Last updated: 21 September 2026 (prepared revision)
RENDERED FITS LTD Merchant Terms and Conditions & App Privacy Policy For the Rendered Fits Virtual Try-On Application This document contains: Part 1: Merchant Terms and Conditions (Clauses 1-20 + Schedules) Part 2: App Privacy Policy (Sections 1-17) Version 1.2 Effective Date: Date of First Installation Revision prepared: 21 September 2026 Prior published version last updated: 6 July 2026 Rendered Fits Ltd Company No. 16922551 | VAT No. 510026164 50-54 Oswald Road, Scunthorpe, North Lincolnshire, DN15 7PQ [email protected] | renderedfits.com PART 1: MERCHANT TERMS AND CONDITIONS IMPORTANT Please read these Terms carefully before installing or using the Rendered Fits App. By installing, accessing, or using the App, you agree to be bound by these Terms and the App Privacy Policy set out in Part 2 of this document. These Terms constitute a legally binding agreement between you (the Merchant) and Rendered Fits Ltd (the Company) governing your installation and use of the App on the Shopify Platform. The App is developed and operated by the Company. Shopify Inc. is not a party to these Terms and has no responsibility or liability in connection with the App. In accordance with Shopify's API Terms of Service, the Merchant acknowledges and agrees that: - the Company is solely responsible for the App and its functionality; - Shopify is not liable for any fault in the App or any harm that may result from its installation or use; - except where expressly stated by Shopify, Shopify cannot provide assistance with the installation or use of the App; and - the Company is solely responsible for any liability which may arise from the Merchant's access to or use of the App, including: (A) the development, use or maintenance of the App; (B) any product, content or service made available through the App; and (C) the processing of any data collected or received by the App. 1. Definitions and Interpretation "App" means the Rendered Fits virtual try-on application, including all software, code, interfaces, widgets, and associated documentation made available by the Company through the Shopify App Store. "AI Service" means the third-party artificial intelligence image generation service used by the App to generate Virtual Try-On Images. "Company" means Rendered Fits Ltd, a company incorporated in England and Wales (company number 16922551), whose registered office is at 50-54 Oswald Road, Scunthorpe, North Lincolnshire, DN15 7PQ. "Customer" means any individual who visits or transacts via the Merchant Store, including any end user who interacts with the Virtual Try-On Feature. "Customer Data" means information (including Personal Information) relating to a Customer, including order information, payment information, account information, and any data submitted by or relating to a Customer in connection with the Virtual Try-On Feature. "Data Protection Laws" means all applicable data protection and privacy legislation, including (as applicable) the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), the Illinois Biometric Information Privacy Act (BIPA), and any other applicable data protection or privacy laws. "Effective Date" means the date on which the Merchant first installs the App on the Merchant Store. "Generated Image" means any image produced by the App using the AI Service, including Virtual Try-On Images. "Intellectual Property Rights" means all patents, rights to inventions, utility models, copyright and related rights, trade marks, service marks, trade names, domain names, rights in get-up and trade dress, rights in goodwill, rights in designs, database rights, rights in computer software, rights in confidential information (including know-how and trade secrets) and any other intellectual property rights, in each case whether registered or unregistered and including all applications and rights to apply for and be granted, renewals or extensions of, and rights to claim priority from, such rights and all similar or equivalent rights or forms of protection in any part of the world. "Merchant" means the individual or business entity that installs the App on its Merchant Store and agrees to these Terms. "Merchant Data" means information (including Personal Information) relating to the Merchant or Merchant Store, including business, financial, and product-related data. "Merchant Store" means the Merchant's commerce presence hosted by Shopify, including its online store and Point of Sale (POS). "Personal Information" means any information relating to an identified or identifiable natural person, as defined under applicable Data Protection Laws. "Privacy Policy" means the App Privacy Policy as set out in Part 2 of this document, as updated from time to time. "Shopify" means Shopify Inc. and its affiliates. "Shopify Platform" means the Shopify hosted commerce platform available via www.shopify.com and any associated websites, products, or services offered by Shopify. "Subscription Plan" means the Free or fixed paid subscription selected by the Merchant, including its approved fee, billing interval, features and fair-use processing limits. "Terms" means these Merchant Terms and Conditions, including the Privacy Policy set out in Part 2, any Schedules, and any Data Processing Agreement, as amended from time to time in accordance with Clause 18. "Virtual Try-On Feature" means the functionality of the App that enables Customers to upload a photograph of themselves and receive an AI-generated image depicting the Customer wearing a product from the Merchant Store. "Virtual Try-On Image" means an AI-generated image produced by the Virtual Try-On Feature depicting a Customer wearing a product from the Merchant Store. 