AI & Sensitive Data Processing

Plain language

When you upload a photo of a clothing item to your Kiwi closet, we send that photo to Google's Gemini AI service. Gemini looks at the photo and identifies what kind of clothing item it is — the type (jacket, dress, jeans), color, material, and style attributes. It returns those labels to us, and we use them to populate your digital wardrobe.

No human at Kiwi looks at your clothing photos during normal operation. The analysis is fully automated. The results — the extracted item attributes — are stored in your account so that the AI stylist can build outfit suggestions based on what you actually own.

The AI does not make any decisions about you as a person from your clothing. It does not assess your fitness, health, wealth, or any other personal characteristic. It only reads clothing attributes.

What Gemini receives

Gemini receives the raw image file you upload. It does not receive your name, email address, account ID, or any other directly identifying information. The photo is passed to Gemini as part of an authenticated API call from Kiwi' backend, which is associated with our Google Cloud account — not your personal Google account.

What Gemini produces

Gemini returns structured clothing metadata: item type, color, material, style descriptors, and suggested care or occasion tags. It does not return personal information about the person in the photo.

Purely automated decisions — Art. 22 safe harbor

The wardrobe photo analysis is a purely automated process. However, it does not produce legal effects or similarly significant effects on you. The output is a list of clothing attributes used to organize your closet. You are not subject to any automated decision-making that has a legal or significant impact on you.

Under GDPR Art. 22, "solely automated decisions" with legal or significant effects require explicit consent or legal authorization. Wardrobe attribute tagging does not meet this threshold — but we disclose the automation here in the interest of full transparency.

How to request deletion of analyzed data

You can request deletion of:

• Your wardrobe photos — contact privacy@kiwifits.com with a request to delete all or specific photos from your account. [Note: in-app photo deletion is available for individual items; bulk photo deletion via the app is coming in a future update.]
• Your extracted item data — delete individual items from your closet in the app, or request full account deletion.
• All your data — delete your account in the app settings, or email privacy@kiwifits.com.

Legal basis: GDPR Art. 6(1)(b) — performance of the contract you entered into with us when you created a Kiwi account.

Your rights: Right of access (Art. 15) — ask us what data we have derived from your photos. Right to erasure (Art. 17) — request deletion of your photos and extracted data at any time.

Plain language

When you take a photo of your clothes to add them to your Kiwi closet, the photo might capture more than just the clothing. It might include:

• Part of your body (arms, torso, legs) if you are wearing the item
• Your face, if the photo is taken in a mirror
• Your home environment, if the photo captures your surroundings

We want to be honest with you about this. We are not trying to collect images of your body or your home — we are trying to capture images of your clothes. But we cannot guarantee that every photo will be perfectly cropped.

How images are stored

Your uploaded photos are stored in Google Cloud Storage (GCS), a secure cloud storage service. They are not publicly accessible. When your device or our servers need to display a photo, we generate a short-lived "signed URL" that expires after 5 minutes. After the URL expires, the photo cannot be accessed without generating a new URL. Only authenticated Kiwi services and your own account can generate these URLs.

Right to delete your photos

You can delete individual clothing items from your closet in the app, and the associated photo will be removed. You can delete your entire account to remove all photos.

Important gap — GCS deletion on account deletion: When you delete your account, we delete your wardrobe data from our database immediately. However, the underlying photo files in Google Cloud Storage are not yet automatically deleted at the same time. We are working to fix this. When account deletion is requested, we manually process GCS deletion, and an automated solution is coming in an upcoming app update. If you want written confirmation that your photos have been deleted from GCS after account deletion, email privacy@kiwifits.com.

Minimization note — how we handle images

To minimize unnecessary storage of personal images:

• Original uploaded photos are replaced by extracted item images (AI-generated product shots of the clothing only) where possible, so the version we store long-term does not contain your body or environment.
• Your original photos are deleted from primary storage after extraction, or upon account deletion.

Special category data — biometric information

GDPR Art. 9 treats biometric data (data processed for the purpose of uniquely identifying a natural person, such as facial images or body measurements) as sensitive. While our wardrobe photo analysis is not intended to capture biometric data, it is possible that an uploaded photo contains a recognizable image of your face or body.

We are taking the following steps to address this:

1. Our Gemini prompt instructs the model to focus on clothing attributes only and not to process or return information about people in the image.
2. We are evaluating client-side image cropping to remove non-clothing content before upload.

