Privacy Policy

Last updated: 28 May 2026 · Bluethread Brands Private Limited

This Privacy Policy explains how Sizee ("we", "us", "our") — a size and fit recommendation app for Shopify-powered apparel stores — collects, uses and protects information from shoppers and merchants who use our service.

1. Who we are

Sizee is operated by Bluethread Brands Private Limited, a company registered in India. For privacy questions, write to gauravbatra0310@gmail.com.

2. What we collect

From shoppers (end customers of merchants who install Sizee):

• Mobile number — to send a one-time password (OTP) for sign-in.
• OTP verification — stored as a bcrypt hash, never in plain text. Discarded after expiry (5 minutes) or after successful sign-in.
• Body measurements you choose to provide (e.g. bust, waist, hip) and/or brand references (e.g. "I wear Madewell size 6").
• Body shape and fit preferences you select.
• Recommendation events — the inputs, computed scores, and resulting size we recommended on each product page view. Used to improve the engine and provide merchants with anonymised analytics.

From merchants (Shopify store owners who install Sizee):

• Your Shopify shop domain and OAuth access token (scoped only to what we need to read).
• Your product catalog (titles, handles, variants) and any garment measurements you upload via CSV or admin UI.
• Your widget customisation settings (colours, copy, language preferences). These are stored as Shopify Shop metafields and remain inside your Shopify shop.

3. Why we collect it

• To compute size recommendations — the entire purpose of the service.
• To recognise returning shoppers across Sizee-enabled stores, so they don't have to re-enter their measurements. This requires us to associate the body profile with the mobile number.
• To improve the engine — recommendation event logs are the training data the engine learns from.
• To provide merchants with analytics on how Sizee is performing on their store (recommendations made, confidence distribution, return-rate impact). Merchant analytics are aggregated — no individual shopper is identifiable.

4. What we don't do

• We do not sell shopper data to third parties. Ever.
• We do not share one merchant's catalog or analytics with another merchant.
• We do not read shopper email, payment information, addresses, or order history beyond what Shopify provides for legitimate webhooks (order created / fulfilled / refunded — used only to evaluate whether our recommendation led to a return).
• We do not use shopper data for advertising or marketing of any kind.

5. How long we keep it

• OTP challenges — discarded immediately after expiry (5 minutes) or successful sign-in.
• Shopper body profile — kept while the shopper account is active. A shopper can delete their profile by emailing us; we will purge within 30 days.
• Recommendation events — retained for up to 24 months for engine improvement, after which they are anonymised (mobile number removed, only aggregate data retained).
• Merchant data — deleted within 30 days of app uninstall. We honour Shopify's customers/redact, customers/data_request, and shop/redact webhooks.

6. How we protect it

• All traffic is over HTTPS; HSTS is enabled.
• OTPs are stored as bcrypt hashes; mobile numbers are stored hashed where identity is not needed for the operation.
• Access tokens are stored encrypted at rest. The application database is hosted on Fly.io with private networking.
• We rate-limit OTP requests (3 per minute, 10 per hour per mobile) and verification attempts (max 5 per OTP) to prevent brute force.

7. Your rights

Under GDPR, the Indian DPDP Act, and similar laws, you have the right to:

• Access the data we hold about you.
• Request correction or deletion.
• Export your data.
• Withdraw consent at any time.

To exercise any of these rights, write to gauravbatra0310@gmail.com. We respond within 30 days.

8. Cookies & local storage

The Sizee widget uses your browser's localStorage to remember that you're signed in (an opaque JWT). It does not set tracking cookies and does not share data with any analytics or ad platform.

9. International transfers

Sizee is hosted in the United States (Fly.io) with backups in Europe. By using the service you consent to your data being processed in these regions.

10. Changes to this policy

We'll update this page if we change how we handle data. Material changes will be announced via the merchant admin dashboard and (where required by law) by email.

By using Sizee you confirm that you have read and understood this policy. For questions, write to gauravbatra0310@gmail.com.