App Privacy Policy

RENDERED FITS LTD
App Privacy Policy

For the Rendered Fits Virtual Try-On Application




Version 1.5
Last updated: 30 October 2026



Rendered Fits Ltd
Company No. 16922551 | VAT No. 510026164
50-54 Oswald Road, Scunthorpe, North Lincolnshire, DN15 7PQ
mail@renderedfits.com | renderedfits.com

Privacy Policy

Version 1.5
Last updated: 30 October 2026

1. Introduction
This Privacy Policy explains how Rendered Fits Ltd (“we”, “us”, “our”, or the “Company”) collects, uses, stores, shares, and protects personal information in connection with the Rendered Fits virtual try-on application (the “App”). The App is available to Shopify merchants (“Merchants”) via the Shopify App Store and provides an AI-powered virtual try-on feature for the Merchant’s customers (“End Users” or “Customers”).
This Privacy Policy applies to all personal information we process in connection with the App, including information relating to Merchants and their Customers. This Privacy Policy should be read in conjunction with our Merchant Terms and Conditions and our Data Processing Agreement.
We are committed to protecting the privacy and security of personal information. We process personal data in accordance with the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018, the EU General Data Protection Regulation (“EU GDPR”), the California Consumer Privacy Act/California Privacy Rights Act (“CCPA/CPRA”), and all other applicable data protection and privacy laws.

2. Who We Are
Data Controller and Data Processor
The role we play in relation to personal data depends on whose data is being processed:
•	For Merchant account data (shop domain, billing information, usage analytics): We act as a data controller, meaning we determine the purposes and means of processing this data.
•	For End User data processed through the Virtual Try-On Feature (customer photographs, IP addresses, session identifiers): We act as a data processor on behalf of the Merchant, who is the data controller. Our processing of End User data is governed by our Data Processing Agreement with the Merchant.

Our details:
Rendered Fits Ltd
Company Registration Number: 16922551
Registered Office: 50-54 Oswald Road, Scunthorpe, North Lincolnshire, DN15 7PQ, United Kingdom
Email: mail@renderedfits.com
ICO Registration Number: ZC139559 (register entry: https://ico.org.uk/ESDWebPages/Entry/ZC139559)

3. Information We Collect
We collect and process the following categories of personal information:

3.1 Information Collected Through Shopify’s APIs (Merchant Data)
When a Merchant installs the App, we collect the following information through Shopify’s APIs:
•	Shop domain and shop ID — used for App authentication, billing, and account identification. Where a sole trader operates the store, this may constitute personal data.
•	Subscription and billing plan data — collected via the Shopify Billing API, including plan tier, usage limits, and billing period. Used to manage the Merchant’s subscription and enforce plan limits.
•	App subscription status — received via the APP_SUBSCRIPTIONS_UPDATE webhook. Used to manage billing cycle resets and usage limit enforcement.
•	Order identifiers — received via the orders/create webhook, including order ID, cart token, and product handles. Used solely for the purpose of attributing completed purchases to virtual try-on sessions (conversion tracking).
We also handle Shopify’s mandatory GDPR compliance webhooks: customers/data_request, customers/redact, and shop/redact.

3.2 Information Collected Directly from Merchants
We do not ask Merchants for separate contact details or registration information. Authentication is handled entirely through Shopify’s OAuth 2.0 Token Exchange, and Merchants access the App directly from their Shopify Admin.
The App generates automated usage logs related to the Merchant’s use of the App:
•	Number of AI image generations consumed against the Merchant’s plan limit
•	Aggregated analytics data, including virtual try-on conversion rate, attributed revenue, and conversion comparison metrics
These logs are used solely to display the Merchant’s analytics dashboard and enforce billing plan limits.

3.3 Information Collected from End Users (Customers)
When a Customer uses the Virtual Try-On Feature on a Merchant’s store, we collect the following:

