Account privacy notice, version 1.0

In short

With a FitMyType account, FitMyType is responsible for your account data (the controller). The shops are not.
Your persona (your bodies, usual sizes and fit preferences) is kept only with your consent, and you can take it back.
A shop gets your size result only after you connect it, and you can disconnect it at any time. Shops never get your persona file.
All account data is hosted in the European Union.
You can download everything we hold about you, and delete your account yourself, at any time.

Who is responsible for your account data

FitMyType (legal company name to be confirmed), (registered address to be confirmed), is the controller for your account data: your email address, sign-in methods, persona, connected shops, consents and security events. Write to [email protected] for anything about it.

When you use the size tool on a shop, the shop stays the controller for the size tool's own data (its statistics and your answers there): see the shopper privacy notice. We never put account data in the shop's statistics.

What we keep, why, and for how long

What	Why	Legal basis	How long
Your email address, your sign-in methods (email link, passkey, Google or Apple) and your language.	Run your account: sign you in and keep you signed in.	Our contract with you (the account terms)	Until you delete the account, or 24 months after you last used it
Your bodies (answers and measurements), references, usual sizes, fit preferences, own size charts and units.	Keep your persona so every shop with FitMyType can use it.	Your consent, which you can withdraw at any time	Until you withdraw this consent or delete the account
Which shops (and later assistants) you connected, with the date; the shop gets your size result, not your persona.	Use your persona in the size tool of a shop you connect.	Your consent, which you can withdraw at any time	Until you disconnect the shop or delete the account
Each consent and withdrawal: purpose, notice version, time and where you gave it. No measurement, no email.	Prove what you agreed to and when.	Our legitimate interest in a safe, provable service	3 years after the account is deleted, under a scrambled account id
Security events: sign-ins, new sign-in methods, connected shops, with the date.	Keep your account safe: notice unusual sign-ins and stop misuse.	Our legitimate interest in a safe, provable service	12 months

We do not use your account data for advertising, we do not sell it, and we do not send you marketing emails.

Accounts you no longer use

If you do not sign in or use your persona for 24 months, we delete the account. We email you 30 days before, so you can keep it by signing in.

What is stored on your device

Name	Where	What it holds	When it is written	How long it stays
`__Host-fmt_account`	account site (me.fitmytype.com): cookie	Keeps you signed in to your FitMyType account on the account site. A random value; no body data.	When you sign in to your account.	Until you sign out, delete the account, or do not use it for 30 days (at most 180 days).
`__Host-fmt_account_csrf`	account site (me.fitmytype.com): cookie	A random check value that stops other sites from making changes in your account.	When you sign in to your account.	As long as the sign-in cookie.
`fmt_account_rt_v1`	widget frame: localStorage	The link between this shop's size tool and your account (a token for this shop only), so you stay connected.	Only after you connect your account to this shop.	Until you disconnect the shop, sign out, delete the account, or do not use it for 30 days.
`fmt_account_cache_v1`	widget frame: localStorage	A copy of your persona for this shop's size tool, so it works quickly and offline.	Only after you connect your account to this shop.	Cleared when you disconnect the shop, delete the account or the account says it is being deleted.

We use these service providers for your account. Shops never receive your account data; a connected shop only gets the size the tool works out for you.

Who	What for	Which data	Where
Resend, Inc.	Sends our emails: back-office invites, password resets, alerts and these change notices, and the account emails (sign-in links, account notices, the warning before an unused account is deleted).	The recipient's email address and name, and the text of the email. No body data.	United States (moving to its EU region) (Outside the EU: Standard Contractual Clauses)
Google Ireland Limited (Google sign-in)	Lets a shopper sign in to a FitMyType account with Google, when the shopper chooses it.	The fact of the sign-in, and the email address and Google account id Google sends back. No body data.	European Union and United States (Outside the EU: Standard Contractual Clauses)
Apple Distribution International Ltd. (Sign in with Apple)	Lets a shopper sign in to a FitMyType account with Apple, and relays our account emails when the shopper hides their email.	The fact of the sign-in, the email address (or Apple's relay address) and Apple's account id, and the text of account emails sent to a relay address. No body data.	European Union and United States (Outside the EU: Standard Contractual Clauses)

Google and Apple receive data only if you choose to sign in with them. The full list of our service providers is on the sub-processor list.

Where your account data is hosted

All account data is hosted in the European Union. Deleted data is gone from our backups within 90 days, and your account's own encryption key is destroyed at delete, so those copies cannot be read.

A body or size chart you delete is kept as a deletion mark for 30 days, so your other devices delete it too; then it is removed. Expired sign-in tokens are removed after 7 days.

Your choices and rights

See and withdraw your consents on your account page. Withdrawing the persona consent deletes your persona and keeps the account.
Disconnect a shop on your account page; it can no longer use your persona.
Download your account file (everything we hold about you) on your account page.
Delete your account on your account page. Within 1 hour your account, persona and connected shops are gone; we keep only a record of your consents, under a scrambled id, as proof.
Correct your data on your account page, or write to [email protected] for any request; we answer within one month.
You can also complain to your data protection authority.

Age

You must be 16 or older to create an account. The size tool on a shop works without an account at any age.

Account privacy notice