Privacy policy

FLY SENGA LTD

Contents

1. Important information and who we are
2. Summary at a glance
3. The personal data we collect about you
4. How your personal data is collected
5. How we use your personal data and our legal bases
6. Your body data — special category data and explicit consent
7. AI features, profiling and automated decision-making
8. Marketing and communications
9. Cookies and similar technologies
10. Who we share your personal data with
11. International transfers
12. Data security
13. Data retention — how long we keep your data
14. Children and age assurance
15. Your legal rights
16. Complaints
17. Third-party links and services
18. Changes to this privacy policy
19. Contact details

1. Important information and who we are

1.1 This policy. This privacy policy explains how FLY SENGA LTD (FLY, we, us, our) collects and uses your personal data when you use our website flysenga.com, our web application, our mobile apps and all features and services available through them — including LEXY (our AI stylist), the Wardrobe, avatar try-on, subscriptions (together, the Services) — and when you communicate with us. It also explains your data protection rights.

1.2 Controller. FLY SENGA LTD, a company registered in England and Wales (company number 14584737) with its registered office at 12 Byrd Grove, Northwich, CW9 8XF, is the controller of your personal data. We are registered with the Information Commissioner’s Office (ICO).

1.3 Laws that apply. We process personal data in accordance with the UK General Data Protection Regulation and the Data Protection Act 2018 (together, UK GDPR) and, where we offer the Services to individuals in the European Economic Area, Regulation (EU) 2016/679 (EU GDPR). References in this policy to the GDPR are to both, as applicable to you.

1.4 Contact. If you have any questions about this policy or want to exercise your rights (section 15), contact us at: enquiries@flysenga.com.

1.6 Changes and your duty to inform us. We keep this policy under regular review; this version was last updated on 15 September 2026 and replaces all previous versions. We will notify you of material changes by email or in-App notice. Please keep the personal data we hold about you accurate and up to date by updating your Profile or telling us of changes.

2. Summary at a glance

• Your body data is optional and yours to control. You never have to upload a body photo or measurements for the FLY avatar. If you choose to, we ask for your explicit consent, we use the data only to power your avatar, try-on and personalised styling, we never show it to other users or Partners, we never sell it, we do not use your body photos to train AI models for other users, and you can delete it at any time (sections 6 and 13).
• LEXY conversations are processed by AI. Your messages and voice input are processed by our systems and trusted AI service providers acting on our instructions, to answer you and personalise your experience (section 7).
• We track clicks and purchases through affiliate links. When you click BUY or GET TICKETS, a click identifier is shared with the retailer or ticketing partner’s affiliate network, which reports back to us if a purchase is made — this is how FLY earns commission (sections 3 and 10).
• Personalisation is built in. Based on the information you provide to us and activity on FLY, we profile your style preferences, likes, views and behaviour to personalise your feed and recommendations. You can object to profiling, and we do not show under-18s commercial content selected by profiling (sections 5, 7 and 14).
• We do not sell your personal data, and we only share it as described in section 10.
• You have rights — access, correction, deletion, objection, portability and more (section 15) — and you can complain to the ICO or your local EU regulator (section 16).

3. The personal data we collect about you

Personal data means any information about an individual from which that person can be identified. We collect, use, store and transfer different kinds of personal data about you, which we have grouped as follows. We also collect, use and share aggregated data (such as statistical or demographic data) which is not personal data because it does not directly or indirectly reveal your identity.

3.1 If you fail to provide personal data. Where we need to collect personal data by law or under a contract with you and you do not provide it, we may not be able to provide the relevant feature (for example, we cannot operate your subscription without billing data). We will tell you at the time if this is the case. Most personalisation data is optional — the Services work but in a more generic form, without it.

4. How your personal data is collected

4.1 Directly from you, when you: create an account; complete the onboarding questionnaire; set up or edit your avatar; upload Wardrobe items; chat with LEXY by text or voice; tap “I got it”; enter a promotion or survey; or contact us.

4.2 Automatically, as you use the Services: we collect Technical Data and Usage Data using device permissions you grant (such as camera and microphone access, used only for the features you invoke), server logs, software development kits and cookies and similar technologies (see our Cookie Policy and section 9).

