App: Madam B!it Developer: Arthur Nunes
English translation. The authoritative version is the Brazilian Portuguese one: https://madamb.it/privacy-policy. Last updated: August 2026.
Madam B!it is a fashion-critique app: you share an outfit photo (and optionally a voice message) and get an AI-generated critique. This policy describes what the app collects, on which legal basis, where that data goes, how long it stays and how you exercise your rights.
The law that governs this is Brazil's LGPD (Law 13.709/2018).
We do not rely on a blanket "by using the app you consent". Each activity has its own basis:
| Activity | Legal basis |
|---|---|
| Account creation and authentication | Art. 7, V — performance of a contract |
| Outfit photo analysis and styling suggestions | Art. 7, V — performance of a contract (it is the service) |
| Voice transcription and spoken replies | Art. 7, V — performance of a contract |
| Wardrobe, wishlist, preferences and conversation memory | Art. 7, V — performance of a contract (features you use) |
| Inspiration research (web lookup) | Art. 7, V — performance of a contract (a feature you ask for) |
| Credit, purchase and AI-usage records | Art. 7, V — performance of a contract (balance control) |
| Crash reports and server diagnostic logs | Art. 7, IX — legitimate interest (stability and security) |
Where we rely on legitimate interest (art. 7, IX) you may request the corresponding balancing assessment (art. 10 § 3) through the channel above, and you may object to the processing.
Outfit photos often include your face. Plainly, what the app does and does not do:
So we do not process biometric data in the sense of LGPD art. 5, XI. If any future feature starts identifying people by face, this policy will be updated and the specific, highlighted consent required by art. 11 will be collected before that change takes effect.
Your data does not all stay in Brazil. The database is held in Brazilian territory (AWS, region sa-east-1); the other providers operate abroad:
| Recipient | What it receives | Purpose |
|---|---|---|
| OpenAI (USA) | Conversation text, outfit photo, voice audio | Generate the critique, transcribe, speak |
| Google — Gemini (USA) | Outfit photo and descriptions; the theme text you ask about | Analyse the image, generate support images and research the theme |
| Cloudflare (global network) | Photos, recordings and the realtime service traffic | Host the engine and store the media |
| Clerk (USA) | Sign-in identifier, name and email (when shared); password hash, for email and password sign-in | Authenticate you |
| Sentry (USA) | Crash reports and masked session replay (production only) | Fix app defects |
| Apple — App Store / Google — Play (USA) | The purchase itself, made inside the store | Charge you and return the transaction identifier that credits you |
The international transfer relies on art. 33, VIII of the LGPD — it is necessary for the performance of a contract to which you are a party — and each provider processes the data under its own published data-processing terms.
Two things the table cannot show:
We do not sell your data and we do not use it for advertising.
The account-and-data-deletion page is the authoritative reference for what is deleted, what is kept and for how long: https://madamb.it/delete-account-en.
Summary, with the real windows:
| Data | Window |
|---|---|
| Account, conversations, messages, wardrobe, media, memory | Until you delete the account — erased as the request runs |
| Password hash (email and password sign-in, kept by Clerk) | Until you delete the account |
| Copies sent to OpenAI's models | Chained-conversation responses only, plus copies OpenAI retains for abuse monitoring: up to 30 days after the request |
| Server diagnostic logs (Cloudflare) | 3 days (free plan) / 7 days (paid plans) |
| Crash reports (Sentry, production builds) | 90 days |
| Credit, purchase and AI-usage records | Deleted together with the account |
| Researched inspiration sheet (shared library) | No deletion period — kept with no link to you |
The details a table cannot carry:
store: false): OpenAI keeps no copy of those on our behalf. The exception is the chained conversation — each turn references the turn before it, and OpenAI only allows that reference for responses it has stored (store: true). So the responses of a running conversation do sit with OpenAI for up to 30 days. When you delete your account we walk that chain of responses and ask OpenAI to delete each one. That clean-up is best-effort: if a step fails, the response stays with OpenAI until it expires inside the window above. Copies sent before that change, or retained by OpenAI for abuse monitoring, likewise remain for up to 30 days after the request. In short: deleting your account here does not, on its own, erase what OpenAI already holds — the final deadline is OpenAI's, not one we control.How to delete: in the app, under SETTINGS → ACCOUNT → DELETE ACCOUNT, or by email to business@mrhewbuc.com — including after you uninstalled the app. The step-by-step is on the deletion page.
At any time you may request:
How to exercise them: write to business@mrhewbuc.com (or to the DPO, business@mrhewbuc.com). We respond within 15 calendar days, per LGPD art. 19. We use the address you write from only to locate the account and confirm the outcome.
You may also lodge a complaint with the ANPD — Brazil's National Data Protection Authority (https://www.gov.br/anpd).
The app does not access your photos, camera or microphone outside the actions you explicitly take.
If we change what we do with your data we update this page before the change takes effect and change the "last updated" date above. This page is generated from the text versioned in our repository: the published version and the internal one cannot diverge without breaking our automated check.