Privacy
We ask you for the measurements of your body. That is unusually personal information to hand a clothing company, and this page is how we account for it.
The three commitments
Your body measurements are never sold or licensed to anyone.
Your body measurements are never used for advertising or ad targeting, by us or by anyone else.
Your body measurements are never used to train machine-learning models.
These are not aspirations pending a policy change. If they ever stop being true, this page changes first and we tell you before it takes effect.
What we collect
- Account details
- Your name and email address. Your password is stored only as a one-way hash — we cannot read it, and neither can anyone who obtains the database.
- Your measurement profile
- The basics and upper-body measurements you enter, your units, your fit preference, and optionally your gender. With your explicit consent, a resized photo of your tailor slip is sent through our API to Cloudflare Workers AI to propose measurement values. Processing may take place outside Australia. We do not store the image on our servers or in browser local storage. Proposed values are held on your device until you confirm or discard them; only confirmed values are saved to your profile. Recognition can be wrong, including for handwriting, so check each value against the slip.
- Orders
- What you ordered, when, what you paid, and a frozen copy of the measurements as they stood when you paid. That frozen copy is what the tailor cuts from, so we keep it with the order.
- Payment details
- None. Payment runs through Stripe. Your card number never reaches our servers and we could not retrieve it if we wanted to.
Why we collect it
To make your clothing, to take payment for it, and to talk to you about your order. That is the whole list. We do not build advertising profiles and we do not run analytics that track you across other sites.
Where it is stored
Account and measurement data is held in a Cloudflare D1 database hosted in the Oceania region. The website is served by Vercel. Payment processing is Stripe, which holds your card details under its own privacy terms and its PCI DSS obligations.
Cloudflare, Vercel and Stripe are our only processors. We do not pass your data to anyone else, and none of the three is permitted to use it for their own purposes.
What the site stores in your browser
We do not use advertising or tracking cookies. The site keeps a sign-in token, a working copy of your profile, and any pending measurement proposals in your browser's local storage so that reloading does not lose your review. Proposals are scoped to your account. Signing out clears this local data. Photo processing is optional and requires separate consent; manual entry remains available.
How long we keep it
Your profile is kept while your account exists, because its whole purpose is to be reused for the next garment. Order records are kept for seven years, which is what Australian tax law requires of us. If you delete your account, the profile goes; the order records stay for that seven years, reduced to what the tax obligation actually needs.
Your rights
- See it. Your profile page shows everything we hold about your body. Ask and we will send you the rest.
- Correct it. Edit your profile at any time. A correction does not alter a shirt already in progress — those measurements are frozen to the order.
- Take it with you. Ask us for a copy of your saved profile, or use the blank printable tailor slip to record measurements with any tailor, including one who is not us. This is deliberate: your measurements are not our lock-in.
- Delete it. Email us and we will delete your account and profile, subject to the order-record retention above.
Security
Traffic to this site and its API is encrypted in transit. Passwords are hashed, not stored. Browser access to the API is restricted to our allowed website origins, and every request for your data must carry your signed session token.
We will not pretend this is impregnable. If we ever suffer a data breach that is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.
Handling of your information
We handle personal information in accordance with the Australian Privacy Principles under the Privacy Act 1988 (Cth).
Contact and complaints
Privacy questions and requests go to hello@vitruviantailor.com. We aim to respond within 30 days.
If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.