Data Type	Purpose	Retention
Customer-uploaded photograph	Processed by the AI Service to generate a virtual try-on image. The photograph travels from the Customer’s browser to the Shopify app proxy (Shopify Inc. transits the request), then to our backend hosted on Google Cloud Platform in the europe-west2 (London, UK) region, and from there to the AI Service.	Stored temporarily. We intend to delete them from our storage after 1 day, and we aim for this to happen within 48 hours. This is a target we are still putting in place, not a guarantee.
IP address	Used solely for rate limiting (e.g., maximum generations per IP per day) to prevent abuse and protect system resources.	Session-scoped. Stored temporarily in the application’s rate-limiting system and expires automatically when the session ends.
Visitor identifier (rf_id / rf_vid)	A random identifier held in the Customer’s browser to join a try-on to a later purchase on the same store (conversion attribution). It is created and kept only when the Merchant’s own cookie banner, read through Shopify’s Customer Privacy API, reports that analytics are allowed; otherwise a page-view-only value is used and the visitor identifier is not stored. We keep a record of that consent state (see Section 14).	rf_id cookie: 24 hours from last activity. rf_vid (localStorage): 30 days from last activity. See Section 9.
Order-related identifiers (order ID, cart token)	Received via Shopify webhooks for the limited purpose of attributing completed purchases to virtual try-on sessions, enabling Merchants to measure ROI.	Retained as aggregated analytics for the duration of the Merchant’s active subscription. Individual identifiers are not retained beyond the attribution window.
Product handles in Shopify cart attributes	Stored to enable conversion tracking between virtual try-on sessions and completed purchases.	Session-scoped, managed through Shopify’s cart attribute system.
Body measurements for size recommendation (height, weight, gender presentation, fit preference, and optionally age, chest, waist, hip, inseam, underbust, shoe size and cup) — provided optionally by the Customer	Used to generate an AI size recommendation for the selected product. Sent from the Customer’s browser via the Shopify app proxy to our backend.	Recommendation results are cached in Redis keyed by product and measurement combination for up to 7 days. The recommendation record (measurements, product, size shown, and the visitor or customer identifier where one was allowed) is held with the size recommendation. Separately, an anonymised fit corpus row is written at the time of the recommendation (see Section 20.3): measurements are banded (for example height to the nearest 5 cm, weight to 5 kg, age to 10 years), the week rather than the time is kept, and no identifier is stored.
Saved measurement profile (logged-in Customers who choose “save my profile”)	Stored against the Customer’s customer ID for that store only, so returning Customers do not need to re-enter measurements. We act as the Merchant’s processor for this data.	Retained until deleted via Shopify’s customers/redact webhook or upon App uninstallation (shop/redact). Disclosed via Shopify’s customers/data_request webhook.

When you use virtual try-on, your photo is used only to create your try-on image. We store your photo and the generated image temporarily. We intend to delete them from our storage after 1 day, and we aim for this to happen within 48 hours. This is a target we are still putting in place, not a guarantee. Links to view or share a generated image expire after 15 to 60 minutes. To create the image, your photo is sent to our AI provider, Google (Gemini Developer API). Google keeps the photo and the generated image for up to 55 days for abuse monitoring. Our system logs are kept for up to 30 days. Our database backups are kept for up to 30 days and hold references to stored files, not the files themselves. A copy of your photo may be kept in your own browser on your device. It is removed 30 days after you last saved it (the next time the page is used after that), or sooner if you withdraw consent. Google separately states that the Gemini Developer API retains prompts, contextual information and outputs for fifty-five (55) days for abuse monitoring. For this service, the API request contains the submitted photograph and the response contains the generated output. This provider-controlled retention is outside our storage target. Google states that paid-service prompts and responses are processed under its Data Processing Addendum for Products Where Google is a Data Processor (https://business.safety.google/processorterms/), and may be transiently stored or cached for safety, policy enforcement and required legal or regulatory disclosures in any country where Google or its agents maintain facilities. Sources: https://ai.google.dev/gemini-api/terms, https://ai.google.dev/gemini-api/docs/usage-policies and https://ai.google.dev/gemini-api/docs/zdr.

On-device face detection: before any photograph is uploaded, the widget runs an automated face-detection check (face-api.js) entirely within the Customer’s browser, solely to confirm that the photograph contains exactly one face and to work out where to place it on screen. This check runs on the Customer’s own device; no facial geometry, template, or measurement is transmitted to or stored by the Company. The number of faces found is discarded straight away. The on-screen position of the face, used only to place your photo, is kept with your saved photo in your browser’s storage on your device for up to 30 days unless you clear it (see section 14), and is never sent to us. The face-detection model files are loaded from a third-party content delivery network (jsDelivr). It can see your IP address and browser details when your browser fetches those files, as any file host can, but it does not receive your photo.
A copy of your photo may be kept in your own browser on your device. It is removed 30 days after you last saved it (the next time the page is used after that), or sooner if you withdraw consent. See Section 14 for the full inventory of browser storage and cookies.

