Privacy Policy

Ayyüce Turan (HomeVisioner)

Petersstr. 59-61, 47809 Krefeld, Germany

Email: [email protected]

When a shopper uses Aynada through a merchant’s Shopify store, the merchant decides to offer the feature and determines the purposes for which shopper data is processed in connection with its store. In this context, the merchant is generally the data controller and HomeVisioner acts as a data processor on the merchant’s documented instructions. This processing is also governed by the HomeVisioner Data Processing Addendum, which forms part of the agreement between HomeVisioner and the merchant.

HomeVisioner is independently responsible for processing certain data relating to its own business operations, including merchant account administration, billing, service security, and legal compliance.

The merchant’s own privacy policy also applies. Shoppers should contact the relevant merchant first for requests relating to data processed through that merchant’s store. HomeVisioner will assist the merchant where required.

Depending on how Aynada is used, we may process:

• The photo a shopper uploads of themselves to try a product on. It may show the shopper’s body and face;
• A fit or pose hint the shopper may optionally type;
• Product images and product information from the merchant’s Shopify store;
• The AI-generated try-on images created from the shopper’s photo and the product images;
• If the shopper chooses to give it: their email address, their choice about marketing emails, the product tried on, and the time;
• Order information from the merchant’s store, used to show the merchant which orders followed a try-on: order number, date, totals and currency, payment, refund, and cancellation status, the products ordered, the order’s email address, and the cart attributes the try-on window adds;
• Merchant store information, such as the store domain, app settings, plan, and Shopify billing status;
• Technical data, such as IP address, date and time of access, browser type, and security or error logs. To limit abuse, the number of try-ons per shopper or connection is counted under a one-way hashed identifier rather than the IP address itself.

We do not use uploaded photos or generated try-on images to identify individuals, perform facial recognition, or create biometric identifiers.

We process personal data only where necessary for the following purposes:

• Creating the virtual try-on image the shopper asks for;
• Showing the merchant which products were tried on and which orders followed a try-on;
• Passing to the merchant an email address the shopper chose to give;
• Operating, maintaining, securing, and improving Aynada; preventing abuse, fraud, and technical failures;
• Administering merchant accounts and subscriptions and responding to support requests;
• Complying with legal obligations and handling legal claims where necessary.

For merchant account and subscription data, processing may be necessary for the performance of a contract or to take steps before entering into a contract under Article 6(1)(b) GDPR. For service security, fraud prevention, and stable technical operation, we may rely on our legitimate interests under Article 6(1)(f) GDPR.

For shopper photos and try-on images processed through a merchant’s store, the relevant merchant is responsible for determining and communicating the applicable legal basis. Where consent is required, processing takes place only after the required consent has been obtained.

When a photo is chosen, Aynada checks whether it shows a person, inside the shopper’s own browser, using an object-detection model that runs on the device. The photo is not sent to any server for this check. The check only gives guidance: if no person is found, the shopper is told so and can still continue. A face does not need to be visible.

The shopper’s browser downloads the program and model files for this check from jsDelivr and Google. Like any web request, this lets those providers see the shopper’s IP address; they do not see the photo.

The check is not used to identify individuals, perform facial recognition, or create biometric templates.

When the shopper starts a try-on, their photo and the relevant product images are sent to HomeVisioner’s servers and to Google Cloud’s AI services (Vertex AI) only to create the requested try-on image.

HomeVisioner does not use uploaded photos or generated try-on images to train or improve AI models, and does not authorise its service providers or subprocessors, including Google Cloud and Google AI services, to use them for that purpose.

A try-on image is a preview; it is not a guarantee of a product’s fit or size.

The merchant’s authorised users can see in the Aynada app:

• How often each product was tried on, and aggregate analytics;
• For each try-on: the product, the time, and, if the shopper gave one, the email address and marketing choice;
• Orders that followed a try-on: order number, time, and value.

The merchant cannot see the photo a shopper uploaded or the try-on image created from it: Aynada has no gallery of shopper images. The merchant can export the list of try-ons and email addresses as a CSV file and is responsible for the exported data.

A shopper can download their try-on image or share it. Sharing is always started by the shopper: nothing is published unless the shopper uses the share function on their own result.

When a shopper shares a result, the try-on image becomes reachable at an unlisted homevisioner.com web address that contains a randomly generated identifier and is excluded from search-engine indexing. Anyone who receives the link can open the page, so shoppers should only send it to people they intend to show the image to. The page shows the try-on image with the product’s title and a link back to the product; it does not show the shopper’s original photo or any contact details. It stops working when the image is deleted (section 13).