2. Licence Grant and Restrictions 2.1 Subject to the Merchant's compliance with these Terms, the Company grants the Merchant a worldwide, non-exclusive, non-transferable, non-sublicensable, revocable licence to install and use the App on the Merchant Store for the duration of the Merchant's active Subscription Plan. 2.2 The Merchant shall not, and shall not permit any third party to: • resell, sublicense, assign, distribute, lease, rent, lend or otherwise commercially exploit the App or any part of it to any third party; • copy, modify, adapt, translate, reverse engineer, decompile, disassemble or create derivative works based on the App or any part of it, except to the extent permitted by applicable law; • use the App on any store, platform or website other than the Merchant's own Merchant Store(s) hosted on the Shopify Platform; • remove, alter or obscure any proprietary notices, labels or marks on the App; • use the App for any unlawful purpose or in any manner that could damage, disable, overburden or impair the App or the Shopify Platform; • use the App to develop a competing product or service; or • use any automated means (including bots, scrapers or similar technology) to access or use the App except as expressly permitted by the App's intended functionality. 2.3 The licence granted under Clause 2.1 is personal to the Merchant and may not be transferred or assigned without the Company's prior written consent. 3. App Description and AI Service 3.1 The App provides an AI-powered virtual try-on feature that enables Customers visiting the Merchant Store to upload a photograph of themselves and receive an AI-generated image depicting the Customer wearing a product from the Merchant's store. Current features include multi-item "Complete the Look" try-on, AI size recommendation (including from Customer-provided body measurements), saved looks, the optional Fit Passport shopper account, and API and AI-assistant access to fit information. In respect of the Fit Passport, the Company acts as an independent data controller (not the Merchant's processor) under its separate Fit Passport Privacy Notice; the Fit Passport is opt-in and additive, and no Customer's raw photograph or measurements are ever disclosed to the Merchant or to any AI assistant — callers receive outputs only, such as a size recommendation or a rendered image. 3.2 The Virtual Try-On Feature is powered by the AI Service. The Merchant acknowledges and agrees that: • Virtual Try-On Images are AI-generated interpretations and are not exact replicas or photographs. The Company does not guarantee 100% visual accuracy, colour fidelity, size accuracy, or likeness; • Virtual Try-On Images are illustrative only and should not be relied upon by the Merchant or its Customers as definitive representations of how a product will look or fit; • the quality, accuracy and availability of the AI Service may vary and is dependent on third-party technology providers. The Company shall use reasonable endeavours to select and maintain high-quality AI service providers; • AI-generated outputs may occasionally produce unexpected, inaccurate or undesirable results, and the Company shall not be liable for any such outputs. 3.3 The Merchant shall not represent or imply to its Customers that Virtual Try-On Images are actual photographs, exact representations, or guarantees of how a product will look or fit. 4. AI Service Availability and Graceful Degradation 4.1 The App incorporates a graceful degradation pattern. In the event that the AI Service is unavailable, experiences downtime, or is otherwise non-operational: • the Virtual Try-On button will be automatically disabled or hidden on the Merchant's storefront; • this behaviour is intentional and is designed to prevent broken functionality or a poor Customer experience; • the rest of the Merchant's store functionality, checkout process, and core Shopify operations shall not be affected; and • the Merchant acknowledges that such temporary disabling of the Virtual Try-On Feature does not constitute a defect in, or breach of contract relating to, the App. 4.2 The Company shall use reasonable endeavours to restore the Virtual Try-On Feature as soon as reasonably practicable following any period of AI Service unavailability. 5. Third-Party Service Providers 5.1 The Merchant acknowledges that the App relies on third-party service providers, including but not limited to: • AI service for AI image generation; • Shopify for platform hosting, billing, authentication, and API access; and • cloud infrastructure providers for hosting and data processing. 5.2 Where any downtime, delay, degradation, failure, error, inaccuracy, or interruption of the App or the Virtual Try-On Feature arises from the acts or omissions of a third-party service provider, the Company shall not be liable for such downtime, delay, degradation, failure, error, inaccuracy, or interruption, provided that the Company has exercised reasonable care in the selection and management of such provider. 