Privacy Policy

This Privacy Policy explains how CDB LFG TTM B.V., trading as Lookly (“Lookly,” “we,” “us”) collects, uses, discloses, and protects personal data when you use the Lookly platform (the “Platform”) — our website, applications, and related services connecting Clients seeking personal styling with independent Creators.

This Policy applies to Clients, Creators, and visitors to our website. It should be read together with our Terms of Service. Capitalized terms not defined here have the meaning given in the Terms of Service.

CDB LFG TTM B.V., trading as Lookly, is the data controller responsible for personal data processed through the Platform, within the meaning of the EU General Data Protection Regulation (“GDPR”) and equivalent US state laws.

• Controller: CDB LFG TTM B.V.
• Address: Herengracht 449 A, 1017 BR Amsterdam, The Netherlands
• KvK: 81628110 · VAT: NL862162002B01
• General contact: support@lookly.vip
• Privacy Officer: privacy@lookly.vip

Lookly serves two kinds of Users with different data footprints:

• Clients provide styling preferences (goals, budget tier, preferred brands and retailers, sizing information), booking and payment details, and content shared inside a Studio session (briefs, wardrobe/inspiration images, chat messages).
• Creators provide public-facing profile content (portfolio, bio, social links, service pricing), and — because Creators are paid via the Platform — tax information required for DAC7 reporting (Section 05). Identity verification and bank details for payouts are provided directly to our payment partner Stripe, not to Lookly (Section 06).

Sections 03–09 apply to both roles except where noted.

We collect the following categories, corresponding directly to the data fields our Platform actually stores:

• Account & identity data: name, email address, authentication credentials (managed by our authentication provider), account role (Client/Creator), account creation and activity timestamps.
• Client profile data: full name, avatar image, Instagram/TikTok handles (optional), styling goals, budget tier preferences, preferred brands and retailers, sizing information (region, top size, waist, length, shoe size).
• Creator profile data: handle, display name, tagline, bio, city, avatar and cover images, social and website links, specialties, supported brands, portfolio images and videos, featured/verified status.
• Creator payout and tax data: Tax Identification Number (TIN), tax country of residence, VAT/BTW number (if applicable), the reference to the Creator's payout account at Stripe, its setup status, and the payout history (amounts, dates, transfer references). This also applies to anyone receiving referral commissions. See Section 05 for why we collect this and Section 06 for how payment itself works.
• Booking and session data: service bookings, styling briefs, session status, in-session chat messages, wardrobe/inspiration images and other files exchanged in a Studio session, lookbooks (title, description, cover image, curated items), reviews and ratings, and — where a Client uses “Report a problem” — the report and its date.
• Subscription and group chat data: subscription feed posts and reactions, group chat messages and images, and — where a Creator moderates the chat — which members were muted and when.
• Transaction data: which service was purchased, price, VAT amount, currency, billing interval, subscription status and renewal date, and the payment and customer references assigned by Stripe. We do not collect or store payment card numbers or full financial account details — see Section 06.
• Technical & usage data: IP address, browser and device information, log data, and cookie/session identifiers necessary to keep you signed in (see Section 10).
• Communications data: messages you send to our support team, and any correspondence about your account.

We do not intentionally collect special category data under GDPR Article 9 (e.g., health, religious belief, sexual orientation, racial or ethnic origin) or “sensitive personal information” as defined under US state privacy laws (e.g., precise geolocation, biometric data for identification purposes), and we ask that you do not include such information in free-text fields (bios, briefs, chat messages) unless you choose to voluntarily disclose it yourself.

We process personal data for the following purposes, each mapped to a legal basis under GDPR Article 6(1):

Where we rely on legitimate interests, we have weighed those interests against your rights and freedoms and concluded our processing is proportionate and expected in the context of using a styling marketplace.

As a digital platform operator facilitating personal services within the EU, Lookly is required under Council Directive (EU) 2021/514 (“DAC7”) to collect identification and tax information from Creators and to report Creator earnings annually to the Dutch Tax Administration (Belastingdienst), which may exchange this information with tax authorities in other EU member states.