3.4 Information We Do NOT Collect
We want to be clear about the data we do not collect or process through the standard Virtual Try-On Feature. (The one exception is the optional Fit Passport described in Section 19: if — and only if — a Customer chooses to add an email address to a Fit Passport, we collect it to operate that account. A Customer can save a Fit Passport without an email address; a Customer who does not create one is never asked for an email address, and the list below applies in full.)
•	Customer names
•	Customer email addresses (except where a Customer adds one to an optional Fit Passport — see Section 19)
•	Customer postal addresses
•	Customer payment or financial details
•	Third-party, advertising, or tracking cookies (see Section 14 for the first-party cookies and browser storage the App does use)
•	Browsing history or navigation data
•	Behavioural tracking data
•	Facial recognition data: we do not use Customer photographs to recognise or identify anyone. Before upload, a check runs in the browser to confirm the photo shows one face; its result is not sent to us.

4. How We Use Information
All personal information we collect is used exclusively for the following purposes:
•	Generating AI virtual try-on images for Customers
•	Providing optional AI size recommendations based on measurements the Customer chooses to provide, and improving the accuracy of those recommendations using anonymous prediction records
•	Providing and operating the App for Merchants
•	Managing Merchant subscriptions, billing, and plan enforcement
•	Enforcing rate limits to prevent abuse
•	Attributing conversions to enable Merchants to measure the ROI of the Virtual Try-On Feature
•	Displaying analytics and usage data on the Merchant’s dashboard
•	Complying with Shopify’s mandatory GDPR webhooks (customer data request, customer data erasure, shop data erasure)
•	Keeping a pseudonymous record of Fit Passport consent and the visitor-cookie choice, and of erasures we have carried out, so that we can demonstrate compliance (Article 5(2) and 7(1) UK GDPR)
•	Maintaining the security and integrity of the App

We do not use any collected data for:
•	Advertising or ad targeting
•	Marketing or promotional purposes
•	Profiling or automated decision-making
•	Selling, renting, leasing, or trading to third parties
•	Training third-party or generative AI models on personal data. We never use your photograph to train any AI model. We do use anonymous and aggregated fit outcomes — such as which sizes are kept or returned — to improve the accuracy of our own size and fit predictions, as described above. This is statistical improvement of our recommendation engine; it does not train generative image models and produces no output about any individual.

5. Legal Basis for Processing
Under the UK GDPR and EU GDPR, we must have a valid legal basis for processing personal data. The legal bases we rely on for each category of processing are set out below:

Processing Activity	Legal Basis (Article 6 UK GDPR)	Additional Basis (if applicable)
Processing Merchant account data (shop domain, billing, subscription)	Article 6(1)(b) — Performance of a contract (the Merchant Agreement)	N/A
Processing Merchant usage analytics	Article 6(1)(f) — Legitimate interests (providing dashboard analytics and enforcing plan limits)	N/A
Processing End User photographs for virtual try-on image generation	The notice shown with upload is: "By uploading a photo you agree to our Terms and Privacy Policy."	See Section 6
Processing End User body measurements for AI size recommendations	Article 6(1)(a) — Consent (the shopper provides the measurements)	N/A
Processing End User IP addresses for rate limiting	Article 6(1)(f) — Legitimate interests (preventing abuse and protecting system resources)	N/A
Processing End User session IDs for conversion attribution	Article 6(1)(f) — Legitimate interests (enabling Merchants to measure ROI)	N/A
Processing order identifiers for conversion attribution	Article 6(1)(f) — Legitimate interests (enabling Merchants to measure ROI)	N/A
Responding to GDPR compliance webhooks	Article 6(1)(c) — Legal obligation (compliance with data protection laws)	N/A

Where we rely on legitimate interests as a legal basis, we have conducted a balancing assessment to ensure that our interests do not override the rights and freedoms of the individuals concerned. Details of these assessments are available upon request.

6. Upload notice
The upload notice reads: "By uploading a photo you agree to our Terms and Privacy Policy."
7. Sharing and Disclosure of Personal Information
We do not sell, rent, lease, trade, or otherwise commercially exploit personal information. We share personal information only in the following limited circumstances:

7.1 Third-Party Service Providers (Sub-Processors)
We use the following third-party service providers who may process personal information on our behalf:

