At Medida, accessible from medida.yohagoeso.com, protecting the privacy of our customers is a priority. This Privacy Policy explains what information we collect through the virtual try-on service (the "Service"), how we use it, who we share it with, and the rights you have over it. If you have questions about this Policy, contact us via the contact page.
Medida, accessible at medida.yohagoeso.com, is the data controller responsible for the personal information described in this Policy. [Legal entity name and registered address to be confirmed before publication — our Terms and Conditions specify Dutch governing law, suggesting an EU/Netherlands establishment; this should be confirmed and stated here, together with whether a separate UK representative under Art. 27 UK GDPR is required.] For privacy questions, or to exercise the rights described below, contact us via the contact page.
When you submit an order, we collect the email address, name, and
order details you provide; the garment photo(s) you upload; the
catalog model you select to generate your try-on; and the images and
videos generated for your order ("Generated Content"). If you contact
us directly — including to exercise the rights described below — we
collect the name, email address, subject, and message you provide in
that form. When you access your order, we issue a magic-link access
token (stored only as a hashed
value, never in plain text) and set an essential order_session
cookie to keep you signed in — see "Cookies and Analytics" below. We
also collect standard request metadata — IP address, browser type, and
timestamps — logged automatically by our hosting infrastructure for
operating and securing the Service.
We use this information to process your order, generate and deliver Generated Content, send order-related emails (including the magic-link used to access your order), and respond to support requests. Before an order is approved for generation, a member of our team manually reviews the uploaded garment photo against our garment image guide — for example, to screen out personal identifying information or third-party intellectual property. If a photo doesn't meet these guidelines, we'll email you and ask you to upload a replacement using the same order link; you won't need to place a new order. We also use this information to maintain, secure, and improve the Service.
Where the EU or UK GDPR applies, we process your information on the following legal bases: performance of a contract (Art. 6(1)(b)) — to fulfil the order you place and deliver Generated Content; legitimate interests (Art. 6(1)(f)) — to secure the Service, prevent abuse, and review uploaded content against our garment guidelines; and, where we ask for it separately, your consent (Art. 6(1)(a)) — for example, the optional choice at order submission to let us feature your garment photo and Generated Content in our public gallery and marketing materials. We do not rely on your general acceptance of this Policy as a stand-alone legal basis for processing.
Medida relies on the following third-party service providers ("processors") to operate the Service:
These providers process your information solely to perform the services described above and are subject to their own privacy practices. We do not sell your personal information to third parties.
Some of the providers listed above process data outside the European Economic Area and the United Kingdom — including in the United States (Google, Cloudflare, Resend) and Singapore (Kling AI, whose group also includes entities in China). For Google, Cloudflare, and Resend, we rely on the transfer safeguards they make available, such as the EU-US Data Privacy Framework or Standard Contractual Clauses. Kling AI does not currently offer a data processing agreement or an equivalent transfer safeguard for these transfers; we are evaluating how to address this. Transfers between the EEA and UK are covered by mutual adequacy decisions and require no additional safeguard.
Medida uses one essential cookie, order_session,
required to keep you signed in to your order after you follow your
magic link. If you choose "keep me signed in on this device" when
accessing your order, this cookie persists for 7 days; otherwise it is
cleared when you close your browser. Because this cookie is strictly
necessary for the Service to function, no cookie-consent banner is
required or shown. We do not currently use any non-essential or
analytics cookies. If that changes — for example, if we add analytics
tools such as Google Analytics — this Policy will be updated first to
describe what is collected and how to opt out.
Uploaded photos, Generated Content, and your order data are retained
for as long as your order remains active so that you can access and
re-download your content. We do not currently operate an automated
deletion schedule — retention is indefinite unless you ask us to
delete your data (see "Your Data Protection Rights" below). Download
links themselves are time-limited and expire after 24 hours for
security; this affects only the link, not the underlying files, and
you may request a new link at any time while your order remains
accessible. Your magic-link access token and order_session
cookie expire after 7 days but can be reissued by requesting a new
link.
If a breach involving your personal information occurs, we will notify affected users and, where required by applicable law, the relevant supervisory authority, without undue delay.
The Service is not directed at children. Placing an order requires confirming you are 18 or older, and we apply a 16-year minimum age policy across the Service generally, higher than the 13-year threshold under UK and US law. Other parts of the Service, such as the contact form, are not actively age-gated. If you believe a child has provided us with personal information, please contact us and we will take steps to remove it.
Depending on your location, you may have the right to: access the personal information we hold about you; correct inaccurate information; request erasure of your information; restrict or object to certain processing; receive your information in a portable format; and withdraw consent where we rely on it. You may also withdraw your gallery/marketing consent and request removal of your garment photo or Generated Content from our public gallery at any time, even after opting in. To exercise any of these rights, contact us via the contact page; we will respond within the time required by applicable law. If you are not satisfied with our response, EU and UK residents have the right to lodge a complaint with their local data protection supervisory authority (in the UK, the Information Commissioner's Office, ico.org.uk).
We may update this Privacy Policy from time to time. Material changes will be reflected by a new version number at the top of this page. Continued use of the Service after a change takes effect constitutes acceptance of the updated Policy.
By using the Service, you acknowledge this Privacy Policy and, where applicable, our Terms and Conditions. Where we rely on your consent for a specific processing activity, we will ask for it separately.