To meet this obligation, we collect and store each Creator's Tax Identification Number, tax country of residence, and, where applicable, VAT/BTW number. This data is used solely for tax compliance and payout administration — it is not used for marketing or shared with third parties beyond what Section 07 describes.

Until this information is provided, payouts owed to a Creator (and, separately, to a Creator who earns a Lifetime Referral commission) are held pending, consistent with our legal obligation to collect this data before disbursing reportable earnings.

Payments on the Platform are processed by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (“Stripe”). Lookly is the seller of the services; Stripe processes the payments and pays out Creators.

• We never see or store your payment card number, CVV, or bank account details. Clients enter payment details directly on Stripe's checkout page. Creators and referrers enter their identity details and bank account directly with Stripe when setting up payouts.
• Lookly receives only what it needs from Stripe: payment confirmations, amounts including VAT, the billing address country needed to apply the correct VAT, subscription status and renewal dates, and references to the customer and payout accounts. We use this to activate bookings and subscriptions, to calculate payout shares, and for our accounting and tax obligations.
• Stripe processes your data partly on our behalf (payment processing) and partly as an independent controller for its own legal obligations, such as identity verification, fraud prevention, and anti-money-laundering checks. For that processing, Stripe's own privacy policy applies.

We share personal data only in the following circumstances:

• With the other party to a booking. A Client's styling brief and sizing information is shared with the Creator they book; a Creator's public profile is visible to prospective Clients.
• With Stripe, to process payments, apply the correct VAT, and pay out Creators and referrers (Section 06).
• With service providers (sub-processors) who host our infrastructure, deliver emails, or support the technical operation of the Platform, bound by data processing agreements consistent with GDPR Article 28. We maintain a current list of sub-processors and will provide it on request to privacy@lookly.vip.
• With the Dutch Tax Administration, for Creator tax reporting under DAC7 (Section 05).
• Where required by law, such as in response to a valid legal order, or to protect the rights, property, or safety of Lookly, our Users, or the public.
• In a business transfer (merger, acquisition, or asset sale), subject to the same protections described in this Policy.

We do not sell personal data, and we do not share it for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA. See Section 13.

Lookly is based in the EU, and we aim to keep personal data within the European Economic Area (“EEA”) where practical. Where personal data is transferred outside the EEA — for example, where our payment partner Stripe involves its US affiliate Stripe, Inc., or to a cloud service provider with servers outside the EEA — we rely on appropriate safeguards, in particular the European Commission's Standard Contractual Clauses (“SCCs”), supplemented where necessary by additional technical and organizational measures. You can request a copy of the relevant safeguard via privacy@lookly.vip.

We retain personal data for as long as your account is active and as needed to provide the Platform. After account closure:

• Most profile and Platform-activity data is deleted or anonymized within a reasonable period following deletion (see our Terms of Service Section 10 and the account-deletion flow in Settings).
• Financial and transaction records, including Creator payout and tax data, are retained for at least 7 years, consistent with Dutch bookkeeping requirements under the Burgerlijk Wetboek and applicable tax law.
• Data we are required to retain for legal, tax, dispute-resolution, or fraud-prevention purposes is kept only as long as necessary for that purpose.

We currently use only strictly necessary / functional cookies and similar technologies — for example, to keep you signed in and remember basic session state. We do not currently use third-party advertising or cross-site tracking cookies.

If we introduce non-essential cookies (e.g., analytics) in the future, we will update this Policy and request your consent via a cookie banner where required by law. We honor recognized opt-out preference signals, including the Global Privacy Control (“GPC”), where technically supported — see Section 13.

We use appropriate technical and organizational measures to protect personal data, including encryption in transit, access controls, and reliance on infrastructure providers with their own security certifications. No system is completely secure; if we become aware of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority and affected Users without undue delay, as required under GDPR Articles 33–34 and applicable US breach-notification laws.

If you are located in the EEA or UK, you have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate or incomplete data;
• Erase your data (“right to be forgotten”), subject to our retention obligations in Section 09;
• Restrict or object to certain processing, including processing based on legitimate interests;
• Data portability for data you provided to us, in a structured, machine-readable format;
• Withdraw consent at any time, where processing is based on consent, without affecting prior lawful processing;
• Lodge a complaint with a supervisory authority — in the Netherlands, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or the supervisory authority in your own EU member state.