5.3 The Company reserves the right to change, replace, or update the third-party service providers used in connection with the App at any time without prior notice to the Merchant, provided that such change does not materially reduce the functionality of the App. 6. Subscription Plans, Billing and Payment 6.1 The App offers Free, Complete and Enterprise plans, with Custom quoted separately. Schedule 1 describes the new public offer. Existing clients retain their agreed plan, recurring price, allowances and trial dates, including at renewal, unless they expressly approve a replacement in Shopify. Publication does not migrate or start billing an existing client. 6.2 Paid plans include the same core features and one Shopify storefront. Included image allowances follow the Shopify subscription cycle. Additional images are off by default and require the Merchant to enable a maximum allowance with its dollar cost disclosed. Successfully delivered additional images cost $0.50 each on Complete or $0.35 on Enterprise. Failed images are not charged. At the limit, new images pause; other included features continue. Unused images do not carry over. Additional allowances reset each cycle unless the Merchant explicitly opts to repeat the allowance. 6.3 Billing is processed through Shopify. Only a paid subscription expressly approved by the Merchant may incur recurring charges, at the amount and interval shown in Shopify. The Free plan incurs no subscription charge. 6.4 The new public offer has no sales-based fees or automatic plan changes. Any replacement plan requires the Merchant's express approval through Shopify, which determines its effective date and applicable billing adjustment. Existing agreed subscriptions continue on their approved terms. 6.5 All fees are exclusive of VAT (or equivalent sales tax). VAT will be charged where applicable, based on the Merchant's location and tax status, in accordance with applicable tax legislation. 6.6 In the event of late or failed payment: • the Company may rely on Shopify's automatic retry mechanism for failed charges; • if payment remains outstanding after Shopify's retry attempts, the Company reserves the right to suspend or restrict the Merchant's access to the App until the outstanding amount is paid; and • the Company shall provide reasonable notice to the Merchant before any suspension for non-payment takes effect, except where suspension is required to prevent further losses. 6.7 Complete offers a fourteen (14) day trial with fifty (50) successfully delivered images in total and no trial overages. Free and Enterprise have no trial. Shopify shows the trial end date and recurring price before approval. Cancel before the trial ends to avoid the subscription charge. Existing agreed trials remain unchanged. 7. Pricing Changes 7.1 The Company may publish revised offers for new subscriptions. Publication does not change an existing Merchant's approved price. The new public offer is billed monthly only. Previously approved annual subscriptions retain their agreed price and term, with no retroactive or catch-up charges. 7.2 The Company shall provide at least thirty (30) days' advance written notice of a proposed price increase for an existing subscription. Notice alone does not authorise a charge. Any plan or price change requires the Merchant's express approval through Shopify. 7.3 Renewal continues on the Merchant's existing approved recurring terms unless the Merchant expressly approves a change. Continued use does not constitute approval of a different price or plan. Cancellation stops future renewal; it does not convert an annual subscription into monthly billing. 8. Merchant Data Ownership and Security 8.1 As between the Company and the Merchant, the Merchant retains all rights, title, and interest in and to the Merchant Data, including all product data, product images, Customer Data, and any other content or data provided by the Merchant to the App. 8.2 The Company does not take ownership of, reuse, or commercially exploit the Merchant's own data, including product data, product images, or Customer information, for any purpose other than providing the App's services to the Merchant. 8.3 The Company shall not use Merchant Data (including any anonymous, aggregate, or derived data) to train third-party or generative artificial intelligence models. The Company may use anonymous, aggregated, and de-identified data derived from use of the App — including product-level fit signals derived from order and return outcomes (for example, the rate at which a size is kept, returned, or exchanged) — to operate, maintain, and improve the accuracy of the App's size and fit recommendation features, including for the benefit of other merchants. Such data is aggregated, does not identify the Merchant or its individual Customers, and is not used to train generative image models. 8.4 The Company processes Merchant Data (including Customer Data) in accordance with the Privacy Policy set out in Part 2 of this document and applicable Data Protection Laws. Where the Company processes Customer Data on behalf of the Merchant, the Company acts as a data processor and the Merchant acts as a data controller. The terms of such processing are set out in the Data Processing Agreement, available at renderedfits.com/legal/dpa. 8.5 The Merchant is responsible for ensuring that it has obtained all necessary consents, authorisations, and legal bases for the collection and processing of Customer Data through its Merchant Store, in accordance with applicable Data Protection Laws. 9. Security Breaches 9.1 In the event of a security breach: • the Company shall only accept responsibility for breaches arising directly from its own systems, infrastructure, and operations; • the Company shall not be responsible or liable for security breaches arising from or relating to: the Merchant's own systems; the Shopify Platform; third-party services not operated by the Company; or the actions or omissions of the Merchant, its employees, or its agents; and • the Company shall notify the Merchant without undue delay upon becoming aware of a security breach affecting the Merchant's data, and shall cooperate reasonably with the Merchant in investigating and remediating any such breach. 