Privacy Policy for Ruvole.com

1. Introduction

This Privacy Policy explains how Ann Tessy Ruguru Wanjohi processes personal information in connection with Ruvole.com at https://ruvole.com. It applies to all users of the Service, including individual consumers, fashion creators, stylists, affiliates, and business or enterprise accounts. It takes effect on 2026-10-12. It is based on the service practices described by its operator and should be read together with notices shown when information is collected.

2. Who operates this service

Ann Tessy Ruguru Wanjohi is the individual responsible for this policy and is based in Kenya.

3. Scope

This policy applies to the website, web application, and software-as-a-service platform offered under the Ruvole.com name to both consumer and business or enterprise users. It does not govern independent third-party services that publish their own privacy terms.

4. Information we collect

Depending on use of the service, Ann Tessy Ruguru Wanjohi collects these broad categories: identity and contact information; and account information, submitted content, and communications. Specific data depends on the features used and the practices described below. Some information is required to provide requested features; if it is not supplied, those features may be unavailable.

5. Sources of information

Information comes from users directly and automatic collection from the devices used to access the service. Information received from another source is handled for the purposes described in this policy and subject to applicable restrictions.

6. How we use information

Information is used for providing and securing the service; and managing accounts, support, payments, and communications. It may also be used to prevent misuse, establish or defend legal claims, meet legal obligations, and enforce service terms where those activities are relevant and permitted.

7. Messages and email

The service sends transactional service messages using secure cloud database and messaging infrastructure providers. Contact details are used for delivery, service administration, and the purposes described when the details are collected.

Transactional messages are sent only as needed to provide, secure, or administer the service. The operator measures message opens or link interactions; those events are used to understand delivery and engagement.

8. EU legal bases for processing

For processing governed by the EU GDPR, the relied-on legal bases are performance of a contract or steps requested before a contract, consent, legitimate interests, and compliance with a legal obligation. The operator's purpose-to-basis mapping is: account service --contract; subscription payments and billing records --contract and legal obligation; refund processing --contract; security logs and fraud prevention --legitimate interests; service improvement --legitimate interests; marketing emails or promotional offers -- consent; customer support -- contract and legitimate interests; compliance with authorities -- legal obligation. Legitimate interests include Fraud prevention and security logs - Protecting accounts and preventing misuse.; Service improvement - Tracking credits usage and performance to improve Ruvole, balanced against affected rights and expectations. Consent can be withdrawn for future processing at any time without affecting processing that was lawful before withdrawal.

9. UK legal bases for processing

For processing governed by the UK GDPR, the relied-on legal bases are performance of a contract or steps requested before a contract, consent, legitimate interests, compliance with a legal obligation, and a recognized legitimate interest under applicable UK law. The operator's purpose-to-basis mapping is: account service --contract; subscription payments and billing records --contract and legal obligation; refund processing --contract; security logs and fraud prevention --legitimate interests; service improvement --legitimate interests; marketing emails or promotional offers -- consent; customer support -- contract and legitimate interests; compliance with authorities -- legal obligation. Legitimate interests include Fraud prevention and security logs - Protecting accounts and preventing misuse.; Service improvement - Tracking credits usage and performance to improve Ruvole, balanced against affected rights and expectations. Consent can be withdrawn for future processing at any time without affecting processing that was lawful before withdrawal.

10. Cookies and tracking technologies

The service uses essential browser storage or cookies only where needed for security, sessions, saved choices, load balancing, or requested functionality. These technologies are not used for cross-service advertising.

11. Social media features

Social features include share buttons and public social pages and involve google. When a user activates a social feature, the provider may receive the page or feature used, device and network information, and information the user directs it to share. Provider privacy terms govern its independent processing.

12. Payments

Payments are processed using authorized third-party merchant-of-record payment processors for recurring subscriptions. The operator does not directly store full payment-card information; the payment provider handles card details under its own privacy terms.

The operator retains amount, currency, credits used, refund eligibility for accounting, support, fraud prevention, and legal obligations.

13. Artificial intelligence processing

Ruvole.com uses artificial intelligence for Outfit/product generation, automation suggestions, and API-driven recommendations. To provide these features, the service sends the following information to high-speed automated styling inference and secure cloud database infrastructure providers: user queries, account ID/email, usage data.