4.3 From third parties, including: (a) Apple or Google, when you sign in with them (name, email and authentication tokens); (b) affiliate networks and Partners (such as Awin, Rakuten, CJ, Impact and Skimlinks), which report purchases attributed to FLY click identifiers, as described in section 3; (c) Stripe, our payment provider, regarding subscription payment; and (d) our service providers, such as analytics, security, content-moderation and crash-reporting providers acting on our instructions.

5. How we use your personal data and our legal bases

The law requires us to have a legal basis for collecting and using your personal data. We rely on: performance of a contract (processing necessary to provide the Services to you under our Terms of Service); legitimate interests (where processing is necessary for our or a third party’s legitimate interests, and your interests and rights do not override them — we balance these carefully and you can ask us about our assessments); legal obligation (where we must process data to comply with the law); and consent (where you have actively agreed — including explicit consent for the special category data described in section 6). Where we rely on consent, you can withdraw it at any time without affecting prior processing. The table below sets out our purposes, the data used and the legal bases.

5.1 Purpose limitation. We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another compatible reason. If we need to use it for an unrelated purpose, we will notify you and explain the legal basis.

6. Your body data — special category data and explicit consent

6.1 What Body Data is. If you choose the photo-based avatar, our AI analyses your full-body photo to derive your body type, height impression, shoulder build, estimated size range, skin tone and a personal colour palette, and your photo is used as the base for photorealistic try-on. If you choose manual setup, you provide measurements and a skin complexion. Because information about your skin tone may reveal (or allow inferences about) your racial or ethnic origin, we treat your body photo, your skin tone selection and the characteristics derived from your photo as special category data and apply the GDPR’s higher standard of protection to all of your Body Data.

6.2 Explicit consent — and it is genuinely optional. We process Body Data only with your explicit consent, which we ask for clearly before you upload a photo or enter measurements. You can use FLY fully without providing any Body Data — choose the default 3D avatar instead; personalisation of sizing and colour suggestions will simply be more generic.

6.3 How we protect and limit Body Data. Your Body Data is: (a) used solely to create and operate your avatar, generate try-on images and personalise styling recommendations to you; (b) stored privately in access-controlled storage with security measures including encryption and signed, expiring access links; (c) never visible to other users or to Partners; (d) never sold; (e) never used to train AI models for other users; and (f) accessed by our personnel only where strictly necessary (for example, to investigate a fault or a report at your request), under confidentiality obligations. Trusted service providers process Body Data on our documented instructions solely to deliver these features (section 10).

6.4 Withdrawing consent and deletion. You can withdraw your consent at any time by deleting your body photo and measurements in your Profile (or switching to the default avatar), or by contacting us. Withdrawal does not affect processing before withdrawal. When you delete Body Data or your account, we delete your photo, measurements, derived characteristics and cached try-on images within 30 days, except where we are legally required to retain specific records (section 13).

7. AI features, profiling and automated decision-making

7.1 How AI uses your data. FLY’s AI features process your data to serve you: LEXY processes your messages, voice input and personal context (preferences, recent likes, recent purchases, wardrobe contents) to generate recommendations; our categorisation engine processes Partner product data; our avatar and try-on features process Body Data (section 6); and our moderation systems process content. Where we use third-party AI providers, they act as our processors on our instructions, are bound by contract, and are listed in the categories in section 10. We do not permit our AI providers to use your personal data to train their own models.

7.2 Voice input. Voice recordings are processed to transcribe and respond to your request and are then retained only for the short period needed for quality, security and abuse-prevention checks before deletion (section 13).

7.3 Improving our Services. We use aggregated and de-identified data derived from use of the Services (which does not identify you) to evaluate and improve our features, recommendations and AI performance. We do not use your private content — your body photos, Wardrobe images or LEXY conversations — to train AI models in identifiable form for other users.

7.4 Profiling for personalisation. We profile your preferences and behaviour to rank your For You feed and tailor recommendations and notifications. This profiling is core to FLY but does not produce legal or similarly significant effects on you, and you can object at any time (section 15) or reduce its inputs by editing your preferences. We do not present commercial content selected on the basis of profiling to users we know to be under 18.