10. Merchant Obligations 10.1 The Merchant represents, warrants and undertakes that: • it has full power and authority to enter into these Terms and to perform its obligations hereunder; • it shall comply with all applicable laws, regulations and codes of practice in connection with its use of the App, including all applicable Data Protection Laws; • it shall not use Virtual Try-On Images in a manner that is misleading, deceptive or likely to create a false impression as to the nature, quality, appearance, fit, colour or size of any product; • it shall ensure that its Customer-facing privacy notices adequately disclose the use of the Virtual Try-On Feature, the processing of Customer photographs and body-measurement data (including measurements provided for AI size recommendations) by AI technology, and the involvement of third-party service providers; • it shall ensure that the Virtual Try-On Feature on its Merchant Store includes the end-user consent mechanism provided by the Company (or an equivalent mechanism that obtains informed, specific and unambiguous consent from Customers before any photograph is uploaded), and shall not disable, bypass, or modify the consent mechanism without the Company's prior written approval; • it shall not upload, or permit the upload of, any illegal, harmful, offensive, defamatory, or infringing content to the App; • it shall not use the App in connection with any products or services that are illegal, fraudulent, or in violation of the Shopify Acceptable Use Policy; and • it shall promptly notify the Company of any suspected security breach, unauthorised access, or misuse of the App. 11. Intellectual Property 11.1 All Intellectual Property Rights in and to the App, including its source code, object code, design, user interface, documentation, algorithms, and all updates, modifications, and enhancements thereto, are and shall remain the exclusive property of the Company. Nothing in these Terms grants the Merchant any ownership rights in the App. 11.2 The Merchant retains all Intellectual Property Rights in its own product data, product images, branding, and Customer Data. 11.3 With respect to Virtual Try-On Images: • the Merchant shall not use Virtual Try-On Images for any purpose unrelated to the Merchant Store or the products depicted therein; and • the Merchant acknowledges that Virtual Try-On Images are AI-generated and that the copyright status of AI-generated images may be uncertain under applicable law. The Company makes no representations or warranties as to the copyright ownership of Virtual Try-On Images. 12. Suspension and Termination 12.1 The Company may suspend or restrict the Merchant's access to the App immediately upon written notice if the Merchant: • fails to pay any subscription fees when due, and such failure continues for more than fourteen (14) days after notification; • breaches any material provision of these Terms; • uses the App in a manner that is unlawful, fraudulent, or in violation of the Shopify Acceptable Use Policy; • engages in conduct that, in the Company's reasonable opinion, may bring the Company, the App, or the Shopify Platform into disrepute; or • becomes the subject of insolvency, bankruptcy, liquidation, administration, or similar proceedings. 12.2 The Merchant may terminate these Terms at any time by uninstalling the App from the Merchant Store through the Shopify Admin. 12.3 The Company may terminate these Terms by providing the Merchant with at least thirty (30) days' written notice. 12.4 Upon termination of these Terms for any reason: • the licence granted under Clause 2.1 shall immediately terminate; • the Merchant's access to the App and all associated features shall cease; • the Company shall handle Merchant Data in accordance with its obligations under these Terms, the Privacy Policy, the Data Processing Agreement, and applicable Data Protection Laws; and • any outstanding fees owed by the Merchant to the Company shall remain payable. 12.5 Clauses 1 (Definitions), 8 (Merchant Data), 9 (Security Breaches), 11 (Intellectual Property), 13 (Limitation of Liability), 14 (Indemnification), 15 (Confidentiality), 16 (Disclaimers), 17 (Governing Law), and 20 (General Provisions) shall survive termination or expiry of these Terms. 13. Limitation of Liability 13.1 Nothing in these Terms shall limit or exclude either party's liability for: • death or personal injury caused by its negligence; • fraud or fraudulent misrepresentation; or • any other liability which cannot be limited or excluded by applicable law. 13.2 Subject to Clause 13.1, the Company shall not be liable to the Merchant, whether in contract, tort (including negligence), breach of statutory duty, or otherwise, for any: • loss of profits, revenue, business, anticipated savings, or goodwill; • loss of data or corruption of data (except to the extent arising from the Company's breach of its data protection obligations); • indirect, special, incidental, consequential, or punitive damages; or • losses arising from the Merchant's reliance on Virtual Try-On Images, including any losses arising from inaccurate, misleading, or unexpected AI-generated outputs; in each case, whether or not the Company has been advised of the possibility of such losses. 