These features operate in the background to support the service; people do not interact with the AI system directly or receive AI-generated content from it.

Prompts, submitted content, or outputs of the AI features are stored. The operator describes how long the service and the AI providers keep them as follows: Retention period - While the account remains active.

The operator states that information submitted to the AI features is not used to train AI models, by the operator or by the AI providers under the terms that apply to the service. People working for the operator or an AI provider may review prompts, submitted content, or outputs.

The operator states that the service asks for the user's permission before personal data is shared with a third-party AI provider.

The operator states that AI is not used to make decisions that produce legal or similarly significant effects on people.

Choices about the AI features: Users can request opt-out by emailing support@ruvole.com. You could also add a toggle in account settings later. Questions and privacy requests about information processed by the AI features can be sent to support@ruvole.com.

14. Sharing and disclosures

Information may be disclosed to service providers for the purposes described in this policy, subject to contracts and legal limits where required. It may also be disclosed to authorities, courts, advisers, or transaction counterparties when reasonably necessary for law, safety, claims, or a business reorganization.

The operator states that it does not sell personal information or share it for cross-context behavioral advertising as those terms are defined by applicable United States privacy laws. Ordinary disclosures to service providers, legal recipients, and user-directed recipients are not treated as a sale when statutory conditions are met.

15. International transfers

Information may be processed outside Kenya. The stated location and safeguard approach is: Personal data is processed in Kenya, the United States, and the European Union. Where data is transferred outside the EU/EEA or UK, we rely on Standard Contractual Clauses and equivalent safeguards to ensure compliance with GDPR and UK GDPR. Our service providers implement encryption, restricted access, and monitoring to protect personal information.

For EU information, the transfer mechanism is: Personal data is processed in Kenya, the United States, and the European Union. Where data is transferred outside the EU/EEA or UK, we rely on Standard Contractual Clauses and equivalent safeguards to ensure compliance with GDPR and UK GDPR. Our service providers implement encryption, restricted access, and monitoring to protect personal information. Users may request information about the mechanism used.

For UK information, the transfer mechanism is: Personal data is processed in Kenya, the United States, and the European Union. Where data is transferred outside the EU/EEA or UK, we rely on Standard Contractual Clauses and equivalent safeguards to ensure compliance with GDPR and UK GDPR. Our service providers implement encryption, restricted access, and monitoring to protect personal information. Users may request information about the mechanism used.

16. Data retention

The retention model is: records are kept while the account or relationship remains active and for a justified period afterward. Records may be kept longer when reasonably necessary for security, disputes, tax, accounting, fraud prevention, legal obligations, or enforcement. Deletion or de-identification follows the stated model and applicable law.

17. Security

The operator uses encryption, access restrictions, backups and monitoring, and other organizational and technical controls, selected according to the nature and risk of the information. No transmission or storage method is completely secure, so absolute security cannot be guaranteed.

18. Children's privacy

The service is intended for a general audience. If the operator learns that information was collected from a child contrary to the stated audience or applicable law, it will take reasonable steps to delete it and may ask for age or authority verification.

19. Your choices and privacy rights

Depending on location and processing, users may ask to access, correct, delete, restrict, or receive information; withdraw consent; unsubscribe; object; or opt out of sale, sharing, or targeted advertising. Requests are supported through the account settings or by email to support@ruvole.com. The operator may verify identity and authority, apply legal exceptions, and explain a denial and available appeal where required.

20. European Economic Area privacy rights

The EU GDPR has applied since May 25, 2018. Where it applies, people may request access, rectification, erasure, restriction, and portability; object to processing; withdraw consent for future processing; and complain to the competent supervisory authority. Rights depend on the processing, lawful basis, and statutory exceptions. Requests may be made through the account settings or at support@ruvole.com. Data protection contact: not appointed. EU representative contact: not appointed.

