BagSuggestions
Try on looks

Privacy policy

Last updated: October 6, 2026

Who is responsible

The controller for the personal data processed on bagsuggestions.com is the operator of BagSuggestions, reachable at hello@accessorysuggestions.com.

BagSuggestions belongs to a family of sites run by the same operator (hatsuggestions.com, glassessuggestions.com, outfitsuggestion.com, accessorysuggestions.com, bagsuggestions.com, watchsuggestion.com, colorsuggestions.com). They share one account system: the same account, credits and selfies work on every one of them. For any privacy question, write to hello@accessorysuggestions.com.

What we process and why

Selfies and try-on images

To create a try-on you upload a photo of yourself (a face shot or a full-body shot), which we call a selfie. We send it to an AI image model together with the style you chose and store both your selfie and the resulting try-on image in your account, so you can see and reuse them on every site of the family. We keep your selfies until you delete them — one by one in your Suite, or all at once by deleting your account. Try-on images are kept the same way. We use your photos only to produce the results you ask for; we do not sell or publish them, and we do not use them to train AI models. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

Your account and email address

You sign up and log in with your email address and a one-time code we email to you (valid for 10 minutes). For your account we store your email address, the site you signed up on, your country (derived from your IP address at signup; it decides your currency and how we ask for email consent), your style preference if you give one, and your credit balance with its history. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

Style emails

We occasionally email style ideas that link back to your Suite. If you sign up from the EU/EEA, the UK, Switzerland or Canada, we send them only if you tick the box at signup (consent, Art. 6(1)(a) GDPR). Elsewhere we tell you at signup that you will receive them. Every one of these emails has an unsubscribe link (one button on the page it opens; mail programs that offer one-click unsubscribe use it too), which stops them from every site of the family; we also stop after several emails you do not engage with. We record each consent decision (the wording you saw, your country and the time) and which emails we sent, so we can show why you received them.

Purchases

Credits are sold in packs through Stripe Checkout. Stripe processes your payment details; we never see your card number. We receive the confirmation of your payment, the pack and the amount, and add the credits to your account. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR) and our accounting obligations (Art. 6(1)(c) GDPR).

Login cookie and browser storage

When you log in, we set one cookie that keeps you logged in on this site for up to 90 days. Your browser also stores a few settings for this site locally, such as your analytics choice and a try-on waiting for you to sign up. Both are strictly necessary for the service you ask for and need no consent.

Security

We process IP addresses to stop abuse, for example to limit how many login codes can be requested. These counters expire automatically within hours. Legal basis: our legitimate interest in a secure service (Art. 6(1)(f) GDPR).

Analytics

Each site of the family uses its own Google Analytics 4 property with Google Consent Mode v2. If you visit from the EU/EEA or the UK, we ask you first: until you accept, no analytics cookies are set and Google receives only cookieless signals. Elsewhere, analytics cookies are enabled when the page loads. When you buy credits, our server reports the purchase (pack, amount and a pseudonymous account ID) to the Google Analytics property of the site you bought on. Legal basis where we ask: your consent (Art. 6(1)(a) GDPR), which you can withdraw by clearing this site's data in your browser.

Links to shops

Our roundups link to shops that sell the products we list. Following such a link takes you to the shop's own website, where its privacy policy applies. We pass no personal data to the shop; your browser tells it which page you came from, as it does for any link.

Processors and other recipients

We use these service providers, which process data on our behalf or, for payments, under their own terms:

Some of these providers process data in the USA. Where a provider is certified under the EU–U.S. Data Privacy Framework, transfers rely on that adequacy decision; otherwise on the EU Standard Contractual Clauses.

If we sell or transfer bagsuggestions.com to another company, we hand that company this site's share of the data so it can keep running the site: the accounts of people who signed up or used the service here, the selfies and try-ons made here, the credit history of credits bought or spent here, and this site's consent records and email log. The buyer then becomes the controller for that data. Legal basis: our legitimate interest in being able to sell a site (Art. 6(1)(f) GDPR).

How long we keep your data

Deleting your account in your Suite erases your account, selfies, try-ons, credit history and consent records on every site of the family at once. Stripe keeps its own payment records as financial and tax law require.

Your rights

You have the right to access, rectify and erase your data, to restrict or object to its processing, and to receive it in a portable format. You can withdraw a consent at any time without affecting earlier processing. Write to hello@accessorysuggestions.com. You may also complain to a data protection authority — in Austria the Datenschutzbehörde (dsb.gv.at) — or the one where you live. We make no automated decisions that have legal or similarly significant effects on you.