Last updated: 21 September 2026 (prepared revision)
RENDERED FITS LTD Biometric Data Retention and Destruction Policy Required under Illinois BIPA Section 15(a) — Publicly Available Version 1.3 Revision prepared: 21 September 2026 (Phase 7 data and privacy rebuild) Prior published version last updated: 16 July 2026 Publication URL: renderedfits.com/legal/biometric-policy Rendered Fits Ltd Company No. 16922551 50-54 Oswald Road, Scunthorpe, North Lincolnshire, DN15 7PQ, United Kingdom [email protected] | renderedfits.com BIOMETRIC DATA RETENTION AND DESTRUCTION POLICY Effective Date: February 2026 Revision prepared: 21 September 2026 (prior published version: 16 July 2026) Published at: renderedfits.com/legal/biometric-policy KEY STATEMENT Rendered Fits Ltd does not create or store biometric templates. In the standard Virtual Try-On Feature, customer photographs and generated images are stored temporarily in Google Cloud Storage. We target deletion within 48 hours: live objects become eligible for lifecycle deletion after 24 hours and, because versioning is enabled, noncurrent versions become eligible for permanent deletion one day later. Google Cloud performs lifecycle actions asynchronously, so 48 hours is an operational target, not a guaranteed maximum. This target covers Rendered Fits-controlled Cloud Storage only. Google separately states that the Gemini Developer API retains prompts, contextual information and outputs for fifty-five (55) days for abuse monitoring; no account-specific zero-data-retention exception has been verified. Google states that paid-service abuse-monitoring data may be transiently stored or cached in any country where Google or its agents maintain facilities. No biometric identifiers or biometric templates are extracted, created, or retained on Company systems at any point. An end user may optionally keep a copy of their own photographs saved in their own browser, on their own device, under their sole control. An end user may also choose to save photographs to an optional Fit Passport account; in that case the photographs are stored by the Company for repeat try-ons (see Section 13), but — exactly as with all processing described in this Policy — no biometric identifier or biometric template is ever created, and the photographs are never used to identify, recognise, or authenticate anyone. 1. Purpose and Scope 1.1 This Biometric Data Retention and Destruction Policy ("Policy") is published by Rendered Fits Ltd ("we", "us", "our", or the "Company") in compliance with the Illinois Biometric Information Privacy Act (740 ILCS 14), Section 15(a), which requires a private entity in possession of biometric identifiers or biometric information to develop and make available to the public a written policy establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information. 1.2 This Policy also addresses the requirements of the Texas Capture or Use of Biometric Identifier Act (Tex. Bus. & Com. Code § 503.001), the Washington Biometric Privacy Protection Act (RCW 19.375), and other applicable US state biometric privacy laws. 1.3 This Policy applies to all biometric data that may be processed in connection with the Rendered Fits virtual try-on application (the "App"), which is available to Shopify merchants via the Shopify App Store. 2. Definitions 2.1 For the purposes of this Policy: (a) "Biometric identifier" means a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry, as defined under BIPA Section 10. (b) "Biometric information" means any information, regardless of how it is captured, converted, stored, or shared, based on an individual's biometric identifier used to identify an individual, as defined under BIPA Section 10. (c) "Customer photograph" means a photograph uploaded by an end user (a customer of a Shopify merchant) to the App's Virtual Try-On Feature. (d) "Virtual Try-On Feature" means the functionality of the App that enables end users to upload a photograph of themselves and receive an AI-generated image depicting the end user wearing a product from the merchant's store. (e) "Session" means the period during which an end user actively interacts with the Virtual Try-On Feature, as tracked by a session identifier stored in the end user's browser. (f) "AI Service" means the third-party artificial intelligence service used by the App to generate virtual try-on images. 3. What Biometric Data We Process 3.1 The App processes customer photographs through the Virtual Try-On Feature. In the course of generating a virtual try-on image, the AI Service may analyse the facial features contained in the customer's photograph. To the extent that such processing constitutes the collection of biometric identifiers or biometric information under applicable law, the following applies: Data Type | Description | Biometric Classification Customer photograph (facial image) | A photograph uploaded by the end user, containing the end user's face and body | May constitute a biometric identifier to the extent that facial geometry is analysed by the AI Service during image generation AI processing of facial features | The AI Service analyses the photograph to map