21. United Kingdom privacy rights

Where the UK GDPR and Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, apply, people may request access, rectification, erasure, restriction, and portability; object to processing; withdraw consent for future processing; and complain to the UK Information Commissioner's Office. Rights depend on the processing, lawful basis, and statutory exceptions. Requests and data-protection complaints may be made through the account settings or at support@ruvole.com. The operator will acknowledge a data-protection complaint within 30 days, take appropriate steps to investigate without undue delay, keep the complainant informed, and communicate the outcome. Data protection contact: not appointed. UK representative contact: not appointed.

22. United States privacy disclosures

United States privacy duties vary by state, sector, data type, and business activity. This policy describes selected factual practices and adds state-specific rights only where the operator identified those laws as applicable. It does not claim that one nationwide GDPR-equivalent framework governs every user or processing activity.

23. California Online Privacy Protection Act disclosures

CalOPPA has applied since July 1, 2004 and was amended in 2013 to add online-tracking disclosures. This policy identifies collected categories, information sources, recipients, review and correction methods, change notices, and its effective date. Browser Do Not Track handling: We do not alter data collection practices in response to browser Do Not Track signals. Third parties collect information over time and across services only where described in the analytics, advertising, social, or service-provider sections.

24. Other United States state privacy rights

Several United States states have comprehensive consumer privacy laws, such as the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, and the Texas Data Privacy and Security Act. Whether one of these laws, or a similar law of another state, applies depends on the consumer's state of residence, the operator's activities, the law's thresholds, and its exemptions. This section summarizes rights and practices under those laws and does not expand or waive any statutory right.

Where such a law applies, residents may, subject to its definitions and exceptions, confirm whether their personal data is processed and access it, correct inaccuracies, delete personal data, obtain a portable copy, and opt out of processing for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects. Requests can be submitted through the account settings or by email to support@ruvole.com. The operator may need to verify the identity of the person making a request.

For these laws, the categories of personal data processed are identity and contact information; and account information, submitted content, and communications, and the purposes of processing are providing and securing the service; and managing accounts, support, payments, and communications. The operator describes the personal data it shares with third parties, and the categories of those third parties, as follows: Ruvole doesn’t sell or share personal data for ads — only uses trusted third-party cloud database, product catalog retrieval, merchant-of-record payment, and AI inference providers as service providers.

The operator states that it does not process sensitive data as these laws define it, such as precise geolocation, health, genetic or biometric data, or data revealing racial or ethnic origin or religious beliefs.

If the operator declines to act on a request made under a state privacy law, the consumer may appeal that decision. Appeals can be submitted as follows: Consumers may appeal a refused privacy request by replying to the decision email at support@ruvole.com. The operator responds to an appeal in writing within the period set by the applicable state law and explains the action taken or not taken. If an appeal is denied, the consumer may submit a complaint to the Attorney General of the consumer's state of residence. Where the applicable law requires it, the appeal decision identifies an online mechanism, if available, or another method for contacting the Attorney General.

25. Brazil LGPD disclosures

Where Brazil's LGPD, Law No. 13,709 of 2018, applies, personal data is processed under these legal bases in Article 7: execution of a contract or of preliminary procedures related to a contract to which the data subject is a party, at the data subject's request (item V); consent of the data subject (item I); legitimate interests of the controller or of a third party, except where the data subject's fundamental rights and freedoms that require protection of personal data prevail (item IX); and compliance with a legal or regulatory obligation by the controller (item II). The operator's purpose-to-basis mapping is: account service --contract; subscription payments and billing records --contract and legal obligation; refund processing --contract; security logs and fraud prevention --legitimate interests; service improvement --legitimate interests; marketing emails or promotional offers -- consent; customer support -- contract and legitimate interests; compliance with authorities -- legal obligation. Where legitimate interests are relied on, only personal data strictly necessary for the intended purpose is processed and transparency of that processing is maintained, as Article 10 requires. The legitimate interests pursued include Fraud prevention and security logs - Protecting accounts and preventing misuse.; Service improvement - Tracking credits usage and performance to improve Ruvole. The operator states that it does not process sensitive personal data as defined in Article 5, item II. Consent can be revoked at any time by express request through a free and facilitated procedure, without affecting processing carried out before revocation.

