Privacy Policy Statement

Hey Lullae! ("Hey Lullae!", "we", "our", "us") is a South African fashion-technology business and brand that operates an online AI styling concierge, digital wardrobe and multi-brand fashion commerce platform. The Platform enables users to create a private style and silhouette profile, upload photographs, body measurements, wardrobe and inspiration content, receive AI-assisted styling, sizing, curation and virtual try-on outputs, discover real clothing and accessories offered by established fashion brands, designers, boutiques and retailers ("Retail Fashion Partners"), and purchase selected items through the Platform.

This Privacy Policy explains how Hey Lullae! processes Personal Information lawfully, reasonably, transparently and securely in accordance with POPIA and other applicable South African law. It should be read with the Hey Lullae! Terms and Conditions, PAIA Manual and any feature-specific consent presented when you activate functionality involving photographs, silhouettes, biometric information, social integrations or third-party AI processing.

The Policy applies when you visit heylullae.co.za or another Hey Lullae! domain, create or use an Account, build a Digital Wardrobe or Silhouette Vault, upload photographs or inspiration content, connect a third-party account, use the AI concierge or virtual try-on tools, subscribe to a membership, save or purchase fashion items, interact with Retail Fashion Partners through the Platform, use a referral or wallet feature, or contact customer support.

Hey Lullae! is the Responsible Party for Personal Information processed for the purposes and by the means determined by Hey Lullae! Where a Retail Fashion Partner or technology provider independently determines the purposes and means of processing, that party may be an independent or joint Responsible Party. Where a service provider processes Personal Information only on Hey Lullae!'s instructions, it acts as an Operator for purposes of POPIA.

• Registered legal entity: Hey Lullae! (Pty) Ltd
• Registration number: 2026/399808/07
• Principal place of business: Midrand, Gauteng, South Africa 1687
• Website: www.heylullae.co.za
• Information Officer email: legal@heylullae.co.za

This Policy applies to customers and prospective customers, registered users, members, website visitors, users of AI styling and virtual try-on functionality, referral participants, representatives of Retail Fashion Partners, suppliers, service providers, customer-support contacts and other persons whose Personal Information is processed through Hey Lullae!'s business.

You have the right to:

• request confirmation of whether Hey Lullae! holds Personal Information about you and request access to it;
• request correction or updating of inaccurate, irrelevant, excessive, out-of-date, incomplete or misleading Personal Information;
• request deletion or destruction where Hey Lullae! is no longer authorised to retain the information;
• object to processing in circumstances permitted by POPIA;
• withdraw consent where processing is based on consent, without affecting lawful processing already undertaken;
• object to or unsubscribe from direct marketing;
• disconnect optional third-party integrations and revoke the associated permissions;
• request deletion of uploaded photographs, silhouette/contour images, saved AI renders and connected-account data, subject to lawful retention requirements; and
• lodge a complaint with the Information Regulator.

Hey Lullae! may require reasonable proof of identity or authority before acting on a request and will respond within the periods required by applicable law.

Hey Lullae! collects Personal Information directly from you, automatically through your use of the Platform, from Retail Fashion Partners where necessary to fulfil or reconcile an order, and from third parties that you deliberately connect or authorise.

The categories may include:

When you upload a photo of a garment as part of using Hey Lullae!'s styling features (including to build your "Digital Closet"), we store that photo so it can be reused across your future styling sessions — for example, so our AI stylist can pair that item with other pieces without you needing to upload it again. We store your original photo, a cleaned studio version of it, and the garment details read from it.

Garment photos you upload to your Digital Closet are retained for as long as your account remains active, or until you delete them yourself. If you choose "style it just this once" at upload, your photo is used only to generate that styling result and is not saved to your Digital Closet. Silhouette and contour photographs are handled separately, as described in the Silhouette section and under Retention and Deletion below.

What we do with your garment photos:

• We use them to generate styling recommendations, outfit pairings, and visual previews within your account.
• To read and tidy each garment photo, the image is sent to third-party AI service providers through our AI gateway: Google (Gemini models) to identify the garment, its colour, fabric and cut, and OpenAI (image models) to produce the cleaned studio version. This happens whether or not you choose to save the photo to your Digital Closet.
• We do not share your Digital Closet photos with fashion partners, boutiques, or any other third party without your explicit consent.
• If you join through an incubator school's sign-up link, that school's Department Head can see your name, email address, sign-up date, AI Stylist activity status and any capsules or projects you submit to your school, through the Hey Lullae Faculty Portal.

Your control over this data:

• You can delete individual items from your Digital Closet at any time within the app (Profile → Digital Closet). Deleting an item removes its photos and details.
• You can ask us to close your account and delete your data by contacting Hey Lullae!. This removes your entire Digital Closet, including all stored garment photos, along with the rest of your account data.
• If you close your account, your Digital Closet photos are deleted immediately when the deletion is carried out, subject to our storage provider's routine backup cycles.