the end user's appearance onto product imagery | May constitute biometric information derived from the biometric identifier (facial geometry) Generated virtual try-on image | The AI-generated composite image showing the end user wearing a product | Contains a representation of the end user's likeness but is an AI-generated image, not a biometric template What We Do NOT Process or Store We wish to be unequivocally clear about the following: • Before a photograph is uploaded, the widget runs an automated face-detection check (face-api.js) entirely within the end user's browser, solely to confirm that the photograph contains exactly one face. This detection runs entirely on the end user's own device; no facial geometry, template, or measurement is transmitted to or stored by the Company, and the detection result is discarded immediately. • Beyond that on-device check, we do NOT extract, create, compute, or store any facial geometry template, faceprint, or biometric template from customer photographs at any point during processing — nothing biometric ever reaches Company systems. • We do NOT create or maintain any database of biometric identifiers or biometric information. • We do NOT use facial recognition technology to identify or verify the identity of any individual. • We do NOT compare customer photographs against any database of images or biometric records. • We do NOT use customer photographs or derived data for profiling, automated decision-making, or any purpose other than generating the requested virtual try-on image. 4. Retention Schedule 4.1 The following retention schedule applies to all biometric data and related data processed in connection with the Virtual Try-On Feature: Data Type | Retention Period | Operational Target | Trigger for Destruction Customer photograph (original upload) | Stored temporarily in Google Cloud Storage. Live objects become eligible for lifecycle deletion after twenty four (24) hours; versioned, noncurrent copies become eligible for permanent deletion one day later. | Deletion targeted within forty eight (48) hours; lifecycle processing is asynchronous and can complete later | Live-object age exceeding 24 hours, followed by one day in noncurrent state AI-processed data | Processed in real time within the Gemini Developer API call. Google states that paid-service prompts and responses are not used to improve its products, but that prompts, contextual information and outputs are retained for fifty-five (55) days for abuse monitoring. | API processing takes seconds; provider-controlled abuse-monitoring retention lasts 55 days | Expiry under Google's provider-controlled abuse-monitoring policy Generated virtual try-on image | Stored temporarily in Google Cloud Storage under the same live and noncurrent lifecycle rules. Download/share links are signed URLs valid for 24 hours; ordinary access stops when the signed URL expires or the live object is removed. | Deletion targeted within forty eight (48) hours; lifecycle processing is asynchronous and can complete later | Live-object age exceeding 24 hours, followed by one day in noncurrent state Visitor identifier (rf_id cookie, rf_vid localStorage) | Held in the end user's browser only while the Merchant's cookie banner, read through Shopify's Customer Privacy API, reports that analytics are allowed; on our servers the identifier is cleared from event records after thirteen (13) months and from size-recommendation records after twenty four (24) months | rf_id 24 hours, rf_vid 30 days from last activity | Merchant-banner refusal, end user action (clearing browser data), or the scheduled server-side sweep Optional device-side photo cache | Stored, at the end user's choice, in the end user's own browser (localStorage) on their own device for faster future try-ons. Sent to Company systems only when the end user starts a new try-on. | Until cleared by the end user | End user action (clearing browser data) Consent records, erasure receipts and audit log | Pseudonymous records (a one-way hash of the identifier, the purpose, the notice version, the action and the time — never a photograph, name or email) retained for six (6) years as evidence of compliance | Six years | Age; these records survive Merchant uninstallation and end-user erasure because they are the proof that erasure occurred Database backups | Automated backups of the application database (which holds no photographs; photographs live only in Cloud Storage and are not backed up) with point-in-time recovery for seven (7) days and thirty (30) daily backups | Thirty days | Automatic expiry; a restore re-applies all erasure receipts issued since the backup 4.2 Under no circumstances shall biometric identifiers or biometric information (being customer photographs and any data derived from the AI Service's analysis of facial features) be retained for longer than three (3) years from the date of the individual's last interaction with the Virtual Try-On Feature, which is the maximum retention period permitted under BIPA Section 15(a). Our operational target is deletion within forty eight (48) hours, but Google Cloud lifecycle processing is asynchronous and can complete later. 