Privacy Policy
Wholefit (“we”) is operated by Ivan Kachur. Wholefit shows complete outfits built from products on brands' own online stores and links you to those brands to buy. This policy explains what we collect, why, how long we keep it and the choices you have. It applies to the Wholefit website. Wholefit is intended for people in the United States.
Who's responsible for your data
Ivan Kachur, an individual based in Poland, is the controller of your personal data under the EU General Data Protection Regulation (GDPR). Because Wholefit is run from the European Union, the GDPR applies to how we handle personal data wherever you live, alongside the US state laws described below. Contact us at privacy@getwholefit.com or ul. Władysława Pytlasińskiego 16/13, 00-777 Warszawa, Poland.
The short version
- You can browse, like looks and personalize your feed without an account. That data stays on your device.
- If you create an account (with Google, or with an email and password), we store your name and email address (and your Google profile picture), plus your likes and taste profile so they follow you across devices.
- We log interactions (looks viewed, opened, liked, swapped, sent to checkout; what you search for on the site; which pages you visit, how long you're active on each and how far you scroll; how long each look and each part of a page is on screen, and which parts you tap) against a random device id, never your name or account, to rank popular looks and to see what on the site is useful. They are deleted after 90 days. You can turn this off. In Europe we ask first whether to remember your device; until you say yes they're counted per visit only, with an id that's never stored in your browser.
- We don't sell your personal information or show ads. Pinterest and Google measure and improve their ads with your visit and purchases here. In the US that's on unless you turn it off; in Europe it's off until you say yes.
- Purchases happen on the brand's own website, under that brand's privacy policy.
Information we collect
| What | Why | How long |
|---|---|---|
| On your device: likes, saved looks, your optional taste answers (who you shop for, styles, colors, fit, how much color you wear, occasions, budget, sizes, and the looks you picked or passed over), looks you've seen, the brand, collection and piece pages you've visited, and a random device id. During a visit, which looks you stayed on and which you scrolled past is kept in the open page only, and forgotten when you leave it (with interaction logging on, how long each was on screen is also logged, as above) | Personalizing your feed. This is sent with feed requests to rank them and is not stored by us (your likes, taste profile and pieces you've viewed are, if you're signed in). | Until you clear your browser storage |
| Interaction events: what kind of action (view, open, like, swap, checkout), which look or piece, when, the random device id, and the site or campaign that first brought the device here (for example "pinterest.com"). In Europe, unless you choose to be remembered: a random id for that visit only, and no site or campaign | Ranking popular looks and measuring whether ranking changes help | 90 days |
| Outbound clicks: the store, pieces and look you clicked through to, a random click id, the time and, unless you've turned logging off, the random device id and first site or campaign | Sending you to the brand and matching affiliate commissions to looks | 13 months |
| Account (only if you create one): name, email address, and either your Google profile picture and account id or a one-way hash of your password (never the password itself), your likes and taste profile, and sign-in sessions (including IP address and browser) | Signing you in and keeping your saved looks and preferences in sync | Until you delete your account; sessions expire after 30 days |
| Weekly email (only if you sign up): your email address, whether you shop women's or men's looks, and when you signed up, confirmed and were last emailed | Sending the weekly looks email you asked for. We confirm your address before sending anything else. | Until you unsubscribe, which deletes your address |
| Saved custom looks: the pieces in a look you generated or edited | So the look can be shown again. The look itself isn't linked to you. | Indefinitely |
| Server logs from our hosting provider: IP address, browser and pages requested | Security and keeping the site running | Per our hosting provider's retention, typically days |
We don't collect payment details: you pay the brand directly. We don't knowingly collect information from children under 13, or under 16 in the European Union.