Legal basis: GDPR Art. 6(1)(b) — contract (core wardrobe feature); Art. 9(2)(a) — explicit consent for any incidental biometric data capture. [Note: explicit consent mechanism is pending implementation — see gap above.]

Your rights: Right to erasure (Art. 17) — request deletion of any or all photos. Right of access (Art. 15) — request a list of all photos and extracted item data we hold. Right to object (Art. 21) — object to photo processing at any time (note: this will prevent the core wardrobe-building feature from working).

Plain language

When you have a conversation with your AI stylist, we record what you said and what the stylist said, and store it as a written transcript. We do this in two versions: one in the language you used (your native language), and one translated into English. The English version is what our AI reads to understand your conversation and generate responses. The native-language version is what we show you in the app.

Transcripts are stored securely in your account in Google Cloud Firestore. They are not shared with third parties except as necessary to run the AI stylist (see Section 5 of the main Privacy Policy).

Audio recording — default off

We do not record or store audio files by default. The Kiwi app processes your voice on-device (or via a secure stream) to convert it to text, and then works with that text. The original audio is not stored in normal operation.

The only exception is when a Kiwi engineer manually enables debug mode on the backend. In debug mode, audio files may be stored in Google Cloud Storage for the purpose of diagnosing problems with the speech recognition or voice synthesis pipeline.

What transcripts contain

Transcripts contain the full text of your conversation with the stylist. Depending on what you share, this may include:

• Descriptions of your clothes and style preferences
• References to occasions (work events, dates, weddings)
• Personal feelings about your wardrobe or appearance
• Body image thoughts or feelings you share with the stylist
• Health, religious, or cultural dress considerations

We store these transcripts to power the AI stylist (it needs the conversation history to give you context-aware advice) and for admin quality review.

Your right to delete transcript history

You can request deletion of your transcript history at any time by emailing privacy@kiwifits.com. We are building an in-app mechanism to view and delete transcript history —

Legal basis: GDPR Art. 6(1)(b) — contract (core stylist feature); Art. 6(1)(f) — legitimate interest (quality review); Art. 6(1)(a) — consent for special-category content (see gap above regarding sensitive disclosures).

Your rights: Right of access (Art. 15) — request a copy of your full transcript history. Right to erasure (Art. 17) — request deletion of your transcripts. Right to restriction (Art. 18) — request that we stop processing your transcripts for quality review while still allowing the stylist to function. Right not to be subject to solely automated decisions (Art. 22) — transcripts are used to generate AI responses but no legally significant automated decisions are made from them.

Plain language

Your AI stylist does more than just suggest outfits. Over time, it learns about you — your taste, what you love, what you never want to wear again, and how you talk about your style. It builds a personal memory that persists between sessions so that each conversation can pick up where the last one left off.

Part of this memory includes what we call "emotional pattern signals." When you express feelings about clothes — excitement about a new purchase, frustration with your wardrobe, insecurity about a body-conscious outfit — the stylist notices these patterns and stores them to guide its tone and recommendations. For example, if the stylist learns that you feel self-conscious about a certain item type, it will be more sensitive in how it discusses similar items in the future.

What the memory stores

Your stylistMemory record in our database may contain:

• Style preferences — specific colors, silhouettes, brands you have expressed preferences about
• Item exclusions — categories or specific items you have asked the stylist never to suggest
• Emotional pattern signals — inferred patterns about how you feel about your wardrobe, based on your language and expressed emotions during conversations
• Body-image vocabulary — words and phrases you use to describe your body and how clothes fit
• Occasion context — recurring occasions you dress for (work, gym, social events, travel)
• Conversation tone preferences — whether you prefer a playful or professional stylist tone

What this is — and what it isn't

This memory is personalization metadata, not a clinical, psychological, or medical record. We are not diagnosing anything. We are not building a psychological profile for any purpose other than giving you better outfit advice. The stylist memory is not shared with advertisers, employers, insurers, or any third party except the AI service providers listed in the main Privacy Policy.

However, we acknowledge that this information is sensitive. Feelings about your body and wardrobe are personal. We treat this data with the care it deserves.