Sub-Processor	Purpose	Data Processed	Location
Google LLC (Gemini Developer API)	AI image generation; Google documents 55-day retention of prompts, contextual information and outputs for abuse monitoring	Customer photographs, product images and generated outputs	Provider-managed processing; abuse-monitoring data may be transiently stored or cached in any country where Google or its agents maintain facilities
Google Cloud Platform	Cloud infrastructure: application servers, Cloud SQL database (with automated backups), Cloud Storage (temporary photo cache and Fit Passport photographs), Pub/Sub and Cloud Functions (render queue), Cloud Logging	Temporary photo cache, application data, database records and their backups, operational logs	europe-west2 (London, UK)
Shopify Inc.	Platform hosting, authentication, billing, webhooks; transits Virtual Try-On requests (photographs and body measurements) between the Customer’s browser and our backend via the Shopify app proxy	Merchant account data, order identifiers, try-on request data (in transit only)	Canada / United States
Transactional email provider (SMTP)	Delivery of Fit Passport sign-in links and codes only	Fit Passport email address, sign-in link	As recorded in our sub-processor register

All sub-processors are bound by contractual obligations to process personal information only in accordance with our instructions and applicable data protection laws. We maintain an up-to-date sub-processor register which is available upon request.

The face-detection model files used on your device are loaded from jsDelivr, a content delivery network. It sees your IP address and browser details when files are fetched. It does not receive your photo.

Generated try-on images are also made available to the shopper who requested them and, where the merchant’s integration requests it, to the merchant whose store it is, through time-limited links.


7.2 Other Disclosures
We may also disclose personal information where:
•	Required by law, regulation, court order, or governmental or regulatory authority
•	Necessary to protect our rights, property, or safety, or the rights, property, or safety of others
•	In connection with a merger, acquisition, reorganisation, or sale of all or substantially all of our assets, in which case the acquiring entity will be bound by this Privacy Policy

8. International Data Transfers
Personal information processed through the App may be transferred to and processed in countries outside the United Kingdom and the European Economic Area (“EEA”), including to:
•	Rendered Fits application servers and Cloud Storage — hosted in Google Cloud region europe-west2 (London, UK)
•	Google Gemini Developer API — provider-managed processing with no verified UK/EU-only restriction; Google states that paid-service abuse-monitoring data may be transiently stored or cached in any country where Google or its agents maintain facilities
•	Shopify servers — located in Canada and the United States

Where personal data is transferred outside the UK or EEA, we ensure that adequate safeguards are in place in accordance with applicable data protection laws. These safeguards include:
•	The UK International Data Transfer Agreement (UK IDTA) or the UK Addendum to the EU Standard Contractual Clauses, where applicable
•	The European Commission’s Standard Contractual Clauses (SCCs) for transfers from the EEA
•	Adequacy decisions, where the destination country has been recognised as providing an adequate level of data protection
•	Additional technical and organisational measures, including encryption in transit and at rest, and transient-only processing of sensitive data

Google LLC participates in the EU-U.S. Data Privacy Framework, which has been recognised as providing adequate protection by the European Commission. Further details on our international transfer safeguards are available upon request.

9. Data Retention
We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:

Data Type	Retention Period	Deletion Method
Customer photographs and generated images (standard try-on)	Stored temporarily. We intend to delete them from our storage after 1 day, and we aim for this to happen within 48 hours. This is a target we are still putting in place, not a guarantee.	Intended deletion from Google Cloud Storage after 1 day.
Gemini Developer API request and response data	Google keeps the photo and the generated image for up to 55 days for abuse monitoring. Google states that prompts, contextual information and outputs are retained for fifty-five (55) days for abuse monitoring. This is provider-controlled retention outside the Rendered Fits storage target.	Google-controlled abuse-monitoring retention; see https://ai.google.dev/gemini-api/docs/usage-policies and https://ai.google.dev/gemini-api/docs/zdr
Download/share links for generated looks	Served via signed links that expire after 15 to 60 minutes. Once the underlying image is deleted, shared links stop working. Images a Customer downloads are the Customer’s own copy on their own device.	Automatic expiry of signed URL; lifecycle deletion of underlying object
Size recommendation cache	Recommendation results are cached in Redis, keyed by product and measurement combination, for up to 7 days.	Automatic expiry (Redis TTL)
Size recommendation records (measurements, product, size shown, visitor or customer identifier where allowed)	Held with the size recommendation.	Identified records are cleared on customers/redact and shop/redact.
Anonymised fit corpus (Section 20.3)	Kept for as long as we operate the size-recommendation service. It contains no identifier: measurements are banded, timing is the ISO week, and the temporary link to the recommendation record is cut when the order outcome is known, on erasure, and in any event after 90 days.	Not personal data once the link is cut; the Merchant’s store reference is removed on shop/redact.
Saved measurement profiles (logged-in Customers who opt in)	Retained against the Customer’s customer ID for that store only, until deletion is requested.	Deleted via Shopify’s customers/redact webhook or upon App uninstallation (shop/redact)
Widget event and try-on conversion records (which surfaces were shown or used, keyed by the visitor identifier)	Held with the event record.	Cleared on customers/redact for the visitor identifiers linked to that Customer.
IP-based rate-limit records	Session-scoped. Stored in the application’s rate-limiting system and expire automatically.	Automatic expiry
Copy of a photograph in the Customer’s browser	A copy of your photo may be kept in your own browser on your device. It is removed 30 days after you last saved it (the next time the page is used after that), or sooner if you withdraw consent.	Removal on the next use of the page after that period, or on withdrawal of consent. The visitor identifier is removed by the widget when the Merchant’s banner reports a refusal
Fit Passport data (Section 19)	No fixed limit: kept until the Customer deletes the passport, withdraws consent or asks us to delete it.	Deleted from our live systems when the Customer does so. Copies in database backups expire within 30 days.
Database backups	Our database backups are kept for up to 30 days and hold references to stored files, not the files themselves.	Automatic expiry.
Operational logs (Google Cloud Logging)	Our system logs are kept for up to 30 days.	Automatic expiry (log bucket retention).
Consent and erasure records	We keep consent and erasure records for at least 6 years for the Fit Passport and the visitor-cookie choice.	Kept.
Merchant billing and subscription data	Retained for the duration of the Merchant’s active subscription	Deleted upon app uninstall in accordance with Shopify’s GDPR webhook requirements (shop/redact)
Merchant aggregated analytics data	Retained for the duration of the Merchant’s active subscription	Deleted upon app uninstall in accordance with Shopify’s GDPR webhook requirements (shop/redact)