Legal bases (GDPR)
| Use | Legal basis |
|---|---|
| Your account, syncing likes and taste, and sign-in and password-reset emails | Performing our agreement with you, the Terms (Art. 6(1)(b)) |
| The weekly email and price or restock alerts | Your consent (Art. 6(1)(a)), which you can withdraw at any time by unsubscribing or turning alerts off |
| Ranking your feed with the taste profile and likes your device sends | Our legitimate interest in showing you looks you'll like, which you asked for by using the feed (Art. 6(1)(f)) |
| Interaction events | Our legitimate interest in ranking popular looks and improving Wholefit (Art. 6(1)(f)). You can object at any time on Your Privacy Choices. In Europe (the EEA, UK and Switzerland), where keeping a device id in your browser for this needs your agreement, we count interactions per visit only (with a random id held in the open page, never stored and without where you came from, so a visit can't be linked to another), unless you consent (Art. 6(1)(a)) to this device being remembered, which we ask on your first visit. We note when you said yes. |
| Outbound clicks | Our legitimate interest in sending you to the brand and being paid commissions (Art. 6(1)(f)). The device id and first site are added only when interaction logging is on. |
| Pinterest and Google ad measurement | In the EEA, UK and Switzerland: your consent (Art. 6(1)(a)), asked before anything is stored or sent; we keep a record of when you agreed and to which wording. Elsewhere: our legitimate interest in knowing which ads bring visitors and sales (Art. 6(1)(f)). Either way, turn it off at any time on Your Privacy Choices; Global Privacy Control turns it off too. |
| Server logs and security | Our legitimate interest in keeping Wholefit secure and running (Art. 6(1)(f)) |
| Keeping records the law requires, and handling legal claims | Legal obligation (Art. 6(1)(c)) and our legitimate interest in defending claims (Art. 6(1)(f)) |
You don't have to give us any personal data to browse Wholefit. An email address is needed only to create an account or get emails. Your feed is personalized automatically (profiling), but this never has legal or similarly significant effects on you: it only changes the order of looks, and you can see and change what it's based on in Your style.
Sign in with Google
When you sign in with Google we receive only your basic profile (name, email address, profile picture and Google account id). We use it solely to create and secure your Wholefit account. We don't access your Gmail, contacts, Drive or any other Google data. Wholefit's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Browser storage and cookies
Wholefit uses your browser's local storage for likes, taste answers and the random device id, and a first-party cookie to keep you signed in. Ad measurement uses Pinterest's tag and its cookie (_epik and similar) and Google's cookies (_gcl_aw, _gcl_au): in the US unless you turn it off, in Europe only after you say yes. Google's tag itself is on every page, but in Europe it sets no cookies until you say yes (see below). We use no third-party analytics. When you click through to a brand, the brand or an affiliate network may set its own cookies to track the referral, under its own policy.
Affiliate links
Links to brands may be affiliate links (see the Affiliate Disclosure). We pass the network a random click id so a commission can be matched to a look. We never pass your name, email or account id.
Pinterest ad measurement
Unless you turn it off on Your Privacy Choices (in the EEA, UK and Switzerland: only if you allow it, in the prompt on your first visit), Pinterest's tag and its cookie record the pages you visit here and the looks you take to checkout. When you click through to buy, we also send Pinterest that click, and later the purchase if the brand's affiliate network reports one: the amount, the pieces' ids, your IP address, browser, Pinterest's click id and, if interaction logging is on, a hashed form of your random device id. Pinterest uses it to measure and improve its ads, under its own privacy policy, and if you have a Pinterest account it may link this to it. We don't use it to build audiences or to show you ads again (retargeting).
For collecting this data on Wholefit and passing it to Pinterest, we and Pinterest are joint controllers (GDPR Art. 26). We're responsible for telling you about it, asking your consent where it's needed, and for what we send; Pinterest is responsible for what it does with the data once it has it. Pinterest is Pinterest Europe Ltd. (Ireland) for people in the EEA, UK and Switzerland, and Pinterest, Inc. (USA) elsewhere. You can exercise your rights with either of us.