How to view or delete your memory

Because a formal in-app view is not yet built, you can:

• Request a copy of your stylist memory by emailing privacy@kiwifits.com. We will export and send you the full contents of your stylistMemory record.
• Request deletion of your memory by emailing privacy@kiwifits.com. This will reset your stylist to a blank slate — it will not remember past conversations or preferences. Your account and wardrobe data are not affected.
• Delete your account in the app settings, which deletes all data including your stylist memory.

Legal basis: GDPR Art. 6(1)(b) — contract (core personalization feature); Art. 6(1)(a) + Art. 9(2)(a) — explicit consent for emotional/psychological inference data. [Note: explicit consent for emotional inference is a known gap, flagged for implementation before EEA launch.]

Your rights: Right of access (Art. 15) — request a copy of your stylist memory. Right to erasure (Art. 17) — request deletion of your memory. Right to restriction (Art. 18) — request we stop updating your memory while still using the stylist. Right to object (Art. 21) — object to emotional inference processing.

Plain language

A common question with AI-powered apps is: "Does my data get used to train the AI models?"

Here is our current position:

Kiwi does not use your personal data to train its own AI models. We are a consumer of AI APIs (Google Gemini), not an AI model trainer.

For Google Gemini API: We use a Google Cloud Console API key for all Gemini requests. This key is governed by the Google Cloud Terms of Service and the Google Cloud Data Processing Addendum, which explicitly state that Google will not use Customer Data to train or improve its Cloud Services without the customer's permission. Your wardrobe photos, conversation transcripts, and any other data sent to Gemini are not used to train Google's AI models.

Our position on AI training is: your data should not be used to train any AI model without your explicit, informed consent. The Google Cloud DPA provides this protection contractually.

Legal basis: N/A (Kiwi does not currently engage in AI model training). Sub-processor training: pending confirmation.

Your rights: Right to object (Art. 21) — if sub-processor training is confirmed, you will have the right to object. Right to restrict processing (Art. 18) — we can flag your account for exclusion from any training use upon request.

Plain language

When you ask the Kiwi stylist for an outfit suggestion, the AI analyzes your wardrobe, your stated preferences, your conversation history, and (optionally) the occasion you are dressing for — and it suggests outfits. This is an automated process. The AI makes the call on which combination of items to suggest.

You are completely free to ignore the suggestion, ask for a different one, or override it entirely. The stylist's recommendation has no impact on your rights, your finances, your employment, or any other significant area of your life. It is just a clothes suggestion.

GDPR Article 22 — Transparency Notice

GDPR Art. 22 gives you protection against "a decision based solely on automated processing... which produces legal effects concerning [you] or similarly significantly affects [you]."

Kiwi outfit recommendations do not produce legal effects on you. They do not significantly affect you in any legally recognized sense — they are fashion advice that you are entirely free to accept or reject. Therefore, the Art. 22 prohibition on purely automated significant decisions does not apply to our core outfit recommendation feature.

We are being transparent about this because we think you deserve to understand how the AI is involved in what you see in the app.

Human oversight

Although outfit recommendations are AI-generated, human oversight is retained at multiple levels:

1. You, the user: You always decide what to wear. The AI cannot make you put anything on.
2. Kiwi engineers: We review stylist interactions, audit outputs, and tune the prompts and guardrails that govern what the AI can and cannot suggest. Specifically, we maintain a ContractGuard system that checks every AI response before it is sent to you — and if the response violates our rules (for example, if it suggests an item you have excluded, or produces an inappropriate recommendation), it is blocked and replaced with a safe fallback.
3. Manual override: Our admins can review and replay any stylist session. If a problematic recommendation is identified, we can correct the record and update the AI's guidelines.

No profiling for external purposes

The AI-generated profile of your style and preferences (your stylist memory) is used only to give you better outfit advice within the app. It is not shared with advertisers, not used for scoring or ranking purposes, and not used to make decisions about you in any other context.

Legal basis: GDPR Art. 6(1)(b) — contract (outfit recommendations are the core service). Art. 22 does not apply because no solely automated decision with legal or significant effects is made.

Your rights: Right to an explanation — you can ask us how a specific outfit recommendation was generated by contacting privacy@kiwifits.com. Right to object — you can object to any type of processing at any time. Right to erasure — you can delete your stylist memory, which will reset the personalization basis for future recommendations.

This Addendum was prepared by Alex Rivera, Legal & Compliance Agent, Kiwi. AI-assisted only. Formal legal counsel review required before major market launch.
Version 1.0 | 2026-05-04