Privacy Policy

Neli Catar, a sole trader trading as Rare & Flair, of 66 Paul Street, London, EC2A 4NA, is the controller responsible for the processing described in this notice. Contact privacy@rareandflair.com with questions, complaints or requests about your information.

When you choose Google sign-in, we receive your email address and the authentication/account information supplied by Google. Apple sign-in may be introduced later. We do not receive or store your Google or Apple password. The email address and identifiers needed to authenticate you are required for account features; you can browse public content without an account.

We store the moodboards you save. Tapping the like/save control saves a moodboard; it is not a separate public liking feature. We also process saved-item and recently viewed product information where these features are available, and information you include in messages to us. We do not take payment for retailer purchases or collect payment-card details for them.

If you represent a brand or business, we process the contact details, role, business details, partnership correspondence, permissions and acceptance records you provide, or that an affiliate platform supplies to us, to assess and manage the relationship. When you use a private partnership invitation, we record the current onboarding section and when onboarding is first recorded as started through an action that saves or submits information. Simply opening the invitation page is not recorded as starting onboarding.

We keep a record of already-seen moodboards so that the feed avoids showing them again. For signed-in users, this record is linked to the account ID and works across visits. For signed-out visitors, it is linked to a random session identifier, with a new identifier for each new session.

This history is used only to prevent repeats. It is not used to infer your fashion interests or train recommendation models. It operates independently of optional analytics. Account-linked history is deleted when the account is deleted; signed-out history is deleted within 24 hours after the relevant session expires. We do not include IP addresses in these functional view records.

We may send necessary account, security or service messages independently of marketing preferences. Email delivery and mailbox providers process addresses and message contents as needed to deliver and manage our communications.

We process search text to return relevant results, including through Voyage AI, which creates search embeddings. Our Voyage AI account is configured to opt out of storage and use of submitted data for model training. We do not retain raw search text in our analytics database or send it as search-event content to PostHog or Umami. Avoid including personal or sensitive information in a search.

Authentication, requested saves, functional repeat prevention, security and essential service logs operate independently of optional analytics. Hosting infrastructure processes network requests, which involve IP addresses and technical request information even where these are excluded from product-event records.

With analytics consent, Umami Cloud measures page visits and traffic sources. We send filtered page paths, referrer origins, campaign parameters restricted by format and length, language and screen size. Umami also processes technical browser/device information and may derive approximate geographic statistics. Our integration does not set Umami cookies or browser storage, use session replay or send account IDs. It is still disabled unless you accept analytics in Privacy settings.

Umami Cloud uses infrastructure in the US and EU; its processing is not limited to the EU.

With analytics consent, PostHog EU Cloud measures approved events such as moodboard views, searches, saves, product clicks, affiliate clicks and completed sign-in. Properties are limited to approved event fields, including moodboard/product IDs, source category, positions and result counts. Events also include a pseudonymous browser identifier and technical event timing. We do not deliberately identify your account to PostHog or send your email or raw search text.

PostHog uses persistent browser storage, so its browser identifier can link activity across visits until cleared. This differs from the session-only identifier used for signed-out first-party records. Our configuration disables IP-address recording and disables session replay, autocapture, automatic pageviews, heatmaps and person profiles. The receiving infrastructure still processes IP addresses as part of delivering network requests.

With analytics consent, we record interaction events in Supabase, including moodboard exposures/views and product or retailer-link clicks, together with relevant IDs, source, timestamps and consent information. Signed-in events can contain your account ID; signed-out events use a random session identifier. We exclude email addresses, raw search text and IP addresses from these event records.

We use optional analytics to understand and improve product discovery. Where the consent request includes recommendation development, we may also use newly collected, consented first-party interaction sequences to develop, test and train Rare & Flair’s own moodboard ranking and recommendation systems. We exclude functional repeat-prevention history, events collected before this notice takes effect, and events collected without the relevant consent.

Before training, we remove account identifiers and minimise other identifying information. Individual viewing sequences can still be personal data even after identifiers are removed. We therefore treat them as personal data unless an assessment establishes that individuals cannot reasonably be identified. The same consent, withdrawal and retention protections apply to these sequences and other identifiable training copies.

Individual interest-based recommendations may be introduced later. Before using activity to personalise your feed beyond preventing repeats, we will explain the processing and controls and obtain any required separate consent. We do not use discovery recommendations to make decisions with legal or similarly significant effects on you.

Optional analytics are off until you accept, whether or not you are signed in. You can reject or withdraw through Privacy settings without deleting your account or losing browsing and requested saved-content features. Withdrawal stops future optional collection and further consent-based use of your identifiable records, including their use in model development.

On withdrawal, we arrange deletion of the optional analytics records and identifiable training copies associated with you without undue delay, including requests to relevant service providers where necessary. We do not retain these records merely until their normal expiry. We may retain limited consent/withdrawal evidence or information required for a separate legal obligation or legal claim; it is not used for analytics or training.

Withdrawal does not make earlier lawful processing unlawful. Genuinely anonymous statistics may remain because they no longer identify you. A training dataset or model is not treated as anonymous merely because names or account IDs have been removed. If we cannot locate a signed-out record, we may ask for an available session identifier or other proportionate information to help identify it.

If you opt in again, that choice applies to new collection and permitted use from that point. It does not reinstate deleted records or authorise reuse of historical records excluded following withdrawal. Functional seen-moodboard history and requested saved content are handled separately under the purposes explained above.

All product shopping links on Rare&Flair are affiliate links. Retailers or affiliate networks may process link and device information and use tracking technologies to attribute qualifying purchases to us. Your Rare&Flair analytics choice does not constitute consent to a retailer’s or network’s separate tracking. They are responsible for their own notices and applicable consent arrangements.

