFF] — categories above are the working set; final taxonomy comes from the compliance handoff.

We do not intentionally collect special-category / sensitive personal information. We do not collect government IDs, payment-card data (no payments are processed in the App today), biometric data, geolocation more precise than city, or health information.

4. Lawful Bases for Processing (EU/UK GDPR)

If you withdraw consent for a consent-based purpose, we stop that processing; processing before withdrawal remains lawful.

[CONFIRM-AGAINST-HANDOFF]

5. How We Use Personal Information

• Provide and operate the Services (browse catalog, save dresses, manage Circle, request

appointments).

• Personalise the App experience to your style, region, and budget.
• Send transactional messages (account, appointment, security alerts).
• Send marketing messages where you've opted in (you can opt out at any time via the email link

or in-app settings).

• Diagnose and fix technical problems; protect against fraud, abuse, and security incidents.
• Comply with legal obligations and enforce our Terms.
• Plan and improve the Services using aggregated, de-identified analytics.

We do not use your personal information to train machine-learning or AI models on your identifiable content. Where we run ML on aggregated patterns (e.g., recommender systems), we use de-identified data only.

6. Who We Share With

Boutiques — When you request an appointment, we share the appointment details (name, contact, dresses to try, optional notes, optional Circle photo URL you elect to share) with the boutique you chose. The boutique becomes an independent controller of that information once received.

Designers — We do not share your identity with designers in the ordinary course. Aggregated, de-identified popularity statistics may be shared.

Service providers / sub-processors (current set, [CONFIRM-AGAINST-HANDOFF]):

We require sub-processors to provide adequate safeguards by contract (SCCs/UK IDTA where applicable) and to process data only on our instructions.

Legal & safety: We may disclose personal information to comply with a binding legal demand, to enforce our Terms, or to protect AISLE, our users, or the public from harm or fraud — with notice to the affected user where lawful.

Corporate transactions: If AISLE is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred subject to standard confidentiality undertakings and continued application of this Policy (or notice and opt-out where required).

We do not sell your personal information for money. We do not engage in cross-context behavioural advertising. (See §8.6 for CCPA/CPRA "sale" and "sharing" definitions.)

7. International Transfers

AISLE primarily processes personal information in Canada. We may transfer personal information outside your country to our sub-processors. For transfers from the EEA, UK, or Switzerland, we rely on:

• Adequacy decisions where they exist (Canada has EU adequacy for PIPEDA-covered orgs);
• EU Standard Contractual Clauses (Module Two, 4 June 2021);
• UK International Data Transfer Addendum for UK data;
• Quebec Law 25 Privacy Impact Assessments for transfers outside Quebec;
• Australia APP 8 reasonable steps to ensure equivalent protection.

A copy of the safeguards is available on request (privacy@aisle.app).

8. Your Rights — Per Region

Plain English: You have rights over your information — access it, fix it, delete it, complain. The exact rights depend on where you live.

8.1 Universal — Common to All Regions

• Access the personal information we hold about you.
• Correct inaccuracies.
• Delete ("right to erasure" / "right to be forgotten").
• Withdraw consent for consent-based processing.
• Object to or restrict certain processing.
• Portability in a machine-readable format for the data you've given us.
• Lodge a complaint with your data-protection regulator.

To exercise any right, email privacy@aisle.app. We respond within 30 days (some regions require shorter — we honour the shortest applicable). We may need to verify your identity before fulfilling.

8.2 Canada — PIPEDA + Quebec Law 25

• Right to know what we collect and why.
• Right of access (PIPEDA Principle 9) and correction.
• Quebec users additionally have:
• Right to data portability (Law 25 s.27.1, in force Sept 2024).
• Right to know about and challenge automated decision-making affecting you (Law 25 s.12.1).
• Right to de-indexing in certain circumstances.
• Complaints: Office of the Privacy Commissioner of Canada (priv.gc.ca);

Commission d'accès à l'information (Quebec) (cai.gouv.qc.ca).