13.3 Subject to Clause 13.1, the Company's total aggregate liability to the Merchant in respect of all claims arising under or in connection with these Terms, whether in contract, tort (including negligence), breach of statutory duty, or otherwise, shall not exceed the total fees paid by the Merchant to the Company under these Terms during the twelve (12) month period immediately preceding the event giving rise to the claim. 13.4 If the Merchant has not paid any fees to the Company during such twelve (12) month period, the Company's total aggregate liability shall not exceed one hundred pounds sterling (£100). 13.5 The Merchant acknowledges that the App is provided as a tool to assist with Customer engagement and product visualisation, and that the Company does not guarantee any specific level of sales uplift, conversion rate improvement, or commercial outcome from the use of the App. 14. Indemnification 14.1 The Merchant shall indemnify, defend and hold harmless the Company, its directors, officers, employees, and agents from and against any and all losses, damages, liabilities, costs and expenses (including reasonable legal fees) arising out of or in connection with: • the Merchant's breach of these Terms; • the Merchant's violation of any applicable law or regulation; • any claim by a third party (including any Customer) arising from the Merchant's use of the App, the Virtual Try-On Feature, or any Virtual Try-On Image; • the Merchant's failure to obtain required consents or provide required notices to Customers in connection with the Virtual Try-On Feature; • any claim that the Merchant's product images, product data, or other content uploaded to or used with the App infringes the Intellectual Property Rights or other rights of any third party; or • the Merchant's misrepresentation of Virtual Try-On Images as actual photographs, exact representations, or guarantees of product appearance, fit, colour or size. 15. Confidentiality 15.1 Each party shall keep confidential any and all information of a confidential nature (including trade secrets and information of commercial value) disclosed to it by the other party in connection with these Terms ("Confidential Information"), and shall not make the other party's Confidential Information available to any third party, or use the other party's Confidential Information for any purpose other than the performance of its obligations under these Terms, without the prior written consent of the disclosing party. 15.2 Neither party shall use the other party's Confidential Information for any purpose other than the performance of its obligations under these Terms, nor disclose such information to any person other than its employees, directors, agents, or professional advisors who need to know such information for the purpose of carrying out the party's obligations under these Terms. 16. Disclaimers 16.1 The App is provided on an "as is" and "as available" basis. To the maximum extent permitted by applicable law, the Company disclaims all warranties, whether express, implied, statutory or otherwise, including any implied warranties of merchantability, fitness for a particular purpose, title, and non-infringement. 16.2 Without limiting the foregoing, the Company does not warrant that: • the App will be uninterrupted, timely, secure, or error-free; • the Virtual Try-On Feature or any Generated Images will be accurate, complete, reliable, or suitable for any particular purpose; • the App will be compatible with all Shopify themes, browsers, devices, or operating systems; or • any defects in the App will be corrected within any particular timeframe. 16.3 Nothing in this Clause 16 shall affect the Merchant's statutory rights under the Consumer Rights Act 2015 (to the extent applicable) or any other mandatory statutory consumer protections. 17. Governing Law and Dispute Resolution 17.1 These Terms and any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with them or their subject matter or formation shall be governed by and construed in accordance with the laws of England and Wales. 17.2 Each party irrevocably agrees that the courts of England and Wales shall have exclusive jurisdiction to settle any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with these Terms or their subject matter or formation. 18. Changes to these Terms 18.1 The Company reserves the right to amend these Terms at any time. The Company shall provide the Merchant with at least thirty (30) days' advance written notice of any material changes to these Terms, via email or in-app notification. 18.2 The Merchant's continued use of the App following the effective date of any amendments constitutes the Merchant's acceptance of the amended Terms. If the Merchant does not agree to the amended Terms, the Merchant's sole remedy is to uninstall the App before the amendments take effect. 