10. Your Rights
Under applicable data protection laws, individuals have the following rights in relation to their personal information:

Right	Description
Right of access	You have the right to request a copy of the personal information we hold about you.
Right to rectification	You have the right to request that we correct any inaccurate or incomplete personal information.
Right to erasure	You have the right to request that we delete your personal information, subject to certain legal exceptions.
Right to restriction of processing	You have the right to request that we restrict the processing of your personal information in certain circumstances.
Right to data portability	You have the right to receive your personal information in a structured, commonly used, and machine-readable format, and to transmit it to another controller.
Right to object	You have the right to object to processing based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds.
Right to withdraw consent	Where processing is based on consent, you have the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal.
Right not to be subject to automated decision-making	You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. We do not make such decisions.

How to exercise your rights:
•	Merchants: Contact us at mail@renderedfits.com with your request.
•	End Users (Customers): In the first instance, please contact the Merchant whose store you used the Virtual Try-On Feature on, as the Merchant is the data controller for standard try-on data. For Fit Passport data, Rendered Fits Ltd is the controller (Section 19). You may also contact us directly at mail@renderedfits.com and we will assist in facilitating your request.

We will respond to all data subject requests within one (1) month of receipt, or within the timeframe required by applicable law. In complex cases, we may extend this period by up to two (2) additional months, and we will inform you of any such extension and the reasons for it.
For access requests we produce a machine-readable export of every record we hold against the identifiers concerned (measurement profiles, size-recommendation records, widget events, order attribution, Fit Passport data, visitor-cookie choices, and erasure records), and for erasure requests we issue an internal erasure receipt listing what was removed. Erasure requests made through a Merchant are actioned by Shopify’s customers/redact webhook without any further step on your part.