We keep the IP address, browser and click id with the click for 30 days, then delete them. If you turn it off (or withdraw consent), we delete Pinterest's cookies on Wholefit and what we've kept of your earlier clicks, so no later purchase from them is reported; what was already sent stays with Pinterest under its policy. In Europe we ask again after a year, or sooner if what we send changes. With Global Privacy Control on, none of this happens.
Google ad measurement
Google's tag is on every page, under Google's consent mode. Unless you turn it off (in Europe: once you say yes), it and its cookies note the Google ad you came from (Google's click id) and, when you click through to buy, that click: the amount and the page you were on, with your IP address and browser. Google uses it to measure and improve its ads. We don't send page views, we turn off ad personalization and Google signals, and we don't use it to build audiences or to show you ads again (retargeting).
In the EEA, UK and Switzerland, until you say yes, the tag sets no cookies and, when you click through to buy, sends Google only a cookieless signal that a buy click happened (with your IP address and browser, and no click id), which Google uses to estimate ad results in aggregate. Once you turn it off, or with Global Privacy Control, it sends nothing about you; your browser still downloads the tag's code from Google.
Google (Google Ireland Ltd for people in the EEA, UK and Switzerland, Google LLC elsewhere) uses this data as an independent controller under its own privacy policy; see also how Google uses information from sites that use its services. If you turn it off, we delete Google's cookies on Wholefit; what was already sent stays with Google.
Who we share information with
- Service providers that run Wholefit for us: Vercel (hosting, and cookieless page and event counts), Neon (database), Google (sign-in) and Resend (account and weekly emails). They process data only on our instructions.
- Brands and affiliate networks receive the click when you choose to visit or buy, as described above.
- Pinterest and Google for ad measurement, unless you turn it off (in Europe, only if you allow it), as described above.
- Legal reasons: if required by law, or to protect Wholefit, our users or others.
- Business transfers: if Wholefit is merged or sold, subject to this policy.
We do not sell personal information. Pinterest and Google ad measurement may count as sharing for cross-context behavioral advertising under California and other state laws. You can opt out of it at any time on Your Privacy Choices (the link at the bottom of every page), and we treat Global Privacy Control as an opt-out.
International transfers
Our service providers store and process data in the United States. Where data is transferred from the European Economic Area, we rely on the EU–US Data Privacy Framework for providers certified under it, and otherwise on the European Commission's Standard Contractual Clauses. Email us for a copy of the safeguards that apply.
Your choices and rights
- Stop interaction logging (or, in Europe, choose whether this device is remembered) on Your Privacy Choices. We also honor the Global Privacy Control (GPC) browser signal automatically.
- Delete local data by clearing your browser's site data for Wholefit.
- Download or delete your account from your account page. Deleting removes your profile, likes, taste and sessions. Interaction events are never linked to your account.
Depending on your state (including California, Colorado, Connecticut, Virginia, Texas, Oregon and others), you may have the right to know, access, correct, delete or get a copy of your personal information, and to opt out of its sale, sharing, targeted advertising or profiling. To make a request, email privacy@getwholefit.com. We'll verify the request using the account email, respond within 45 days, and won't discriminate against you for exercising your rights. You may use an authorized agent. If we deny your request, you can appeal by replying to our decision.
Under the GDPR, wherever you live, you have the right to access your personal data, correct it, delete it, restrict how we use it, receive it in a portable format, object to uses based on our legitimate interests, and withdraw consent at any time (without affecting what we did before). Email privacy@getwholefit.com and we'll respond within one month. You can also complain to a data protection authority, in particular in the EU country where you live or work. Ours is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.
Security
Data is encrypted in transit, and access is limited to what's needed to run Wholefit. No system is perfectly secure, but we'll notify you as required by law if a breach affects your information.
Changes
We'll update the date below when this policy changes, and tell signed-in users about material changes before they take effect.
Contact
Ivan Kachur, ul. Władysława Pytlasińskiego 16/13, 00-777 Warszawa, Poland. Email privacy@getwholefit.com.
Last updated October 20, 2026.