19. Force Majeure 19.1 Neither party shall be liable for any failure or delay in performing its obligations under these Terms to the extent that such failure or delay results from circumstances beyond the reasonable control of that party, including but not limited to: acts of God, natural disasters, epidemics or pandemics, war, terrorism, civil unrest, government actions or sanctions, power failures, internet or telecommunications failures, cyberattacks, failures of third-party service providers (including Shopify and AI service providers), and any other events beyond the reasonable control of the affected party. 19.2 The affected party shall use reasonable endeavours to mitigate the effects of the force majeure event and shall promptly notify the other party of the nature and expected duration of the event. 20. General Provisions 20.1 Entire Agreement. These Terms, together with the Privacy Policy set out in Part 2, the Data Processing Agreement, and any Schedules, constitute the entire agreement between the parties and supersede all prior agreements, representations, and understandings between the parties relating to the subject matter hereof. 20.2 Severability. If any provision of these Terms is held to be invalid, illegal, or unenforceable by any court or tribunal of competent jurisdiction, such provision shall be severed from these Terms and the remaining provisions shall continue in full force and effect. 20.3 Waiver. No failure or delay by a party to exercise any right or remedy provided under these Terms or by law shall constitute a waiver of that or any other right or remedy, nor shall it prevent or restrict the further exercise of that or any other right or remedy. 20.4 Third Party Rights. A person who is not a party to these Terms shall not have any rights under the Contracts (Rights of Third Parties) Act 1999 to enforce any term of these Terms, except that Shopify Inc. may enforce the Shopify-protective statements in the preamble to these Terms. 20.5 Assignment. The Company may assign or transfer these Terms or any of its rights or obligations hereunder without the Merchant's prior consent. The Merchant may not assign or transfer these Terms without the Company's prior written consent. 20.6 Notices. Any notice required to be given under these Terms shall be in writing and shall be deemed duly given when sent by email to: (a) the Company, at [email protected]; and (b) the Merchant, at the email address associated with the Merchant's Shopify account. 20.7 Independent Contractors. The parties are independent contractors. Nothing in these Terms shall be construed to create a partnership, joint venture, agency, or employment relationship between the parties. Schedule 1: Subscription Plans and Pricing New public offer: Free, Complete, Enterprise and Custom. Existing clients retain their agreed contracts, allowances and trial dates unless they expressly approve a replacement in Shopify. All prices are USD, excluding applicable taxes. One Shopify storefront per self-service plan. Monthly billing only. No sales-based fees. Plan | Monthly fee | Included images | Optional additional image | Trial --- | --- | --- | --- | --- Free | $0 | 5 per monthly allowance period | Not available | None Complete | $349 | 1,000 per paid Shopify cycle | $0.50 | 14 days, 50 images total Enterprise | $999 | 5,000 per paid Shopify cycle | $0.35 | None Custom | Quoted separately | Agreed in quote | Agreed in quote | Agreed in quote Free includes personalised sizing on one selected product, basic analytics and Rendered Fits branding. It does not convert to a paid subscription automatically. No sales history is required to start Free. Its monthly allowance is anchored to the first Free enrollment; reinstalling or changing the selected product does not reset usage. Complete and Enterprise include full-catalogue personalised sizing on supported products, Complete the Look and outfit sizing, individual-item and whole-outfit cart, bracket-order prompts and full analytics. Additional storefronts or bespoke requirements require a separate Custom quote. Additional images are off by default. The Merchant must enable a maximum additional-image allowance, with its maximum dollar cost shown before saving. Only successfully delivered additional images are charged. Failed images are not charged. Allowances reset each paid cycle unless the Merchant explicitly opts to repeat the maximum. Unused images do not roll over. At the image limit, only new image generation pauses; other included features continue. Complete's fourteen (14) day trial includes fifty (50) images in total, with no image overages. Shopify shows the exact end date and recurring charge before approval. Cancel before the trial ends to avoid the subscription charge. Existing agreed trials and client terms remain unchanged. Schedule 2: Company Contact Details Rendered Fits Ltd Company Registration Number: 16922551 VAT Registration Number: 510026164 Registered Office: 50-54 Oswald Road, Scunthorpe, North Lincolnshire, DN15 7PQ, United Kingdom Email: [email protected] Website: renderedfits.com Directors: Sydney George Stones, Sienna Olivia Stones PART 2: APP PRIVACY POLICY Effective Date: February 2026 Revision prepared: 21 September 2026 Prior published version last updated: 6 July 2026 1. Introduction This Privacy Policy explains how Rendered Fits Ltd ("we", "us", "our", or the "Company") collects, uses, stores, shares, and protects personal information in connection with the Rendered Fits virtual try-on application (the "App"), which is available to Shopify merchants via the Shopify App Store. This Privacy Policy applies to all personal information we process in connection with the App, including information relating to Merchants who install the App and Customers (End Users) who interact with the Virtual Try-On Feature on Merchant stores. We are committed to protecting the privacy and security of personal information. We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), the Data Protection Act 2018, and other applicable Data Protection Laws worldwide. 