11. Additional Information for US Residents
11.1 Biometric Information Notice (All US States)
This section provides additional information for residents of the United States regarding the processing of biometric data through the Virtual Try-On Feature.
When you upload a photograph to the Virtual Try-On Feature, our AI technology analyses the facial features and body shape in your photograph to generate a virtual try-on image. To the extent that this processing may involve biometric identifiers or biometric information as defined under applicable state law, the following applies:
a)	What is collected. Your photograph, which contains your facial image, is transmitted to the AI service for processing. The AI analyses the visual content of your photograph, including your facial features, to generate the composite try-on image.
b)	Before upload, a check runs in your browser to confirm the photo shows one face; its result is not sent to us. We do not use your photo to recognise or identify you.
c)	Purpose. Rendered Fits processes your photograph to generate the virtual try-on image you requested and does not use it for identification, verification, surveillance, profiling or advertising. Google separately states that it logs paid-service prompts and responses to detect and prevent policy violations, maintain service safety and security, and make required legal or regulatory disclosures.
d)	Retention and destruction. When you use virtual try-on, your photo is used only to create your try-on image. We store your photo and the generated image temporarily. We intend to delete them from our storage after 1 day, and we aim for this to happen within 48 hours. This is a target we are still putting in place, not a guarantee. Links to view or share a generated image expire after 15 to 60 minutes. To create the image, your photo is sent to our AI provider, Google (Gemini Developer API). Google keeps the photo and the generated image for up to 55 days for abuse monitoring. Our system logs are kept for up to 30 days. Our database backups are kept for up to 30 days and hold references to stored files, not the files themselves. A copy of your photo may be kept in your own browser on your device. It is removed 30 days after you last saved it (the next time the page is used after that), or sooner if you withdraw consent. Fit Passport photos are kept only as described in Section 19. Our full retention schedule and destruction procedures are set out in our Biometric Data Retention and Destruction Policy, available at: renderedfits.com/legal/biometric-policy
e)	No sale or disclosure. We do not sell, lease, trade, or otherwise profit from your photograph or any data derived from it. We disclose it to Google’s Gemini Developer API to generate your try-on image. Google processes paid-service prompts and responses under its Data Processing Addendum for Products Where Google is a Data Processor (https://business.safety.google/processorterms/) and separately logs them for the safety, policy-enforcement and legal purposes described in paragraph (c).
f)	Upload notice. The upload notice reads: "By uploading a photo you agree to our Terms and Privacy Policy."
g)	Applicable laws. This notice is provided in compliance with the Illinois Biometric Information Privacy Act (740 ILCS 14) (BIPA), the Texas Capture or Use of Biometric Identifier Act (Tex. Bus. & Com. Code § 503.001), the Washington Biometric Privacy Protection Act (RCW 19.375), and other applicable US state biometric privacy laws.
11.2 California Privacy Rights (CCPA/CPRA)
If you are a California resident, the following additional rights and disclosures apply under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:
a)	Categories of personal information collected. Photographs (which may constitute biometric information and are classified as sensitive personal information under the CPRA), IP addresses (internet or other electronic network activity information), and session identifiers (unique personal identifiers).
b)	Purpose of collection. As set out in Section 4 of this Privacy Policy. We do not use or disclose sensitive personal information for purposes other than those permitted under CPRA Section 1798.121.
c)	Sale and sharing. We do not sell personal information. We do not share personal information for cross-context behavioural advertising.
d)	Right to know. You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you.
e)	Right to delete. You have the right to request deletion of personal information we have collected. We intend to delete your photograph from our storage after 1 day, and we aim for this to happen within 48 hours. This is a target we are still putting in place, not a guarantee, so it may already be gone when we receive your request. Google keeps a copy for up to 55 days for abuse monitoring, which is outside our control.
f)	Right to limit use of sensitive personal information. You have the right to limit the use and disclosure of your sensitive personal information. We already limit use to the purposes disclosed in this Privacy Policy.
g)	Non-discrimination. We will not discriminate against you for exercising any of your CCPA/CPRA rights.
To exercise your California privacy rights, contact us at: mail@renderedfits.com. We will verify your identity before processing your request.
11.3 Other US State Privacy Laws
Residents of other US states with applicable consumer privacy or biometric privacy laws (including but not limited to Colorado, Connecticut, Virginia, Utah, Montana, Oregon, and New Jersey) may have additional rights regarding their personal information. To the extent required by applicable state law, we will honour requests to access, correct, delete, or opt out of the processing of your personal data. To exercise any such rights, please contact us at: mail@renderedfits.com
For full details of our biometric data retention and destruction practices, please refer to our Biometric Data Retention and Destruction Policy at: renderedfits.com/legal/biometric-policy

12. Children’s Privacy
AI size recommendations, virtual try-on and the Fit Passport are intended for people aged 18 or over. Please do not use them, or upload a photo of anyone, if you or they are under 18. This wording does not prevent anyone from contacting support or exercising privacy rights.
If we learn that information about a person under 18 has been submitted, we will restrict further use and handle it in accordance with applicable law and our published retention and deletion processes. If you believe an under-18’s information has been submitted, contact us at mail@renderedfits.com.

13. Data Security
We implement appropriate technical and organisational security measures to protect personal information against unauthorised access, alteration, disclosure, or destruction. These measures include:
•	Encryption of data in transit using TLS/HTTPS
•	Temporary storage of Customer photographs, with deletion intended after 1 day
•	Session-scoped data storage with automatic expiry
•	Authentication via Shopify’s OAuth 2.0 Token Exchange (no separate credentials stored)
•	Rate limiting to prevent abuse and protect system resources
•	Access controls restricting access to personal data to authorised personnel only; administrative operations require scoped, individually issued tokens and are written to an audit log
•	Encrypted, automated database backups with point-in-time recovery, and a documented restore procedure that re-applies erasure records so that deleted data is not brought back
•	Regular review and monitoring of security measures

While we take reasonable steps to protect personal information, no method of transmission over the internet or method of electronic storage is 100% secure. We cannot guarantee the absolute security of personal information.

