Privacy Policy

CloFound is an unincorporated business and trading name used by [YOUR LEGAL NAME], who is the data controller for the personal information described here. Business correspondence address: [BUSINESS CORRESPONDENCE ADDRESS]. Privacy enquiries: hello@clofound.com. CloFound initially serves the United Kingdom.

CloFound is a discovery platform, not a marketplace. We bring together listings from third-party resale marketplaces so they’re easier to find. When you choose an item, you’re sent to the original listing to complete your purchase. CloFound does not own, sell, ship, fulfil or process purchases for the products shown. Prices, availability, condition, sizes, photographs and descriptions may change or disappear; check the original marketplace listing before purchasing. The seller and marketplace handle the transaction under their own terms. Displaying a listing does not imply a partnership or endorsement.

• Account information — email address, optional display name, account identifier, UK country/currency settings, setup status and account/welcome-email timestamps.
• Login information — credentials submitted to our authentication service, verification and recovery information, and session tokens used to keep you signed in. CloFound does not display or store readable passwords in its profile records.
• Preferences — shopping department, clothing and shoe sizes, fit/length, budgets, brands, categories, colours, materials, styles, patterns, condition and permitted marketplaces.
• Saved items and saved searches — listing details you save, saved queries and full filters, alert settings, activation/check timestamps and records of matching listings included in requested email alerts, delivery attempts and outcomes.
• Activity and personalisation — signed-in searches, listing views, outbound clicks, saves, removals and saved-search actions, with timestamps and available listing attributes. Photo-search activity records the search mode, not the uploaded photo. This is first-party account activity, not advertising tracking.
• Photo Search — a resized copy of the submitted image and extracted fashion descriptions used to perform your requested search, as explained below.
• Technical and security information — request information such as IP address and browser details handled by hosting/authentication services, session information and operational error logs. Their detailed log fields and retention are subject to provider confirmation.
• Email information — recipient email, optional first name for the welcome email, message content and delivery/suppression information handled by the email service. If you email us, we also receive what you choose to include in your enquiry.

No third-party analytics SDK, advertising pixel or marketing-cookie integration is present in the application. We do record the signed-in account activity described above for personalisation.

• To run your account and keep it secure.
• To personalise search results, For You and homepage edits around your preferences and activity.
• To keep your saved items and saved searches.
• To send account emails, such as a welcome email and password resets.
• To check new stored marketplace listings against email alerts you enable, using your saved search and current preferences, and send a daily digest only when qualifying new matches are available. You can disable each alert or delete the saved search in Saved; enabling alerts does not subscribe you to marketing emails.
• To fix problems and improve the service.

The intended lawful bases below are matched to the current functionality. They require controller confirmation before launch; they are not established merely by the software.

• Contract — providing the service you request: creating and authenticating your account, maintaining explicit preferences, saved items and searches, carrying out text/Photo Search and sending essential verification, recovery and welcome/service emails.
• Legitimate interests — subject to a documented assessment: securing the service and troubleshooting errors. Behavioural personalisation from signed-in saves, searches and interactions is proposed on this basis only if the controller’s assessment supports it and an effective objection can be honoured.

[OWNER / LEGAL REVIEW: confirm the activity-specific lawful bases, legitimate-interests assessment and how behavioural-personalisation objections will be honoured before launch]

The current application does not implement a marketing mailing programme or a consent-based analytics service. We do not describe those as current processing purposes.

Your original file is selected in your browser. Before analysis, the browser creates a JPEG copy with a maximum side of 1,024 pixels. That copy is sent to CloFound’s server and then to the Lovable AI Gateway using an OpenAI image-analysis model. The analysis request sets “store: false”; this request setting is not a guarantee about every provider’s operational logs or retention.

The application does not upload the original file to a photo-storage bucket or save it in an account record. A local preview reference, extracted descriptions and results are held in browser memory to allow you to return to Photo Search without repeating analysis. This memory is lost on a full page reload or when the tab closes, and cleared on successful account deletion. There is no permanent photo library or scheduled photo-deletion job.

Only text queries derived from the fashion descriptions are sent to eBay or ReefAPI, not your photo. Search terms may be stored alongside shared marketplace listings without an account identifier. A signed-in photo-search activity event records the mode, not the image. No code deliberately logs the uploaded image; operational/provider logging may be separate.