4.3 In the event that the initial purpose for collecting or obtaining biometric data has been satisfied (i.e., the virtual try-on image has been generated and delivered to the end user's browser), the biometric data shall be destroyed in accordance with the destruction guidelines set out in Section 5 below, regardless of whether the maximum retention period has elapsed. 4.4 The Company-controlled destruction schedule in Section 5 does not shorten Google's separate Gemini Developer API retention. Google states that prompts, contextual information and outputs are retained for fifty-five (55) days for abuse monitoring. For this service, the request contains the submitted photograph and the response contains the generated output. No account-specific zero-data-retention exception or UK/EU-only provider-processing restriction has been verified. Google states that paid-service abuse-monitoring data may be transiently stored or cached in any country where Google or its agents maintain facilities. Sources: https://ai.google.dev/gemini-api/terms, https://ai.google.dev/gemini-api/docs/usage-policies and https://ai.google.dev/gemini-api/docs/zdr. 5. Guidelines for Permanent Destruction 5.1 Automated Storage Lifecycle Deletion Uploaded customer photographs and generated virtual try-on images are stored in Google Cloud Storage. A bucket lifecycle policy configured on that storage: (a) makes each live object eligible for deletion once it is older than twenty four (24) hours; (b) because versioning is enabled, makes the resulting noncurrent version eligible for permanent deletion one day later; lifecycle actions are asynchronous, so the operational target is forty eight (48) hours rather than a guaranteed maximum; (c) applies to both original customer photographs and generated virtual try-on images; and (d) operates automatically at infrastructure level and requires no manual intervention; (e) is held as code in the Company's repository and checked against the live bucket, so that any drift between the published policy and the configured rules is detected; and (f) is verified: for any erasure the Company can list live, noncurrent and soft-deleted objects under the relevant storage prefix and record the result against the erasure receipt, which is marked verified only when the listing is empty. 5.2 AI Service Processing Customer photographs transmitted to the AI Service are used to generate an output during the API request and response. Google states that paid-service prompts and responses are processed under its Data Processing Addendum for Products Where Google is a Data Processor (https://business.safety.google/processorterms/). For paid API usage: (a) Google states that prompts (including customer photographs) and responses (including generated images) are not used to improve its products; (b) generation takes place during the API request and response; and (c) separately from that generation, Google logs paid-service prompts and responses for safety, policy-enforcement and required legal or regulatory purposes. Google documents that prompts, contextual information and outputs are retained for fifty-five (55) days for abuse monitoring and may be transiently stored or cached in any country where Google or its agents maintain facilities, as disclosed in Section 4.4. 5.3 App Uninstallation When a Merchant uninstalls the App from their Shopify store: (a) Shopify triggers a mandatory GDPR shop/redact webhook; (b) the App receives and processes this webhook, deleting all data associated with the Merchant, including any residual session data and analytics data, in one database transaction, and writes an erasure receipt; the pseudonymous consent, receipt and audit records described in Section 4.1 are retained as evidence; and (c) live deletion is completed on receipt of the webhook; copies in automated database backups expire within thirty (30) days. 5.4 Manual Deletion Requests Any individual may request the deletion of their data by contacting the Company at [email protected]. Given the transient nature of our processing, in most cases the data will already have been automatically destroyed before the request is received. Where data has not yet been destroyed, the Company shall process the request without undue delay and confirm deletion in writing. 5.5 Destruction Standard All destruction of biometric data is carried out using methods that render the data permanently irrecoverable. Specifically: (a) lifecycle deletion first removes the live object and then permanently deletes its noncurrent generation after the noncurrent rule becomes eligible; Google Cloud performs both actions asynchronously; (b) session-scoped data stored in the rate-limiting system expires automatically and is overwritten in the normal course of system operation; and (c) the application creates no separate backup, archive, or shadow copy of customer photographs or generated images; Cloud Storage versioning temporarily retains a noncurrent generation until lifecycle deletion completes, and the database backups described in Section 4.1 contain no photographs. (An end user may choose to keep a copy of their own photographs saved in their own browser on their own device; that copy remains under the end user's sole control and can be cleared through their browser settings.); and (d) every erasure carried out by the Company — Merchant uninstallation, a customer erasure request, a Fit Passport withdrawal, or the 18-month Fit Passport inactivity sweep — produces an erasure receipt recording the record types and counts removed and the storage prefixes cleared (as one-way hashes), which the Company can produce on request. 