×Privacy notice
Updated: 27 October 2026
Optional notifications
You may enable a daily reminder at your selected time, using your device’s time zone, from your profile by granting permission on your device. We store the technical delivery endpoint, public encryption keys, language, selected time, time zone, activation date and last delivery attempt date. Your browser push service, such as Apple, Google or Mozilla, receives technical data required for delivery; the message is encrypted and contains no photos, email address or wardrobe data. You may revoke this choice from your profile or device settings. Disabling notifications from your profile or deleting your data removes the server registration. Reminders do not generate images automatically or consume your quotas.
Controller and contact
The controller is Unkredible Studios, VAT no. IT12700380012. For data protection questions or to exercise your rights, email info@unkredible.com, stating the email associated with your profile. This notice covers Forma and the data needed to operate it.
Data we process
We process your verified email, a non-reversible cryptographic password hash, sessions and activation or recovery requests, contact details, chosen name, preferences, optional physical information, city and coordinates when used, personal photos, garment images and attributes, outfits and processing history. Server requests may include IP address, browser information, dates and technical logs. Subscriptions involve Stripe identifiers, plan, status, expiry dates and necessary administrative information. Full card details are collected by Stripe, not by the Forma interface.
Purposes and legal bases
Access, wardrobe features, suggestions, generation and plan management perform the service you request and our contract. Tax and administrative duties rely on legal obligations. Service protection and abuse prevention rely on our legitimate interest in security, subject to your rights. Optional features requiring consent, such as device location access, can be disabled. Your data is not sold for advertising.
Personal photos and AI
Necessary photos are sent to fal.ai and the model providers used to perform the analyses and generations you request. Four personal photos prepare your outfit reference; alternatively, choose a generic model. This internal reference is not a photograph published on your profile. Synthetic images may alter your face, body shape and proportions: they are not faithful replicas or assessments of your appearance or health. Photos are not used for facial-recognition authentication. Do not upload health data, documents or images of unauthorised persons.
Location and external services
Forma uses Open-Meteo for contextual suggestions and Nominatim/OpenStreetMap and ipwho.is for city or location searches. GPS requires browser permission; revoke it in your settings and enter a city manually instead. Necessary coordinates and locations may be shared with weather and geocoding services. Fonts are requested from Google Fonts. Stripe processes payment and plan-management data under its own privacy notice. Language selection uses a local IP-to-country database: no visitor IP is sent to the database provider. Your manually selected language takes precedence.
Recipients and international transfers
Depending on their duties, data may be accessed by the controller and authorised staff, hosting and maintenance providers, AI, weather and payment services, administrative advisers and authorities where required by law. Some providers may process data outside the European Economic Area. Actual conditions depend on the service and model used. Ask the controller for information about recipients, countries and applicable transfer safeguards. Key providers’ privacy notices are linked below.
Retention and subscribing again
Internal aggregate statistics are described in the Cookies and device storage notice and retained for up to 90 days. Profile content, wardrobe and lookbook are retained to provide the service while you keep them in the app. After your paid subscription period ends, they are archived for six months to allow you to subscribe again using the same email, then permanently deleted if you do not reactivate. You may request deletion earlier. Tax and accounting records follow statutory periods. Security or dispute records are retained as long as needed for their purpose, taking applicable time limits into account.
Control and deletion
Edit preferences and remove individual items using the app controls. An image still referenced by an outfit may remain available until that reference is removed. Full deletion permanently removes app content and signs you out; it does not cancel your subscription or delete documents subject to legal obligations. Use plan management for renewal or cancellation.
Your rights
Where applicable, you may request access, rectification, erasure, restriction, portability and object to processing. You may withdraw consent without affecting earlier lawful processing. We may need to verify your identity. We normally respond within one month, subject to permitted extensions. You may complain to the Italian Data Protection Authority (Garante per la protezione dei dati personali).
Required data and automated decisions
Data needed for access and requested features is necessary to provide them. Personal photos, physical information and precise location are optional; without them, some personalisation is unavailable. AI suggestions are not decisions producing legal or similarly significant effects on you.
References
General Data Protection Regulation