2. Who We Are Data Controller and Data Processor The role we play in relation to personal data depends on whose data is being processed: • For Merchant account data (shop domain, billing information, usage analytics): We act as a data controller, meaning we determine the purposes and means of processing. • For End User data processed through the Virtual Try-On Feature (customer photographs, IP addresses, session identifiers): We act as a data processor on behalf of the Merchant, who is the data controller. The terms of this processing relationship are set out in the Data Processing Agreement, available at renderedfits.com/legal/dpa. Our details: Rendered Fits Ltd Company Registration Number: 16922551 Registered Office: 50-54 Oswald Road, Scunthorpe, North Lincolnshire, DN15 7PQ, United Kingdom Email: [email protected] ICO Registration Number: ZC139559 (register entry: https://ico.org.uk/ESDWebPages/Entry/ZC139559) 3. Information We Collect We collect and process the following categories of personal information: 3.1 Information Collected Through Shopify's APIs (Merchant Data) When a Merchant installs the App, we collect the following information through Shopify's APIs: • Shop domain and shop ID - used for App authentication, billing, and account identification. • Subscription and billing plan data - collected via the Shopify Billing API, including plan tier, usage limits, and billing period. • App subscription status - received via the APP_SUBSCRIPTIONS_UPDATE webhook. Used to manage billing cycle resets and usage limit enforcement. • Order identifiers - received via the orders/create webhook, including order ID, cart token, and product handles. Used solely for the purpose of attributing conversions to virtual try-on sessions. We also handle Shopify's mandatory GDPR compliance webhooks: customers/data_request, customers/redact, and shop/redact. 3.2 Information Collected Directly from Merchants We do not ask Merchants for separate contact details or registration information. Authentication is handled entirely through Shopify's OAuth 2.0 Token Exchange, so no separate Merchant credentials are stored by the Company. The App generates automated usage logs related to the Merchant's use of the App: • Number of AI image generations consumed against the Merchant's plan limit • Aggregated analytics data, including virtual try-on conversion rate, attributed revenue, and conversion comparison metrics These logs are used solely to display the Merchant's analytics dashboard and enforce billing plan limits. 3.3 Information Collected from End Users (Customers) When a Customer uses the Virtual Try-On Feature on a Merchant's store, we collect the following: Data: Customer photograph Purpose: Processed by AI to generate the virtual try-on image. The photograph travels from the Customer's browser to the Shopify app proxy (Shopify Inc. transits the request), then to our backend on Google Cloud Platform (europe-west2, London, UK), and from there to the AI service. Retention: Temporary — live objects become eligible for lifecycle deletion after 24 hours and versioned, noncurrent copies one day later; target 48 hours, with asynchronous completion Provider retention: The 48-hour target covers copies in Rendered Fits-controlled Cloud Storage only. Google states that the Gemini Developer API retains prompts, contextual information and outputs for 55 days for abuse monitoring. For this service, the request contains the submitted photograph and the response contains the generated output. No account-specific zero-data-retention exception has been verified. Google states that paid-service prompts and responses are not used to improve its products, are processed under its Data Processing Addendum, and may be transiently stored or cached for safety, policy enforcement and required legal or regulatory disclosures in any country where Google or its agents maintain facilities. Sources: https://ai.google.dev/gemini-api/terms, https://ai.google.dev/gemini-api/docs/usage-policies and https://ai.google.dev/gemini-api/docs/zdr. Data: Body measurements for size recommendation (height, weight, gender presentation, fit preference, and optionally age) - provided optionally by the Customer Purpose: Used to generate an AI size recommendation for the selected product; sent from the Customer's browser via the Shopify app proxy to our backend Retention: Recommendation results cached in Redis keyed by product and measurement combination for up to 7 days; an anonymous prediction record (body specification and predicted size, with no name, contact details, or customer identifier) is retained to improve fit accuracy Data: Saved measurement profile (logged-in Customers who choose "save my profile") Purpose: Stored against the Customer's customer ID for that store only, so returning Customers do not need to re-enter measurements Retention: Until deleted via Shopify's customers/redact webhook or