Skip to content
Ayna
Sign in

Privacy

This is a translation for your convenience. The German version is legally binding: German version.

Last updated: October 2026

This page explains what data Hey Ayna processes, what for and who receives it. In short: your photos are stored on our own server in Germany. We don't show ads, we don't sell data and we don't use tracking.

1. Who is responsible

Y&L Solutions UG (haftungsbeschränkt), Rahnfelsstraße 10, 68163 Mannheim, Germany
Email: info@yl-solutions.de

2. This website (heyayna.de)

Hosting. The website and the app run on a server operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in a data centre in Germany. We have a data processing agreement with Hetzner under Art. 28 GDPR.

Visiting the site. So that your browser can display the site, the server technically processes your IP address, the date and time, the address requested and information about your browser. We don't keep any access logs. The legal basis is our legitimate interest in a working and secure website (Art. 6(1)(f) GDPR).

No cookies, no third-party content. This website doesn't set any cookies, doesn't load any fonts, videos or scripts from other providers and doesn't embed any social networks. Instagram and TikTok are only linked to with plain links: the platform only receives data from you once you click one. Their privacy policies then apply.

Ayna on Instagram and TikTok. We have profiles there (@heyayna.de) with Meta Platforms Ireland Limited and TikTok Technology Limited, both in Dublin, Ireland. If you visit them, the platforms process your data in line with their own privacy policies. For the statistics they show us about our profiles (Instagram Insights, TikTok Analytics), we are joint controllers with them (Art. 26 GDPR). The platforms provide the agreements on this. We only see aggregated figures, not individual people. We only use messages you send us there to reply to you (Art. 6(1)(f) GDPR). You can exercise your rights with us and with the platforms.

No audience measurement. We don't measure who visits this website.

3. The app (app.heyayna.de)

Account and sign-in

For your account, we store the name you give, your language setting and who your invitation came from. You sign in with a passkey: we only hold a public key. Face ID or your fingerprint never leaves your device. We don't need an email address or phone number. To keep you signed in, the app sets a technically necessary session cookie (§ 25(2) no. 2 TDDDG). The legal basis is your use of the app (Art. 6(1)(b) GDPR).

Profile, measurements and photos of you

For the try-on, you upload photos of yourself. For the fit grid, you enter body measurements (for example the height of your shoulders, waist and knees), plus sizes per brand and, if you want to use the weather, your city. Every photo is saved afresh when it's uploaded; location data and other metadata are removed in the process. Nobody but you sees photos of you.

Wardrobe, outfits and try-ons

We store your clothing photos and what was recognised about them (type, colour, brand, size), your notes, folders, outfits, how often you've worn a piece, shop links, your try-on images and favourites, as well as your requests and feedback to the stylist. If you adjust a suggestion, we remember your note on it and which pieces you swapped, so that the stylist learns your taste.

Friends

Friendships only come about through a link you send yourself. A friend only sees your wardrobe if you switch it on for her – as cut-outs, without notes or original photos. Clothing images you send reach her as a copy. Try-on images are only shown to her; you can take them back at any time. Polls disappear for everyone after 30 days. If a friendship ends, we delete everything you've sent each other, including comments. The app can't prevent screenshots.

Notifications

You switch notifications on yourself (Art. 6(1)(a) GDPR) and can switch them off again at any time. They're delivered via your device's push service (Apple, Google or Mozilla). The content is encrypted for this service and only contains a first name, the weather, a short greeting or the status of a report – never photos or wardrobe data.

Protection against misuse

To slow down too many sign-in attempts, for example, we briefly process your IP address in the server's memory. In error logs, it only appears as a shortened, encrypted identifier. These logs have a fixed maximum size, and older entries are continuously overwritten (Art. 6(1)(f) GDPR).

Feedback and reports

You can write to us via “Give feedback” in your profile. We store your text, what it's about (idea, bug, praise, other), the time and your account, in order to improve the app (Art. 6(1)(f) GDPR).

You can report other people's content – a comment, an image, a poll, a wardrobe item or a person – to us with “Report”. For this, we store who reported what, the reason, your description and a snapshot of the content: text, title or name and a reference to the photos. We don't copy the photos themselves. Until we've made our decision, for 30 days at most, we can view the reported photos, even if they've been taken back in the meantime. If the owner deletes a photo or her account, it's gone for us too. Only the Ayna team sees reports. We don't tell anyone who made a report; with something only two people can see, however, it can be inferred. We review reports in order to take action against illegal content and breaches of the terms of use (Art. 6(1)(c) GDPR in conjunction with Art. 16 and 17 of the Digital Services Act, and Art. 6(1)(f) GDPR). If we remove content, the person it came from receives a statement of reasons in the app, stating the type of content and the reason. You'll also see the outcome of your report in the app and, if notifications are switched on, as a push notification as well.

4. Who receives data from us

Part of the app only works with specialised services. Each of them only receives what it needs for its task.

Transfers to third countries. Norway is part of the European Economic Area, where the GDPR applies. For the United Kingdom, the EU Commission has found an adequate level of data protection. With Anthropic, a data processing agreement with EU standard contractual clauses applies (Art. 28 and Art. 46(2)(c) GDPR). The transfer to fal in the USA is based on your explicit, voluntary consent, which you give when you register or before your first try-on and can withdraw at any time (Art. 49(1)(a) GDPR). There is no adequacy decision for fal. It is therefore possible that US authorities access this data and that you have less legal protection against this than in the EU. Without this consent, no try-on is possible.

5. How long we store data

6. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future. To do so, write to us at info@yl-solutions.de.

You can also lodge a complaint with a data protection supervisory authority, for example the one responsible for us: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart.

7. Other

Ayna is for people aged 18 and over. The stylist's suggestions and the fit information are recommendations; we don't make any automated decisions that affect you legally (Art. 22 GDPR). You don't have to give us any data – but the try-on doesn't work without photos.