8.3 EU / EEA — GDPR

Articles 15–22 rights: access, rectification, erasure, restriction, portability, objection (incl. to direct marketing — absolute), automated-decision rights. Lodge complaints with your local Supervisory Authority. Our EU representative under Art. 27 is: TODO — appoint before EU launch.

8.4 UK — UK GDPR + Data Protection Act 2018

Same substantive rights as §8.3. Complaints: UK Information Commissioner's Office (ICO) at ico.org.uk. Our UK representative under UK GDPR Art. 27: TODO — appoint before UK launch.

8.5 Australia — Privacy Act 1988 (APPs)

• APP 12 (access), APP 13 (correction), APP 1 (open and transparent management), APP 5

(notification at collection), APP 6 (use and disclosure), APP 8 (cross-border).

• Complaints: Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

8.6 California — CCPA / CPRA

• Right to **Know, Access, Delete, Correct, Limit Use of Sensitive PI, Opt-Out of Sale/Sharing,

Non-Discrimination**.

• AISLE does not sell or share personal information for cross-context behavioural advertising

as those terms are defined in the CCPA. We provide a "Do Not Sell or Share My Personal Information" link as a courtesy.

• Authorised agents may submit requests on your behalf with verifiable proof.
• Complaints: California Privacy Protection Agency (cppa.ca.gov) or the **California

Attorney General**.

• "Shine the Light" (Cal. Civ. Code §1798.83): California residents may request annually a

list of personal information shared with third parties for those parties' direct marketing — AISLE does not share for third-party marketing, so the list is empty.

8.7 Other US States

We honour analogous rights under the Virginia CDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA, Texas DPDCA, and successor state laws (universal opt-out signals — Global Privacy Control — recognised where required). [CONFIRM-AGAINST-HANDOFF] for the state-by-state rights matrix once published.

8.8 Rights Summary Table

9. Retention

[CONFIRM-AGAINST-HANDOFF] — proportionality review by counsel against GDPR Art. 5(1)(e).

10. Children

The Services are not directed to children under 16. We do not knowingly collect personal information from anyone under 16. If you believe we have, contact privacy@aisle.app and we will delete it. (See Terms §2.)

11. Security

We use industry-standard technical and organisational measures: TLS in transit, encryption at rest, access controls on a need-to-know basis, regular dependency and vulnerability scanning, and incident-response procedures. No system is perfectly secure; if you suspect an incident, contact security@aisle.app.

In the event of a personal-data breach affecting you, we notify the relevant regulator within 72 hours where required (GDPR Art. 33; PIPEDA Breach of Security Safeguards Regulations) and notify you without undue delay where the breach is likely to result in a real risk of significant harm.

12. Marketing & Communications

• Transactional messages (account, appointment, security) are sent without separate consent.
• Marketing messages (newsletters, promotional emails/SMS) are sent only with your consent.

Canadian users: CASL-compliant express consent. EU/UK/AU users: opt-in. US users: opt-in for SMS (TCPA), opt-out for email (CAN-SPAM).

• Unsubscribe via the link in any marketing message or in-app preferences.

13. Cookies & Similar Technologies

See Cookie Policy.

14. Automated Decision-Making

The personalisation algorithm that ranks dresses for you is automated. It does not produce legal or similarly significant effects for you (it is a recommendation, not an admission or denial of service). On request (privacy@aisle.app) we will explain in plain language how it works for your account and let you reset its model state.

15. Changes to This Policy

We will post material changes 30 days before they take effect, with notice in-app and to your email where we have one. The version history below tracks changes.

16. Version History

17. Contact

• privacy@aisle.app — privacy questions, rights requests
• security@aisle.app — security concerns
• Postal: _________________________________________
• EU representative (Art. 27 GDPR): TODO — appoint before EU launch
• UK representative (Art. 27 UK GDPR): TODO — appoint before UK launch