Networks and retailers may provide conversion reports, including transaction IDs, retailer, date, value, currency, commission, status and product information. Available fields vary by programme. We use these reports to reconcile commissions, resolve disputes and keep business records. Some report fields may constitute personal information, depending on the network and the other information available.

Our affiliate relationships include networks such as Awin, GoAffPro, Rakuten Advertising and CJ Affiliate and may change. Contact us for information about the network relevant to a particular link. See our Affiliate Disclosure.

We use account authentication information and requested saved-content records to perform our agreement with you where necessary to provide those features. Necessary account/service messages are sent on the same basis, or on legitimate interests where needed for service administration or security.

We rely on legitimate interests for proportionate repeat prevention, returning relevant search results (including processing search text through Voyage AI), responding to enquiries, protecting the service, and administering partnerships and affiliate commissions. Those interests are providing a usable discovery service, helping visitors, maintaining security and managing our business relationships. We assess necessity and balance those interests against your rights, with particular care for children.

For business contacts, we rely on legitimate interests in assessing and administering partnerships and keeping permission records. Where an individual is personally a party to an agreement, we may instead rely on performance of that agreement for processing necessary to it.

Consent is our basis for optional analytics and the recommendation-development use explained in the consent request, and for optional marketing messages. Legal obligations apply to records or disclosures required by law, including applicable tax and accounting requirements. Any separate cookie or similar-technology consent requirements also apply.

Supabase provides authentication and database infrastructure in Ireland. PostHog EU Cloud provides product analytics; Umami Cloud provides website analytics using infrastructure in the US and EU. Voyage AI processes search text. Pannon-site Kft. provides our server hosting in Hungary. Bunny.net stores product and moodboard imagery served through our application. Email delivery and mailbox providers assist with communications. Professional advisers and authorities may receive information where necessary and lawful.

Google, and Apple if introduced, process information under their own privacy notices when you choose their sign-in services. Retailers and affiliate networks process information in connection with their services and provide the reports described above.

Some providers or their support teams and subprocessors may process information outside the UK or EEA. For a restricted transfer, we use an applicable adequacy arrangement or appropriate safeguards, such as the UK International Data Transfer Agreement or UK Addendum, and EU Standard Contractual Clauses where EU GDPR applies. Contact privacy@rareandflair.com for the countries and safeguards relevant to a particular provider and a copy of applicable safeguards, subject to appropriate redactions.

Account information and saved content are kept while needed to provide the account and removed on account deletion, except for limited records needed for legal obligations or claims. Account-linked seen-moodboard history is kept while needed to prevent repeats across visits and deleted when the account is deleted. Signed-out seen-moodboard records are deleted within 24 hours after their session expires.

Optional first-party raw analytics are retained for up to 90 days plus the daily cleanup interval. This limit also applies to identifiable training copies; moving a record to a training dataset does not restart the retention period. PostHog events are retained for one year and Umami analytics for six months. These are maximum routine periods and do not override earlier deletion required following withdrawal or an applicable erasure request. Genuinely anonymous statistics may be retained longer.

Separately consented marketing information is kept while the subscription continues. Minimal suppression records are retained for as long as needed to honour an unsubscribe, under our legitimate interests in respecting preferences and complying with marketing rules.

Security logs and correspondence are retained for the time needed to investigate incidents, answer enquiries and handle claims, considering their sensitivity and applicable limitation periods. Partnership contacts, onboarding progress, first-action timestamps and permission/acceptance records are retained while needed to manage the relationship, document authorised uses and deal with related claims. Affiliate accounting records are kept for applicable tax, accounting and dispute requirements.

Supabase backups are retained for seven days. Records deleted from the active database may remain in those backups until they rotate out; they are not used for analytics or training, and deletion instructions are reapplied if a backup is restored. Other providers’ backup and deletion schedules apply to copies they hold. We review continuing need and remove data that is no longer necessary, including in connection with inactive accounts.

Under applicable data protection law, you can request access, correction, erasure, restriction and, where the conditions apply, a portable copy of your information. You can withdraw consent at any time. Contact privacy@rareandflair.com; we may request proportionate identity verification. We normally respond within one month, subject to lawful extensions or adjustments, and explain any refusal or exception. Delete your account through your profile or contact us.

You can complain to the Information Commissioner’s Office. Where applicable, you may also complain to the supervisory authority where you live, work or believe an infringement occurred.

You may object to processing based on legitimate interests for reasons relating to your situation. We must stop unless we demonstrate overriding compelling legitimate grounds or need the information for legal claims. You can object to direct marketing at any time, including related profiling, and we will stop using your information for that purpose. Contact privacy@rareandflair.com.

Rare&Flair does not impose a general 18+ restriction. Public fashion content can be browsed without an account. If you need help understanding this notice or your choices, ask a parent or guardian.

Where consent is required for an online service offered directly to a child under 13 in the UK, it must be authorised by a person with parental responsibility. Other countries may set a different threshold. Merely accepting this notice does not provide that authorisation. Contact privacy@rareandflair.com if you believe a child has provided information without required authorisation; we will review the situation, stop processing where necessary and delete information where required.

We do not use functional seen-moodboard history for training or knowingly use children’s information for behavioural advertising. Individual interest-based recommendations are not enabled by the analytics choice described in this notice.

We update this notice when our processing changes. We will draw material changes to your attention through an appropriate notice and seek fresh consent where required before using information for a new consent-based purpose. The date above is a revision date; new model-development uses only apply after publication and the relevant informed consent.