Security: Garment photos are stored privately using the same access controls as the rest of your account data — only you can view or manage your own Digital Closet through your authenticated account.

Hey Lullae!'s styling features may use body measurements, body-shape information and uploaded silhouette or contour photographs to personalise recommendations, improve size and fit matching, maintain a private Silhouette Vault and generate virtual try-on or styling outputs.

A photograph or body measurement is not automatically biometric information merely because it relates to your body. However, where Hey Lullae! or an Operator processes physical, physiological or behavioural characteristics in a manner that constitutes biometric information under POPIA or creates biometric-like inferences from silhouette or contour data, Hey Lullae! will treat that information as Special Personal Information and apply the additional requirements of POPIA.

Hey Lullae! does not use silhouette photographs or body measurements for facial recognition, identity authentication or surveillance unless a separate feature is introduced and the required lawful basis and notice are provided. Hey Lullae! does not sell or licence your likeness, silhouette information or body measurements.

AI-generated try-on images are illustrative and may inaccurately represent fit, body shape, fabric, drape, texture, colour or proportions. This privacy disclosure does not convert an AI output into a guarantee about a physical garment.

You retain ownership of photographs and other content you upload, subject to the limited processing licence in the Terms of Service necessary to store, transmit, transform and return the requested AI output.

When you upload a garment photo, build your avatar, or use virtual try-on, your photos are processed by Google (Gemini) and OpenAI through our platform's AI gateway to generate styling recommendations, cleaned-up product images, and your avatar. These providers operate under zero data retention terms for the models we use — they do not store or train their systems on your photos.

Our platform provider (Lovable) does not use your data — photos, closet items, avatar images, or survey responses — to train its own systems, regardless of plan tier.

We use your Personal Information to:

• create and administer your Account, membership and Digital Wardrobe;
• maintain your style profile, Silhouette Vault and saved preferences;
• generate personalised outfit, styling, sizing, colour and product recommendations;
• operate AI concierge, curation matching and virtual try-on functionality;
• match inspiration images and selected Pinterest content to real products offered by Retail Fashion Partners;
• display, save and manage Curated Items, favourites and lookbooks;
• process unified checkout orders, route fulfilment information to the relevant Retail Fashion Partner, manage delivery, returns and refunds;
• process membership billing, wallet credits, vouchers, referral rewards and promotional benefits;
• send transactional, concierge, price-drop, restock or other communications you request or lawfully opt into;
• provide customer support and resolve complaints;
• protect the Platform, prevent fraud and abuse, and maintain information security;
• perform analytics, product improvement and service-quality review using information lawfully available for that purpose;
• comply with legal, accounting, tax, regulatory and evidential obligations; and
• conduct marketing measurement and attribution only in accordance with the cookie and tracking consent controls below.

Hey Lullae! relies on the lawful grounds available under POPIA according to the processing activity, including consent, performance of a contract, compliance with a legal obligation and legitimate interests recognised by POPIA.

Where consent is required for Special Personal Information, optional social integrations, non-essential tracking or an AI feature involving sensitive uploaded images, Hey Lullae! will obtain the required consent before that processing begins. Consent will not be inferred merely from continued browsing, silence or a pre-selected choice.

Where a separate consent is presented for silhouette, biometric or AI image processing, declining that consent may mean that the relevant image-dependent feature cannot be provided, but it will not prevent access to unrelated core functionality.

Where Hey Lullae! offers Pinterest or another social integration, the connection is optional and is initiated by you. The Platform may use the provider's official OAuth or equivalent authorisation process and will request only the permissions reasonably required for the stated styling function.

We rely on our providers' standard data-handling terms, including zero-retention processing arrangements with our AI providers. We do not currently have a signed Data Processing Agreement in place with our platform provider; this is something we are actively reviewing as the business grows.

Where a third party acts as an independent or joint Responsible Party, Hey Lullae! will use an appropriate data-sharing or commercial arrangement reflecting the parties' actual roles and responsibilities. Hey Lullae! will not describe a third party as an Operator where the third party independently determines its own purposes and means of processing.

Hey Lullae! may use strictly necessary cookies, functional or preference cookies, analytics technologies and marketing or advertising technologies. Strictly necessary technologies may operate where required to provide or secure a service requested by you.

Optional analytics, marketing, advertising and attribution technologies that transmit Personal Information or online identifiers to third parties are disabled by default and are subject to a consent-before-processing model.

A prominent cookie consent banner or preference centre will act as a technical gatekeeper. Non-essential tracking must not load, drop a cookie, fire, transmit an event or disclose Personal Information or online identifiers to a third party before the required prior, explicit and affirmative consent is obtained.