7.5 Automated moderation decisions. Our systems may automatically hide or restrict content assessed with high confidence as breaching our rules (for example, a Creator post classified as unsafe), pending human review. Where any decision affecting you is taken by automated means, you have the right to be informed, to obtain human review, to express your point of view and to contest the decision — use the in-app appeal option or contact us (section 15). We do not make solely automated decisions that produce legal or similarly significant effects on you without these safeguards.

8. Marketing and communications

8.1 Marketing from us. With your consent or, for email, under the “soft opt-in” where you have an account or have engaged with our Services and have not opted out, we may send you marketing by push notification and email — for example: new product and event alerts, favourite-brand picks, sale alerts, restock alerts, event reminders and new-feature announcements — including personalised suggestions based on your Profile & Preference and Usage Data. We comply with the Privacy and Electronic Communications Regulations 2003 (UK) and the ePrivacy rules applicable in the EU.

8.2 Opting out. You can stop marketing at any time: toggle notification and email preferences in your Profile settings; use the unsubscribe link in any marketing email; or disable push notifications in your device settings. Opting out of marketing does not stop service communications we need to send (such as billing, security and changes to terms), and your trial-end and renewal reminders.

8.3 Third-party marketing. We do not share your personal data with any third party for that third party’s own direct marketing purposes without your express consent.

9. Cookies and similar technologies

9.1 Our website and web app use cookies and similar technologies (such as local storage, pixels and SDKs in our mobile apps) to make the Services work, keep you signed in, remember preferences, measure performance and understand usage, and to support affiliate click attribution. Where the law requires, we ask for your consent before setting non-essential cookies, and you can change your choices at any time via the cookie settings on our website. Full details — including the cookies we use, their purposes and durations — are in our Cookie Policy at flysenga.com/cookies.

9.2 Affiliate tracking. When you click BUY or GET TICKETS, a click identifier is attached to the link that takes you to the Partner, and the Partner’s affiliate network may set cookies on the Partner’s site under its own and the Partner’s policies, so that purchases can be attributed. The data we receive back is described in section 3 (Transaction & Affiliate Data).

10. Who we share your personal data with

10.1 We require all third parties to respect the security of your personal data and to treat it in accordance with the law. Our service providers (processors) may only process your personal data on our documented instructions and for specified purposes, under contracts incorporating the safeguards required by the GDPR, and may not use it for their own purposes. We share personal data with:

10.2 No sale of personal data. We do not sell your personal data.

11. International transfers

11.1 We are based in the UK and our primary infrastructure is hosted in the UK/EEA. Some of our service providers (for example, certain cloud, payment, AI, moderation and analytics providers) are located in, or support from, countries outside the UK and EEA, including the United States, so your personal data may be transferred internationally.

11.2 Whenever we transfer your personal data out of the UK or EEA, we ensure a similar degree of protection by using at least one of these safeguards: (a) transfers to countries covered by UK adequacy regulations or an EU adequacy decision (including, for the EEA-UK route, the EU’s adequacy decision for the UK); (b) transfers to US providers certified under the EU-US Data Privacy Framework and/or its UK Extension; or (c) contracts incorporating the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses, together with any supplementary measures needed. You can contact us for further information on the specific mechanism used for any transfer.

12. Data security

12.1 We have put in place appropriate technical and organisational measures to prevent your personal data from being accidentally lost, used, altered, disclosed or accessed in an unauthorised way. These include encryption of data in transit and at rest, private storage with signed, expiring access links for sensitive media (such as body photos and try-on images), row-level access controls, role-based staff access on a need-to-know basis under duties of confidentiality, server-side calculation and verification of all payment flows, secrets management and rotation, logging and monitoring, and regular review of our security posture.

12.2 Breach notification. We have procedures to deal with any suspected personal data breach. Where legally required, we will notify the ICO (and/or the relevant EU supervisory authority) without undue delay and within 72 hours of becoming aware of a notifiable breach, and we will inform you directly where the breach is likely to result in a high risk to your rights and freedoms.

13. Data retention — how long we keep your data

13.1 We only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including satisfying legal, regulatory, tax, accounting and reporting requirements, and to establish or defend legal claims. To determine retention periods we consider the amount, nature and sensitivity of the data, the potential risk of harm from unauthorised use or disclosure, the purposes of processing, whether we can achieve those purposes by other means, and applicable legal requirements. Key periods:

13.2 When you delete your account, we delete or anonymise your personal data in line with this section. We may retain limited data where necessary for the purposes above (for example, transaction records for tax), in the event of a complaint, or where we reasonably believe there is a prospect of litigation. In some circumstances we will anonymise personal data (so it can no longer be associated with you) for research or statistical purposes, in which case we may use it indefinitely without further notice to you.