To exercise these rights, contact privacy@lookly.vip. We will respond within the timeframes required by GDPR (generally one month, extendable in complex cases).

This section is a Notice at Collection and rights summary for California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”).

Categories of personal information we collect, mapped to CCPA's statutory categories: identifiers (name, email, account ID); customer records information (billing/transaction metadata); commercial information (services purchased); internet/network activity (log and cookie data); geolocation (only coarse, if provided via profile fields such as city — we do not collect precise geolocation); professional information (for Creators — portfolio, specialties, tax/business identifiers); and inferences are not generated for advertising purposes.

Purposes: as described in Section 04.

Sources: directly from you; automatically through your use of the Platform; and, for booking-related data, from the other party to a booking.

Disclosures: as described in Section 07 — service providers, our payment partner, and as legally required.

We do not sell personal information, and we do not “share” it for cross-context behavioral advertising, as those terms are defined by the CCPA/CPRA. There is nothing to opt out of on that front today; if this changes, we will provide a “Do Not Sell or Share My Personal Information” mechanism and honor it, including via the Global Privacy Control.

Your rights as a California resident:

• Right to know what personal information we have collected, used, disclosed, and (as applicable) sold or shared;
• Right to delete personal information we hold about you, subject to statutory exceptions;
• Right to correct inaccurate personal information;
• Right to opt out of sale/sharing (not currently applicable — see above) and of certain automated profiling with legal effects (we do not currently perform such profiling — see Section 16);
• Right to limit use of sensitive personal information (not generally applicable — we do not collect CCPA-defined sensitive categories in the ordinary course, see Section 03);
• Right to non-discrimination for exercising any of these rights.

To submit a verifiable request, email privacy@lookly.vip. We may need to verify your identity before completing certain requests. You may designate an authorized agent to act on your behalf as permitted by the CCPA.

Shine the Light (Cal. Civ. Code § 1798.83): we do not share personal information with third parties for those third parties' own direct marketing purposes without your consent.

A growing number of US states — including but not limited to Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and others that have since enacted comprehensive privacy laws — grant residents rights broadly similar to those in Section 13: the right to access, correct, delete, and port your personal data, and to opt out of the sale of personal data, targeted advertising, and certain profiling. As stated in Section 07, Lookly does not sell personal data or use it for targeted advertising, so the practical effect of an opt-out request is limited today, but we will honor verifiable requests under the law of your state of residence. Residents of Nevada may also submit a request under Nevada's opt-out-of-sale law (NRS 603A) to the same contact below; as above, we do not sell personal information as defined by that law.

To exercise any state-specific right, contact privacy@lookly.vip, noting your state of residence.

The Platform is intended solely for individuals aged 18 and over, consistent with our Terms of Service. We do not knowingly collect personal data from anyone under 18. If we learn that we have inadvertently collected data from a minor, we will delete it and terminate the associated account.

We do not currently use automated decision-making or profiling that produces legal or similarly significant effects on Users (for example, Creator visibility and search ordering are based on straightforward, non-automated criteria such as featured status and specialties, not an opaque scoring algorithm).

The Platform may contain links to Creators' external social media profiles and websites. We are not responsible for the privacy practices of those third-party sites; this Policy applies only to Lookly.

We may update this Policy from time to time. Material changes will be notified in the same manner, and on the same notice period, as material changes to our Terms of Service. The “Last updated” date at the top reflects the current version.

For any question about this Policy or to exercise your rights:

• Privacy Officer: privacy@lookly.vip
• General support: support@lookly.vip
• Postal address: CDB LFG TTM B.V., trading as Lookly, Herengracht 449 A, 1017 BR Amsterdam, The Netherlands

If you are in the EEA and believe we have not addressed your concern satisfactorily, you have the right to lodge a complaint with the Autoriteit Persoonsgegevens (the Dutch Data Protection Authority) or the supervisory authority in your own member state.