After a shopper’s first free try-on, the try-on window may ask for an email address to continue. A shopper can also leave their email address to be told when try-ons are available again in a store that has used up its allowance; HomeVisioner then sends one email, through Resend, when they are. Addresses that have bounced or asked not to be emailed are not emailed again.

Consent to marketing emails is asked separately, with a checkbox that is not preselected, and may be withdrawn at any time. Marketing emails are sent by the merchant, not by HomeVisioner, and the merchant is responsible for them.

The try-on window keeps a few values in the shopper’s browser: a random visitor identifier, the number of try-ons that day, the email address the shopper gave and for which product, and short-lived session values. It sets a first-party cookie with a random session identifier and adds the try-on’s identifiers to the cart, so that an order can be matched to a try-on. The persistent visitor identifier is used only where the store’s Shopify cookie consent allows analytics.

These values are not used for advertising tracking and can be removed by clearing the browser’s data. A merchant’s store may use its own cookies and consent tools; those are governed by the merchant’s own notices.

We use the following service providers to operate Aynada:

• Shopify, to provide the app within the merchant’s Shopify store and to bill the merchant;
• Google Cloud, including Google AI services (Vertex AI), for AI processing and cloud infrastructure;
• Supabase, for database and image-storage infrastructure in the EU;
• Resend, for service email delivery;
• Crisp, for merchant support chat in the Aynada app;
• Cloudflare, for network security and content delivery of homevisioner.com;
• jsDelivr and Google, to deliver the files of the in-browser photo check (section 5).

These providers process personal data only as necessary to provide their services to us and subject to applicable contractual safeguards. We may also disclose personal data where required by law, to protect legal rights, or to prevent fraud or security incidents. We do not sell personal data and do not disclose it to third parties for their own advertising purposes.

Aynada’s primary application and image-storage infrastructure is operated in European Union regions. We also use established international service providers, including Google Cloud, to deliver the service. Where personal data is transferred outside the European Economic Area, we ensure that an appropriate transfer mechanism is in place, such as an adequacy decision, Standard Contractual Clauses, or another lawful safeguard under applicable data-protection law.

The photo a shopper uploads, the copies of the product images used for the try-on, and the generated try-on image are stored privately and deleted automatically 30 days after the try-on, unless a longer retention period is required by law or necessary for the establishment, exercise, or defence of legal claims. A shared link stops working at the same time.

Records of try-ons and of the email addresses shoppers chose to give, and the matches between try-ons and orders, are kept on the merchant’s behalf for as long as the store uses Aynada, and are deleted as described in section 14. Individual usage events are combined into daily totals and deleted after 60 days.

Merchant account, billing, and transaction-related information may be retained for as long as necessary to provide the service, meet tax or accounting obligations, resolve disputes, and enforce agreements. Technical and security logs are retained only for as long as necessary for security, troubleshooting, and operational purposes.

Aynada handles Shopify’s privacy requests through Shopify’s required privacy webhooks. For a customer data request, we provide the merchant with the data held about that customer. For a customer deletion request, we delete that customer’s try-on images, try-on records, order matches, and email records.

When a merchant removes Aynada from their store, its access to the store ends immediately. Shopify then sends a shop deletion request, and we delete all of that store’s images and records. A merchant may request earlier deletion by contacting [email protected].

Subject to applicable law, individuals may have the right to:

• Access their personal data;
• Request correction or deletion of personal data;
• Request restriction of processing or receive data in a portable format;
• Object to certain processing;
• Withdraw consent at any time, where processing is based on consent; and
• Lodge a complaint with a competent data-protection supervisory authority.

A shopper who used Aynada through a merchant’s store should normally contact that merchant first. Shoppers may also contact us at [email protected]. Aynada does not require an account, so to find the records concerned we need the store, and the email address if one was given, or a share link.

Aynada is meant for adults trying products on with a photo of themselves. Shoppers must not upload a photo of another person without that person’s permission, or a photo of a child.

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration, and disclosure. Images are kept in private storage and shown only through short-lived signed links. No internet-based service can guarantee absolute security, but we take reasonable steps to protect the data processed through Aynada.

We may update this Privacy Policy to reflect legal, technical, or operational developments. The updated version will be published with a revised “Last updated” date.