14. Children and age assurance

14.1 Minimum age 13. The Services are not intended for, and must not be used by, anyone under 13, and we do not knowingly collect personal data from children under 13. If we learn that we have collected personal data from a child under 13, we will delete it and the associated account. If you believe a child under 13 is using FLY, please contact us at enquiries@flysenga.com.

14.2 Users aged 13–17. We design the Services with the safety of younger users in mind, in line with the ICO’s Age Appropriate Design Code, including: high-privacy defaults for under-18s; no presentation of commercial content selected on the basis of profiling to under-18s; limiting the visibility of age-inappropriate products and events to younger users; and clear, age-appropriate explanations of how we use data.

14.3 Parental consent in the EU. Where we rely on consent to process the personal data of a user below the age of digital consent in their EU member state (which ranges from 13 to 16), we require that consent to be given or authorised by the holder of parental responsibility, and we use reasonable efforts, taking available technology into account, to verify this.

14.4 Age assurance. We use proportionate measures to establish and act on age, which may include self-declaration of date of birth, signals from your account and usage, and — where required for access to higher-risk features or where we suspect misstatement — additional age-assurance checks. We retain only the minimum data needed from such checks.

15. Your legal rights

15.1 Under the GDPR you have the right to:

1. request access to your personal data (a “subject access request”) and receive a copy of it, plus information about how we process it;
2. rectification — have incomplete or inaccurate data corrected;
3. erasure — ask us to delete your data where there is no good reason for us to continue processing it (we will delete your personal data automatically when you successfully delete your account, subject to section 13); we may not always be able to comply for specific legal reasons, which we will tell you about;
4. object to processing based on legitimate interests (including profiling for personalisation), where something about your particular situation makes you want to object — and an absolute right to object at any time to processing for direct marketing;
5. restriction — ask us to suspend processing while we verify accuracy, where processing is unlawful but you do not want erasure, where you need the data for legal claims, or while we assess your objection;
6. portability — receive the personal data you provided to us, processed by automated means on the basis of consent or contract, in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible;
7. withdraw consent at any time where we rely on consent (including the explicit consent for Body Data — see section 6.4), without affecting the lawfulness of prior processing; and
8. rights relating to automated decision-making — including human review of, and the ability to contest, relevant automated decisions (section 7.5).

15.2 How to exercise your rights. Use the tools in your Profile (edit data, manage preferences, clear LEXY history, delete Body Data, delete your account) or contact us at enquiries@flysenga.com. You will not have to pay a fee, unless your request is clearly unfounded, repetitive or excessive (in which case we may charge a reasonable fee or refuse). We may need to verify your identity before acting — this is a security measure. We respond within one month; if your request is complex or you have made several, we may extend by up to two further months and will tell you.

16. Complaints

16.1 We would appreciate the chance to deal with your concerns first — please contact us at enquiries@flysenga.com. You also have the right to complain at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority (ico.org.uk; helpline 0303 123 1113), and, if you are in the EEA, to the supervisory authority of the member state of your habitual residence, place of work or the place of the alleged infringement.

17. Third-party links and services

17.1 The Services include links to third-party websites and services — most importantly the Partner sites you visit when you tap BUY or GET TICKETS, app stores and Apple/Google sign-in. Clicking those links or enabling those connections may allow third parties to collect or share data about you under their own privacy policies, which we do not control and are not responsible for. We encourage you to read the privacy policy of every site you visit — especially before completing a purchase on a Partner site.

18. Changes to this privacy policy

18.1 We keep this privacy policy under regular review and will post any updates in the App and on our website. If we make material changes, we will notify you by email or prominent in-App notice before they take effect and, where the change involves a new purpose requiring your consent, we will ask for it.

19. Contact details

Controller: FLY SENGA LTD (company number 14584737)
Registered office: 12 Byrd Grove, Northwich, CW9 8XF, United Kingdom
Email: enquiries@flysenga.com
UK supervisory authority: Information Commissioner’s Office, ico.org.uk