HatSuggestions
Log in

Privacy policy

Last updated: October 6, 2026

Who is responsible

The controller for the personal data processed on hatsuggestions.com is the operator of HatSuggestions, reachable at hello@accessorysuggestions.com.

HatSuggestions belongs to a family of sites run by the same operator (hatsuggestions.com, glassessuggestions.com, outfitsuggestion.com, accessorysuggestions.com, bagsuggestions.com, watchsuggestion.com, colorsuggestions.com). They share one account system: the same account, credits and selfies work on every one of them. For any privacy question, write to hello@accessorysuggestions.com.

What we process and why

Selfies and try-on images

To create a try-on you upload a photo of yourself (a face shot or a full-body shot), which we call a selfie. We send it to an AI image model together with the style you chose and store both your selfie and the resulting try-on image in your account, so you can see and reuse them on every site of the family. We keep your selfies until you delete them — one by one in your Suite, or all at once by deleting your account. Try-on images are kept the same way. We use your photos only to produce the results you ask for; we do not sell or publish them, and we do not use them to train AI models. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

Face analysis

When you ask which style fits you best, we send the selfie you took to an AI vision model, which reads your face shape and picks one style from our catalog for you, with a sentence on why it suits you. It works without an account. We show you your face shape; the picked style and its reason stay sealed until you reveal them as a try-on, and only an encrypted code your browser keeps (valid for 7 days) carries them until then. We do not store the selfie you analyse: it is saved only if you go on to a try-on, as described above. If you are logged in, or log in or sign up afterwards in the same browser tab, we keep the result in your account — your face shape and the sealed pick — so you find it again in your Suite; a revealed pick's reason is kept with its try-on. Legal basis: steps you ask for before entering into a contract with us, and its performance (Art. 6(1)(b) GDPR).

Size calculator

When you use our head size calculator, we send the measurement you type (your head circumference) to our server, which reads it against our size chart, without any AI model, and shows you the result. It works without an account. Your browser remembers the measurement for this visit, so a face analysis you run afterwards can take it into account. If you are logged in, or log in or sign up afterwards in the same browser tab, we keep the result in your account — the measurement and your size — so you find it again in your Suite. Legal basis: steps you ask for before entering into a contract with us, and its performance (Art. 6(1)(b) GDPR).

Your account and email address

You sign up and log in with your email address and a one-time code we email to you (valid for 10 minutes). For your account we store your email address, the site you signed up on, your country (derived from your IP address at signup; it decides your currency and how we ask for email consent), your style preference if you give one, and your credit balance with its history. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

To save the style our face analysis picked for you, you can also open an account with your email address alone: you are logged in at once, and we email you a link to confirm the address. Until you confirm it — with that link, a login code or Google — the account gets no free try-on and no style emails. Unconfirmed accounts that bought no credits are deleted with everything in them 7 days after they were opened.

Style emails

We occasionally email style ideas that link back to your Suite. If you sign up from the EU/EEA, the UK, Switzerland or Canada, we send them only if you tick the box at signup (consent, Art. 6(1)(a) GDPR). Elsewhere we tell you at signup that you will receive them. Every one of these emails has an unsubscribe link (one button on the page it opens; mail programs that offer one-click unsubscribe use it too), which stops them from every site of the family; we also stop after several emails you do not engage with. We record each consent decision (the wording you saw, your country and the time) and which emails we sent, so we can show why you received them.

Purchases

Credits are sold in packs through Stripe Checkout. Stripe processes your payment details; we never see your card number. We receive the confirmation of your payment, the pack and the amount, and add the credits to your account. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR) and our accounting obligations (Art. 6(1)(c) GDPR).

Login cookie and browser storage

When you log in, we set one cookie that keeps you logged in on this site for up to 90 days. Your browser also stores a few settings for this site locally, such as your analytics choice and a try-on or an analysis result waiting for you to sign up. Both are strictly necessary for the service you ask for and need no consent.

Security

We process IP addresses to stop abuse, for example to limit how many login codes, face analyses or size calculations can be requested. These counters expire automatically within hours. Legal basis: our legitimate interest in a secure service (Art. 6(1)(f) GDPR).

Analytics

Each site of the family uses its own Google Analytics 4 property with Google Consent Mode v2. If you visit from the EU/EEA or the UK, we ask you first: until you accept, no analytics cookies are set and Google receives only cookieless signals. Elsewhere, analytics cookies are enabled when the page loads. When you buy credits, our server reports the purchase (pack, amount and a pseudonymous account ID) to the Google Analytics property of the site you bought on. Legal basis where we ask: your consent (Art. 6(1)(a) GDPR), which you can withdraw by clearing this site's data in your browser.

Processors and other recipients

We use these service providers, which process data on our behalf or, for payments, under their own terms:

Some of these providers process data in the USA. Where a provider is certified under the EU–U.S. Data Privacy Framework, transfers rely on that adequacy decision; otherwise on the EU Standard Contractual Clauses.

If we sell or transfer hatsuggestions.com to another company, we hand that company this site's share of the data so it can keep running the site: the accounts of people who signed up or used the service here, the selfies and try-ons made here, the analysis results kept here, the credit history of credits bought or spent here, and this site's consent records and email log. The buyer then becomes the controller for that data. Legal basis: our legitimate interest in being able to sell a site (Art. 6(1)(f) GDPR).

How long we keep your data

Deleting your account in your Suite erases your account, selfies, try-ons, analysis results, credit history and consent records on every site of the family at once. Stripe keeps its own payment records as financial and tax law require.

Your rights

You have the right to access, rectify and erase your data, to restrict or object to its processing, and to receive it in a portable format. You can withdraw a consent at any time without affecting earlier processing. Write to hello@accessorysuggestions.com. You may also complain to a data protection authority — in Austria the Datenschutzbehörde (dsb.gv.at) — or the one where you live. We make no automated decisions that have legal or similarly significant effects on you.