14. Cookies and Similar Technologies
The App uses a small number of first-party cookies and browser storage items, all of which are functional (no advertising, analytics, or third-party tracking). All device-side items can be cleared by the Customer at any time through their browser settings.

The App shows no cookie banner of its own. The visitor identifier (rf_id and rf_vid) is created and kept only while the Merchant’s own cookie banner, read through Shopify’s Customer Privacy API, reports that analytics are allowed. Until that API is available on the page the visitor identifier is not created; if the Customer refuses or later withdraws through the Merchant’s banner, the identifier is deleted from the cookie, from localStorage and from the Shopify cart, and we record that withdrawal against the identifier so that it is not reused. The photograph copy in the browser is separate: a copy of your photo may be kept in your own browser on your device. It is removed 30 days after you last saved it (the next time the page is used after that), or sooner if you withdraw consent.

Cookies (first-party):
•	rf_id — a first-party attribution/session identifier, valid for 24 hours from last activity. It is also written as a Shopify cart attribute so that the Merchant’s order records reflect try-on involvement.
•	rf_user_rate_limit — a 24-hour fair-use counter used to enforce rate limits.

localStorage (on the Customer’s own device):
•	rf_vid — the same identifier as rf_id, kept for 30 days from last activity so that a return visit can be joined to an earlier try-on; subject to the Merchant-banner condition above.
•	rf_user_photos_v1 — a copy of your photo may be kept in your own browser on your device. It is removed 30 days after you last saved it, together with the point used to position it on screen (the next time the page is used after that), or sooner if you withdraw consent.
•	rf_user_measurements_v2 — the Customer’s saved body measurements.
•	rf_pending_generation_v1 — resume state for an in-progress generation.
•	rf_nudge_last_shown — a timestamp limiting a one-off UI prompt.
•	rf_passport_v1 — the signed-in Fit Passport session token, only if the Customer has created a Fit Passport (Section 19).

sessionStorage (cleared when the browser tab is closed):
•	rf_looks — the Customer’s generated looks for the current browsing session.
•	rf_image_session_v2 — the reference to an in-progress try-on render.
•	rf_entry_sub_ok_v1 — caches the subscription check on collection pages.

We do not log browsing behaviour, store navigation data, or use any form of behavioural tracking.

15. AI-Generated Content Transparency
Virtual Try-On Images produced by the App are generated using artificial intelligence. In accordance with emerging AI transparency regulations, including the EU AI Act (Article 50, effective August 2026):
•	All Virtual Try-On Images are clearly identified to the Customer as AI-generated within the storefront widget
•	Virtual Try-On Images are illustrative only and do not constitute photographs or exact representations of real-world products
•	We will implement machine-readable marking of AI-generated content in accordance with applicable legal requirements as they come into effect

16. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify Merchants of any material changes by email or in-app notification at least thirty (30) days before such changes take effect.
We encourage you to review this Privacy Policy periodically. The “Last Updated” date at the top of this policy indicates when it was last revised. Continued use of the App after changes take effect constitutes acceptance of the updated Privacy Policy.

17. Complaints
If you have any concerns or complaints about our processing of personal information, we encourage you to contact us first at mail@renderedfits.com so that we can try to resolve the matter.
You also have the right to lodge a complaint with a supervisory authority. In the United Kingdom, this is the Information Commissioner’s Office (ICO):
•	Website: ico.org.uk
•	Telephone: 0303 123 1113
•	Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

If you are located in the European Economic Area, you may lodge a complaint with the data protection authority in your country of residence.

