Privacy template

Who is responsible

Controller name, postal address and privacy contact: [OWNER TO COMPLETE]. This section must be completed before publication. Contact [PRIVACY EMAIL TO COMPLETE] with privacy questions or rights requests.

Information we handle

• Personal app: account email, profile information, uploaded photos, garment images, generated results and preferences needed to provide the private application.
• Merchant enquiries: name, work email, store URL, platform, approximate catalogue size and optional message. The enquiry is delivered by email and is not stored in an in-app CRM in version one.
• Commerce pilots: store identifiers, eligible product and product-image data, integration settings and aggregate usage information received through Shopify or WooCommerce.
• Shopper experience: a consented shopper photo, generated result and short-lived session details needed to create and show the visualisation.
• Operations and abuse prevention: request identifiers, limited service logs, delivery status and short-lived HMAC-hashed IP and email signals. Raw contact IP and email values are not stored in the throttle table.

How and why we use it

We use this information to run the requested application or pilot, create clothing visualisations, synchronise eligible products, respond to enquiries, secure the service, enforce usage limits, diagnose failures and meet legal obligations. The legal bases for each live processing activity must be confirmed during legal review.

AI processing and storage

Depending on the model selected by the merchant, commerce shopper photos and product images are processed using OpenAI or FASHN to create a visual preview and stored using Supabase infrastructure. The precise processor terms, data locations, international-transfer safeguards and production account settings require verification before a live pilot. We do not describe visual results as sizing or exact-fit advice.

Retention and deletion

For the commerce experience, shopper photos are scheduled for deletion after 24 hours and generated results after seven days. Session deletion controls allow earlier deletion, subject to reliable processing and operational safeguards. Product, store and aggregate usage records may be kept while a pilot is active and for a proportionate period afterwards. Short-lived contact throttle records expire after 48 hours. Personal-app retention and operational-log periods require final owner and legal approval.

Who receives information

Relevant service providers may include the merchant platform, OpenAI, FASHN, Supabase, Vercel and Resend. The final subprocessor list, roles, contracts and international-transfer wording must be checked against the production configuration. We do not sell enquiry content or use it for advertising in version one.

Your choices and rights

Depending on your location, you may have rights to access, correct, delete, restrict or object to processing, receive portable data, or complain to a regulator. Contact [PRIVACY EMAIL TO COMPLETE]. We may need to verify a request and cannot promise immediate deletion where safe processing, backups or legal duties require more time.

Security and changes

We use access controls and operational safeguards appropriate to the pilot. This template intentionally makes no unverified promise about encryption, storage geography or absolute security. We will publish a revised date when this notice changes and provide additional notice where required.