Where social advertising technologies such as Meta/Instagram, Facebook, TikTok or similar platforms are used, the information may include PageView, ViewContent, AddToCart, InitiateCheckout and Purchase events, product identifiers, page URL, order value, currency, event identifiers, technical signals and, where lawfully configured, hashed identifiers. Hey Lullae! will not use silhouette photographs, body-shape information or Pinterest-derived styling data for third-party behavioural advertising.

The consent interface will provide a clear means to accept or reject optional tracking and to change or withdraw consent later. Creating an Account, accepting this Privacy Policy or continuing to browse does not itself constitute consent to optional marketing tracking.

Hey Lullae! may send transactional and service communications necessary for Account, membership, concierge, order, return, refund, security or fulfilment purposes. Direct marketing communications will be sent only where permitted by applicable law. You may unsubscribe or object to direct marketing without losing essential service communications.

Hey Lullae! implements reasonable and appropriate technical and organisational safeguards having regard to the sensitivity of the information and the risks of processing. Measures may include TLS/HTTPS, encryption at rest where supported, access controls, least-privilege permissions, owner-only storage paths for sensitive profile assets, secure authentication, server-side token storage, logging, monitoring, vulnerability management, backups and incident-response controls.

Silhouette and contour photographs, biometric-related information, payment references, optional banking details, authentication tokens and other high-sensitivity information are subject to enhanced access and retention controls. No online system is completely secure, and users should maintain strong credentials and promptly report suspected unauthorised access.

Hey Lullae! retains Personal Information only for as long as authorised by POPIA and reasonably necessary for the relevant purpose, including contractual, support, refund, chargeback, accounting, tax, legal and evidential requirements.

• general Account data may be retained while the Account is active and for a limited period after closure where reasonably required for support, refund, chargeback, security or dispute purposes;
• financial, order, invoice, payment-reference, refund and wallet records may be retained for applicable statutory and evidential periods;
• Digital Closet garment photos are retained while your account is active or until you delete them; photos styled "just this once" are not saved to your closet;
• silhouette and contour photographs are retained while you keep them in your Silhouette Vault or until deletion is requested, subject to reasonable deletion and backup cycles;
• Pinterest-derived or inspiration data is removed or de-identified when no longer required after disconnection or deletion, subject to lawful retention;
• AI try-on outputs are transient unless the Platform expressly allows you to save them, in which case saved copies are retained until deleted or otherwise no longer required.

Where Hey Lullae! is no longer authorised or required to retain Personal Information, it will delete, destroy or de-identify it in a manner that prevents reconstruction in an intelligible form.

Because Hey Lullae! uses global cloud, AI, security, communications, social-integration and payment providers, Personal Information may be transferred to, stored in or accessed from jurisdictions outside South Africa. Hey Lullae! will undertake such transfers in accordance with section 72 of POPIA and will use appropriate contractual, legal, technical or organisational safeguards where required.

Where there are reasonable grounds to believe that Personal Information has been accessed or acquired by an unauthorised person, Hey Lullae! will investigate and contain the incident, assess affected information and risks, preserve appropriate evidence, implement corrective measures and review relevant controls. The Information Officer will oversee notification to the Information Regulator and affected Data Subjects where and in the manner required by POPIA. Operators must notify Hey Lullae! of security compromises in accordance with their contractual and legal obligations.

Hey Lullae! is intended for persons aged 18 years and older. Hey Lullae! does not knowingly collect Personal Information from children through its styling, silhouette or commerce functionality. If Hey Lullae! becomes aware that children's Personal Information has been collected without the required authorisation, it will take appropriate steps in accordance with POPIA.

Hey Lullae! maintains a PAIA Manual in accordance with section 51 of PAIA. The Manual describes the categories of records held by Hey Lullae!, the procedure for requesting access, applicable forms and fees, POPIA processing categories, recipients, cross-border flows, security measures and data-subject request mechanisms.

Hey Lullae! may amend this Policy to reflect legal, operational or technological changes. The current version will be published on the Platform and material changes will be communicated where appropriate.

Email: legal@heylullae.co.za

Physical address: Midrand, Gauteng, South Africa 1687

Website: www.heylullae.co.za

Questions, requests, or concerns? Reach our Information Officer at the email above. All formal access, correction, deletion and PAIA requests are handled by that office. You may also lodge a complaint with the Information Regulator (South Africa) at enquiries@inforegulator.org.za or 0800 017 160.

We do not sell your Personal Information. Silhouette photographs, contour profiles, body measurements and Pinterest-derived styling data are never used for third-party behavioural advertising, and are stored encrypted in Google Cloud and Firebase infrastructure.