6. Consent and Notice 6.1 Before any customer photograph is collected or processed through the Virtual Try-On Feature, the end user is provided with: (a) written notice (displayed within the Virtual Try-On widget) that facial features contained in their photograph may be analysed in the course of generating the virtual try-on image; (b) written notice that Rendered Fits analyses the photograph to generate a virtual try-on image, together with notice of Google’s separate safety, policy-enforcement and legal processing; (c) written notice that deletion is targeted within 48 hours and that asynchronous cloud lifecycle processing can complete later; (d) written notice that biometric data will not be sold, leased or traded, and that the photograph is disclosed to Google's Gemini Developer API to generate the try-on image subject to Google's stated safety, policy-enforcement and legal processing; (e) a link to this Policy; and (f) a requirement to provide explicit written consent before the photograph upload function is enabled. 6.2 Consent is obtained separately from general terms acceptance through a disclaimer that reads: "By uploading your photo, you agree to our Terms & Conditions and Privacy Policy. Your image is stored temporarily; we target deletion within 48 hours, but cloud lifecycle processing is asynchronous and can complete later. It is never used to train AI models. You can choose to keep a copy saved in your own browser for faster future try-ons." 6.3 The Company does not collect, capture, or otherwise obtain biometric identifiers or biometric information without first providing written notice and obtaining written consent as described above. 7. Prohibition on Sale, Lease, Trade, and Disclosure 7.1 The Company shall not sell, lease, trade, or otherwise profit from any individual's biometric identifiers or biometric information. 7.2 The Company shall not disclose, redisclose, or otherwise disseminate any individual's biometric identifier or biometric information to any third party, except: (a) to Google LLC through the Gemini Developer API to generate the requested virtual try-on image, with the individual's written consent and subject to Google's stated safety, policy-enforcement and legal processing; or (b) as required by law, court order, or valid legal process, provided that the Company shall use reasonable efforts to notify the affected individual before making such disclosure (unless prohibited from doing so by law). 8. Security Measures 8.1 The Company protects biometric data using a standard of care that is the same as or more protective than the standard applied to other confidential and sensitive information, including: (a) encryption of all data in transit using TLS/HTTPS; (b) transient processing with automated deletion (the primary security measure — data that does not exist cannot be breached); (c) access controls restricting access to cloud infrastructure to authorised personnel only; (d) multi-factor authentication for administrative access; (e) use of reputable, audited cloud infrastructure providers (Google Cloud Platform) with ISO 27001, ISO 27017, ISO 27018, and SOC 2 Type II certifications; and (f) contractual data protection obligations imposed on all sub-processors. 9. Data Flow Summary The following describes the complete lifecycle of a customer photograph through the Virtual Try-On Feature: Step | Action | Data Location | Duration 1 | End user views the Virtual Try-On widget and is presented with the consent notice | End user's browser only | Until user action 2 | End user selects a photograph from their device; the widget first checks, entirely within the browser, that the photograph contains exactly one face (the detection result is discarded immediately and never transmitted), then uploads it | On-device check in the end user's browser; upload transmitted from the browser via the Shopify app proxy (Shopify Inc. transits the request) to the App backend (GCP europe-west2, London, UK) via HTTPS | Seconds 3 | Photograph is temporarily stored in cloud storage (GCP) and a session reference is created | GCP Cloud Storage (temporary storage, europe-west2) | Deletion targeted within 48 hours; asynchronous completion can occur later 4 | Photograph is transmitted to the Gemini Developer API along with the selected product image | AI service servers | API call takes seconds; Google states that prompts, contextual information and outputs are retained for 55 days for abuse monitoring 5 | AI service generates the virtual try-on composite image and returns it | AI service servers → App backend | API call takes