The image is submitted for the requested search, not for another application feature. Provider-side logging, retention, training restrictions and transfer arrangements cannot be confirmed from this implementation. [PROVIDER / OWNER CONFIRMATION: AI Gateway and OpenAI image-request logging, retention, permitted uses and transfer arrangements]

We do not sell your personal information. The implementation uses these services:

• Lovable Cloud — application database and authentication infrastructure for account information, preferences, saves, saved searches and activity.
• Lovable managed email delivery — welcome-email recipient details, message content and delivery/suppression handling. Verification and password recovery use the authentication service; these remain separate from saved-search alerts.
• Resend — your verified account email address and requested saved-search alert content, including the query and selected listing details, for alert email delivery. Provider contracts, processing locations and retention require confirmation before launch.
• Lovable AI Gateway and OpenAI — the resized image and analysis prompt for Photo Search.
• Application hosting and delivery infrastructure — site requests and operational/security information. The code targets a Cloudflare Worker environment; the complete deployed hosting/subprocessor chain requires confirmation.

[PROVIDER / OWNER CONFIRMATION: contracting entities, processor roles, data-processing agreements and relevant subprocessors for Cloud, authentication, email, AI and hosting]

Marketplace data providers are distinct. eBay supplies listing data; ReefAPI retrieves Vinted and Depop listing data. These integrations receive search terms and search parameters, which can include requested department, size or price. They do not receive CloFound account identifiers, email addresses, login details or photos through the search implementation. We do not assume that every marketplace or listing provider is a processor of account data or an official CloFound partner.

When marketplace images load, their image hosts receive the browser request. When you open an original listing, you leave CloFound and that marketplace’s privacy policy and purchase terms apply.

The services above may process data outside the UK. Their current processing locations and UK transfer mechanisms are not established by application code. We do not claim that all services are UK-based or that particular contractual safeguards are already in place.

[PROVIDER / LEGAL CONFIRMATION: processing countries and applicable UK adequacy decisions, IDTA or UK Addendum/other safeguards for each relevant provider before launch]

Account/profile information, preferences, saved items, saved searches and their alert settings remain until you remove the relevant records or successfully delete your account. Account activity has no scheduled age-based deletion in the current application; it is removed by account deletion. Using only the latest activity for recommendations does not delete older records.

Alert delivery history is kept with the saved search to prevent repeated listing emails and handle bounded retries. Deleting the saved search removes its delivery history; successful account deletion removes all account-owned alerts and delivery history. Disabling an alert stops future processing but retains the saved search and its history. Provider-side email records are separate.

Search/navigation information in session storage normally lasts for the browser tab session; sign-in storage persists until sign-out, expiry or browser clearing. Photo previews and extracted results have the browser-memory lifetime described above. Marketplace retrieval caches reuse results for 30 minutes; this is a freshness window, not a guarantee that all query information is erased after 30 minutes. Stored marketplace queries use a 21-day retrieval window, which is not a deletion schedule.

Successful account deletion removes the live account-owned application records and authentication account. Shared marketplace listings and their unlinked search terms remain; provider-side email records, suppression lists, security logs and backups are not erased by this operation. No backup, email-log or security-log retention period is defined in the application.

[OWNER / PROVIDER CONFIRMATION: justified activity/query retention and cleanup policy, plus authentication, email, operational-log and backup retention/deletion periods]

Depending on the circumstances, UK data protection law gives you rights of access, correction, erasure, restriction, objection (including to processing based on legitimate interests) and data portability. You can withdraw consent where processing actually relies on consent, without affecting earlier lawful processing.

You can update your preferences in Profile, remove saved items/searches, or use “Delete account”. After successful deletion, the live authentication account, profile, preferences, saves, saved searches and alert settings, notifications and account activity are removed and you are signed out. Shared listings and the provider records described above are not covered by that action. If deletion fails, the account may be partially cleared; retry or contact us.

For access, portability, correction, restriction, objection or other privacy requests, email hello@clofound.com with the account email and the right you want to exercise. Do not send a password. We may need proportionate identity checks and will normally respond within one month, explaining any legally permitted extension. The site does not currently provide a self-service export or behavioural-personalisation opt-out.

You can also complain to the Information Commissioner’s Office. Personalisation is used for fashion discovery, not decisions with legal or similarly significant effects.

See our Cookie Policy.

We’ll update this page if anything changes and revise the date above. Questions about privacy: hello@clofound.com.