18. Contact Us
If you have any questions about this Privacy Policy, our data practices, or wish to exercise your data subject rights, please contact us:

Rendered Fits Ltd
Email: mail@renderedfits.com
Post: 50-54 Oswald Road, Scunthorpe, North Lincolnshire, DN15 7PQ, United Kingdom

19. The Fit Passport (Optional Shopper Account) — Rendered Fits as Controller
19.1 Everything above describes the standard Virtual Try-On Feature, where we act as a processor on behalf of the Merchant and, unless a Customer opts in as described below, do not intentionally retain a standard-flow photograph beyond the transient lifecycle; we intend to delete photos from our storage after 1 day and aim to do so within 48 hours. This is a target we are still putting in place, not a guarantee.
19.2 We also offer an optional shopper account called the Fit Passport. A Fit Passport lets a Customer save their measurements and, if they choose, their photographs, so that they do not have to re-enter them on each store that uses Rendered Fits. It is entirely opt-in and additive: a Customer who does not create one experiences the standard session-only flow and creates no persistent Fit Passport storage; the standard temporary lifecycle still applies.
19.3 Different controller. Because a Fit Passport follows the Customer across multiple Merchants' stores, Rendered Fits Ltd — not any individual Merchant — is the data controller for Fit Passport data. This is a change from the processor role we hold for the standard try-on flow.
19.4 What is stored is consent-gated and granular. A Customer can save their measurements with one tap ("Save my sizes"), which is their opt-in consent, without giving an email address. The Fit Passport is then reopened by a sign-in token kept in the Customer's browser and, where the Customer was logged into the Merchant's own customer account when saving, by a link between the Fit Passport and that account. The link holds only a one-way hash of the Merchant's store and customer number; the Merchant does not receive Fit Passport data through it. A Customer may add an email address at any time (to use the Fit Passport on other stores and receive sign-in links; no password is created). Photographs are stored only after the email address is confirmed and behind their own separate, unbundled, opt-in consent. Fit Passport photos are kept until you delete your passport, withdraw consent or ask us to delete them. Declining either consent does not block the other, and one action deletes everything. Logging into a Merchant's store never opens a Fit Passport that has a confirmed email address.
19.5 If you create a Fit Passport and separately choose to save your photos, Rendered Fits Ltd is the data controller for that data. There is no fixed time limit: we keep your saved measurements and photos until you delete your passport, withdraw your consent or ask us to delete them. When you do, we delete them from our live systems straight away; copies in our database backups expire within 30 days.
19.6 No biometric use. As with the standard flow, we never process passport photographs to identify or recognise anyone. Sign-in is by email link or code, or by logging into the Merchant customer account the Fit Passport was saved with, never by face. Passport photographs are ordinary personal data, not special-category biometric data.
19.7 Data location. Fit Passport data is stored on Google Cloud in the europe-west2 (London, UK) region and does not leave the UK/EU.
19.8 Full details are set out in the separate Fit Passport Privacy Notice, at renderedfits.com/legal/fit-passport-privacy-notice, which governs Fit Passport data and prevails over this policy in respect of the Fit Passport.

20. AI Shopping Assistants and the Rendered Fits API
20.1 Rendered Fits provides an application programming interface (API) and Model Context Protocol (MCP) endpoints that allow a Merchant, or an AI shopping assistant acting for a Customer, to request a size recommendation, a fit answer, or a virtual try-on for a product. Access is authenticated with per-Merchant API keys, and Merchants may expose machine-readable fit information (for example, structured data on a product page) so that AI assistants can answer fit questions about their catalogue.
20.2 Assistants receive answers, never raw personal data. An AI assistant or API caller only ever receives an output — a size recommendation, a fit statement, or a rendered try-on image. A Customer's original photograph and their raw measurements are never disclosed to an AI assistant, a Merchant, or a brand through these interfaces.
20.3 Fit signals from order outcomes — the anonymised fit corpus. To improve the accuracy of size and fit information, we derive aggregate, product-level fit signals (for example, the rate at which a given size is kept or returned, or is exchanged for another size) from Merchants' order and return data, which we already receive to provide conversion attribution. We hold these as an anonymised fit corpus: at the moment a size is shown, a row is written with the product, the Merchant’s store, the ISO week, the measurements the Customer provided rounded to bands (height to 5 cm, weight to 5 kg, age to 10 years, chest, waist, hip and inseam to 4 cm, shoe size to a half size), the size shown and, later, whether that size was kept, returned or exchanged. The row carries no name, email, customer number, visitor identifier or photograph. A temporary link to the identified recommendation record exists only so that the order outcome can be attached; it is cut when the outcome is known, immediately on any erasure request, and in any event after 90 days. Aggregates produced from the corpus suppress small groups so that no output describes fewer than a handful of people. These signals are statistical and product-level; they are not published or shared in a form that identifies any individual Customer. For Merchants, this processing is carried out as their processor under the Data Processing Agreement; the Merchant’s store reference is removed from the corpus if the Merchant uninstalls the App.

End of App Privacy Policy — Version 1.5 · Last updated: 30 October 2026