seconds; provider-controlled abuse-monitoring retention is separate from the Company bucket lifecycle 6 | Generated image is delivered to the end user's browser for display (any copy the end user downloads, or chooses to keep cached in their own browser, is the end user's own copy on their own device) | End user's browser + temporary cloud storage | Deletion targeted within 48 hours; asynchronous completion can occur later 7 | Session expires | N/A | N/A 8 | Lifecycle rules make live objects eligible for deletion after 24 hours and versioned, noncurrent generations eligible for permanent deletion one day later | Deletion from GCP Cloud Storage | Automated; target 48 hours, with asynchronous completion 9 | After lifecycle deletion completes, no standard-flow photograph or generated image remains in the bucket | None | Permanent after completion 10. Applicable Biometric Privacy Laws This Policy is designed to comply with the following US state biometric privacy laws (among others): Law | Jurisdiction | Key Requirements Addressed Illinois Biometric Information Privacy Act (BIPA), 740 ILCS 14 | Illinois | Section 15(a): Written retention/destruction policy (this Policy). Section 15(b): Written notice and written consent before collection. Section 15(c): Prohibition on sale/trade/profit. Section 15(d): Prohibition on disclosure without consent. Section 15(e): Reasonable security. Texas Capture or Use of Biometric Identifier Act (CUBI), Tex. Bus. & Com. Code § 503.001 | Texas | Notice and consent before capture. Prohibition on sale/disclosure. Destruction within reasonable time (our transient processing satisfies this). Storage with reasonable care. Washington Biometric Privacy Protection Act (BPPA), RCW 19.375 | Washington | Notice of collection. Consent before collection. Restrictions on commercial purpose. Security measures. California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA) | California | Biometric information classified as sensitive personal information. Right to know, delete, and limit use. No sale of sensitive personal information. Colorado AI Act (effective Feb 2026) | Colorado | Disclosure requirements for high-risk AI systems using biometric data. Risk management obligations. This list is not exhaustive. The Company monitors developments in US state biometric privacy legislation and will update this Policy as necessary to maintain compliance with new and amended laws. 11. Policy Review and Updates 11.1 This Policy shall be reviewed at least annually by the Company's management to ensure it remains accurate, complete, and compliant with applicable laws. 11.2 This Policy may be updated from time to time. Material updates will be reflected in the "Last Updated" date at the top of this Policy. The Company shall notify Merchants of material changes through in-app notifications or email. 11.3 This Policy is published at renderedfits.com/legal/biometric-policy and is freely accessible to the public at all times, as required by BIPA Section 15(a). 12. Contact Information If you have any questions about this Policy, or wish to exercise your rights in relation to biometric data, please contact: Rendered Fits Ltd Email: [email protected] Post: 50-54 Oswald Road, Scunthorpe, North Lincolnshire, DN15 7PQ, United Kingdom You may also contact the Merchant whose store you used the Virtual Try-On Feature on, as the Merchant is the data controller for your data. 13. Fit Passport (Optional Persistent Photo Storage) 13.1 The App offers an optional shopper account, the Fit Passport, which — only where the end user gives separate, specific consent — stores the end user's photographs so they can be reused for future try-ons instead of following the standard 48-hour deletion target. This is the single exception to the transient-storage rule stated elsewhere in this Policy; it applies only to end users who choose to create a Fit Passport and tick the photo-storage consent box. For the Fit Passport, Rendered Fits Ltd is the data controller. 13.2 The Fit Passport does not change the biometric posture of the App in any respect with which BIPA and comparable laws are concerned: (a) no facial-geometry template, faceprint, or other biometric identifier is created from a passport photograph at any time; (b) passport photographs are never used to identify, recognise, verify, or authenticate any individual — sign-in to a Fit Passport is by email link only, never by face; and (c) passport photographs are never sold, and are never disclosed to any store, brand, AI assistant, or other third party. 13.3 Passport photographs are stored on Google Cloud in the europe-west2 (London, UK) region, and are permanently deleted on request, on deletion of the passport, and automatically after eighteen (18) months without passport activity; each deletion produces an erasure receipt and the storage prefix is verified empty as described in Section 5.1(f). Full details are in the Fit Passport Privacy Notice at renderedfits.com/legal/fit-passport-privacy-notice. End of Biometric Data Retention and Destruction Policy — Version 1.3 — Revision prepared: 21 September 2026; prior published version last updated: 16 July 2026