Privacy policy

KOTS is a service operated by Mindlace Industries Ltd, a company registered in England and Wales (company number 13905733), registered office 124 City Road, London, EC1V 2NX. Mindlace Industries Ltd is the “data controller” responsible for your personal information.

For any privacy question or request, contact us at hello@killersonthestreet.com.

• Account details — your email address, name and authentication data used to create and secure your account.
• Profile & sizing — gender, sizes and the style preferences you give us so we can personalise recommendations.
• Wardrobe & activity — items, outfits, collections, shopping lists and how you interact with them.
• Photos — any images you choose to upload of yourself or your wardrobe, plus private styling-reference and outfit-preview images created from them.
• Weather location — the approximate location you choose to share so your daily outfit can respond to local conditions.
• Delivery address — if you choose to save one, the address you would have orders sent to. We use it to check which retailers actually deliver to you, since many serve one part of a country and not another. It is visible only to you, is never shown to anyone managing your profile, and we never pass it to a retailer unless you choose to use it at their checkout.
• Communications — messages you send us and your notification and marketing preferences.
• Technical & usage data — device and browser type, approximate location derived from network information, performance and aggregate interaction data needed to operate, secure and improve KOTS, plus cookies (see our Cookie Policy).

Under UK GDPR we rely on the following lawful bases:

• Performance of a contract — to create your account and provide personal styling, wardrobe management and collection features.
• Legitimate interests — to improve KOTS, keep it secure, prevent misuse and understand how the service is used, in ways you would reasonably expect.
• Consent — to retain analytics identifiers on your device, join signed-in analytics across devices, share optional masked session replays, send marketing communications you have opted into and, where required, use affiliate or marketing cookies. You can withdraw consent at any time.
• Legal obligation — to comply with law, for example tax, accounting and responding to lawful requests.

We use PostHog to understand, in aggregate, which parts of KOTS are useful, how journeys are completed and where performance or reliability needs attention. Website analytics begins in anonymous cookieless mode. If you accept analytics cookies, PostHog retains a pseudonymous browser identifier across return visits. The app retains a pseudonymous device identifier by default. When you sign in and analytics is enabled, KOTS uses an internal profile identifier to join activity across web, iOS and Android. We do not send PostHog your name, email address, photos, messages or other text you enter.

Anonymous cookieless website measurement is on by default for the sole purpose of improving KOTS. We rely on our legitimate interest in improving the service and the statistical-purpose exception under UK electronic communications law. Native iOS and Android analytics remains off until you enable it in Privacy & data. You can switch either surface off at any time, free of charge, from our Cookie Policy or the Privacy section of the app.

Separately, you can choose to share masked session replays so we can see the sequence of screens, taps, clicks and scrolling around a usability problem. Replays are off until you actively turn them on. All text, inputs, images, video and canvas content are hidden before anything is sent to PostHog. We also exclude console logs, network contents and sensitive account or password-recovery pages. You can withdraw this consent at any time from the same controls, which stops future recording immediately.

We use Sentry to receive essential crash reports from the website and app. A report can include the app version, device or browser type, operating system, the route or operation that failed and the technical stack trace. When you are signed in, we may attach an internal profile identifier so repeated failures can be tied to one affected account. We rely on our legitimate interest in keeping KOTS reliable and secure.

KOTS does not send Sentry your name, email address, photographs, voice recordings, messages, search terms, cookies or request headers. Crash reporting runs separately from optional analytics and session replay.

KOTS takes part in affiliate programmes. When you click a “shop” link and buy from a retailer, we may earn a commission at no extra cost to you. To credit that referral, the retailer or its affiliate network (for example AWIN, Rakuten Advertising, CJ, Impact or Sovrn/Skimlinks) may set cookies or process limited transaction data. These are governed by that partner’s own privacy policy.

We only enable affiliate or marketing cookies on KOTS where consent is required and you have consented. See our Affiliate Disclosure and Cookie Policy for detail.

We do not sell your personal information. We share it only with service providers who process it on our behalf under contract, including:

• Supabase — database, authentication and secure storage.
• Vercel — website and app hosting.
• Resend — transactional and account emails.
• PostHog — privacy-conscious product analytics using pseudonymous browser, device and internal profile identifiers, plus fully masked session replay only when you enable it. KOTS does not send typed content, names or email addresses.
• Sentry — essential crash reporting using technical diagnostics and an internal profile identifier, with default personal-data collection disabled.
• AI model providers — to analyse a selfie you choose to provide and create your colour analysis, styling reference, private outfit previews and other styling suggestions. These providers process the image to return the requested result; KOTS stores the resulting profile media in private storage.
• Affiliate networks & retailers — where you choose to shop through our links, as described above.

We may also disclose information where required by law or to protect our rights and users.

Some of our providers are based outside the UK, including in the United States. Where personal information is transferred internationally, we rely on appropriate safeguards such as UK adequacy regulations or the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses.

We keep your personal information for as long as your account is active and as needed to provide the service, then for any further period required to meet legal, accounting or dispute-resolution obligations, after which it is deleted or anonymised.

Under UK data protection law you have the right to:

• Access a copy of your personal information
• Have inaccurate information corrected
• Have your information erased in certain circumstances
• Restrict or object to certain processing
• Data portability
• Withdraw consent at any time, without affecting prior processing

To exercise any of these, email hello@killersonthestreet.com. You also have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk.

KOTS is not directed at children under 16, and we do not knowingly collect their personal information.

We may update this policy from time to time. Material changes will be reflected here with a revised “last updated” date.