The operator states that it is a small processing agent (agente de tratamento de pequeno porte) under the regulation adopted by Brazil's National Data Protection Authority (ANPD) in Resolution CD/ANPD No. 2 of January 27, 2022, and has not appointed a data protection officer (encarregado), as Article 11 of that regulation permits. In place of an encarregado, the operator makes a communication channel available to data subjects at support@ruvole.com. Data subjects can use this channel to submit complaints and communications, obtain clarifications, and exercise their rights under the LGPD.

Where Brazil's LGPD applies, a data subject may request confirmation of processing, access, correction, anonymization, blocking or deletion of unnecessary or unlawfully processed data, portability where regulated, information about sharing and consent choices, consent withdrawal, and review of qualifying solely automated decisions. Requests may be made through the account settings or at support@ruvole.com. Under Article 18 of the LGPD, a data subject may also petition Brazil's National Data Protection Authority (ANPD) regarding their data against the controller, and may petition consumer-protection bodies as applicable.

26. Canada PIPEDA privacy rights

Where Canada's PIPEDA applies, the operator follows accountability, identified purposes, meaningful consent, limited collection, limited use and retention, accuracy, safeguards, openness, individual access, and complaint-handling principles. Individuals may ask about the existence, use, and disclosure of their personal information, request access or correction, or challenge compliance through the account settings or at support@ruvole.com. Complaints may also be directed to the Office of the Privacy Commissioner of Canada where applicable.

27. Quebec privacy disclosures

Where Quebec's Act respecting the protection of personal information in the private sector applies, the person in charge of the protection of personal information holds the title Administrator and can be contacted at support@ruvole.com. The operator states that the service does not use technology with functions allowing a person to be identified, located, or profiled. Personal information may be communicated outside Quebec. Before such a communication, the operator conducts a privacy impact assessment and communicates the information only where the assessment establishes that it would receive adequate protection, under a written agreement, as section 17 of the Act requires.

A person may request access to personal information about them; rectification of information that is inaccurate, incomplete, or equivocal, or whose collection, communication, or keeping is not authorized by law; communication of computerized personal information they provided, to them or to a person or body they authorize, in a structured, commonly used technological format; and withdrawal of consent, subject to the conditions and exceptions in the Act. Requests may be made through the account settings or at support@ruvole.com. A person may apply to the Commission d'accès à l'information du Québec to examine a disagreement about a request or to file a complaint where applicable.

28. Australia Privacy Act disclosures

Where Australia's Privacy Act 1988 and Australian Privacy Principles apply, this policy states the kinds of personal information collected and held, how it is collected and held, the purposes for which it is collected, held, used, and disclosed, how it can be accessed and corrected, how to complain, and whether it is likely to be disclosed to overseas recipients. Personal information is likely to be disclosed to overseas recipients; the countries and safeguards identified by the operator are: Personal data is processed in Kenya, the United States, and the European Union. Where data is transferred outside the EU/EEA or UK, we rely on Standard Contractual Clauses and equivalent safeguards to ensure compliance with GDPR and UK GDPR. Our service providers implement encryption, restricted access, and monitoring to protect personal information.

Individuals may request access or correction or make a privacy complaint through the account settings or at support@ruvole.com. The operator considers each complaint about a possible breach of the Australian Privacy Principles, may ask for information needed to assess it, and responds with its outcome. Complaints and responses follow applicable legal procedures and periods; no shorter period is promised. A complaint may also be made to the Office of the Australian Information Commissioner where applicable.

29. New Zealand Privacy Act disclosures

Where New Zealand's Privacy Act 2020 applies, people are informed of collection purposes, intended recipients, whether providing information is mandatory or voluntary, consequences of not providing it, and access and correction rights. Requests may be made through the account settings or at support@ruvole.com. A person may complain to the Office of the Privacy Commissioner where applicable.

30. Account and data deletion

Users can request account and associated-data deletion through email to support@ruvole.com or the account settings. Some records may remain for security, legal, tax, payment, dispute, fraud-prevention, or backup-cycle needs and will remain restricted to those purposes.

31. Changes to this policy

This policy may be updated to reflect service, legal, or operational changes. The current version will be posted at https://ruvole.com with a revised effective date. Additional notice or consent will be provided only when required by applicable law.

32. Contact us

Privacy questions and requests may be sent to Ann Tessy Ruguru Wanjohi at support@ruvole.com.