App uninstallation (shop/redact); disclosed via the customers/data_request webhook Data: IP address Purpose: Rate limiting to prevent abuse Retention: Session-scoped - expires automatically when the session ends Data: Session identifier Purpose: Stored in browser localStorage for session continuity and conversion attribution Retention: Until the Customer clears their browser data Data: First-party cookies and browser storage (see Section 14 for the full inventory) Purpose: Session continuity, conversion attribution, rate limiting, and optional device-side caching of the Customer's photos and measurements Retention: Cookies expire after 24 hours; localStorage and sessionStorage items remain on the Customer's own device until cleared 3.4 Information We Do NOT Collect We want to be clear about the data we do not collect or process through the standard Virtual Try-On Feature. The one exception is the optional Fit Passport: if a Customer chooses to create one, we collect their email address to operate that account, as controller, under the separate Fit Passport Privacy Notice. A Customer who does not create a Fit Passport is never asked for an email address. • Customer names • Customer email addresses (except where a Customer creates an optional Fit Passport) • Customer postal addresses • Customer payment or financial details • Browsing history or navigation data • Behavioural tracking data • Biometric identifiers or biometric templates (we do not extract, store, or create facial geometry scans, fingerprints, voiceprints, or similar biometric identifiers) 4. How We Use Information All personal information we collect is used exclusively for the following purposes: • Generating AI virtual try-on images for Customers • Providing and operating the App for Merchants • Managing Merchant subscriptions, billing, and plan enforcement • Enforcing rate limits to prevent abuse • Attributing conversions to enable Merchants to measure the ROI of the Virtual Try-On Feature • Displaying analytics and usage data on the Merchant's dashboard • Complying with Shopify's mandatory GDPR webhooks (customer data request, customer data erasure, shop data erasure) • Maintaining the security and integrity of the App We do not use any collected data for: • Advertising or ad targeting • Marketing or promotional purposes • Profiling or automated decision-making • Selling, renting, leasing, or trading to third parties • Training third-party or generative AI models on personal data (we never use your photograph to train any AI model; we do use anonymous and aggregated fit outcomes — such as which sizes are kept or returned — to improve the accuracy of our own size and fit predictions, which is statistical improvement of our recommendation engine and produces no output about any individual) 5. Legal Basis for Processing Under the UK GDPR and EU GDPR, we must have a valid legal basis for processing personal data: Processing Activity: Customer photographs for VTO generation Legal Basis: Article 6(1)(a) Consent + Article 9(2)(a) Explicit consent Justification: Consent is obtained before any photograph is uploaded. The upload action, combined with agreement to the End-User Terms of Use, constitutes informed consent. Processing Activity: IP addresses for rate limiting Legal Basis: Article 6(1)(f) Legitimate interests Justification: Preventing abuse and protecting system resources. Minimal impact on data subjects given session-scoped retention. Processing Activity: Body measurements for AI size recommendation Legal Basis: Article 6(1)(a) Consent Justification: Measurements are provided voluntarily by the Customer, with consent given alongside the photo-upload consent. Processing Activity: Session IDs for conversion attribution Legal Basis: Article 6(1)(f) Legitimate interests Justification: Enabling Merchants to measure ROI. Pseudonymous identifiers only. Processing Activity: Merchant account data for billing and operations Legal Basis: Article 6(1)(b) Contract performance Justification: Necessary for the performance of the Merchant Agreement. Processing Activity: GDPR webhook compliance Legal Basis: Article 6(1)(c) Legal obligation Justification: Required by UK GDPR / EU GDPR. Where we rely on legitimate interests as a legal basis, we have conducted a balancing assessment to ensure that our interests do not override the rights and freedoms of the data subjects concerned. 6. Consent for End User Photo Processing Before any Customer photograph is uploaded or processed through the Virtual Try-On Feature, the Customer is presented with a consent notice within the storefront widget that: • Clearly explains that the Customer's photograph will be processed using AI technology to generate a virtual try-on image • Identifies Rendered Fits Ltd as the processor and the Merchant as the controller • States that the photograph will be sent, via the Shopify app proxy and our backend, to Google's AI service (Gemini API) for processing • Confirms that the photograph is stored temporarily and that we target deletion within 48 hours, while explaining that Google Cloud performs lifecycle deletion asynchronously and can complete later; the Customer may optionally keep a copy saved in their own browser for faster future try-ons • Covers the optional provision of body measurements for AI size recommendations, which is consented to alongside the photo-upload consent • Provides links to the End-User Terms of Use and this Privacy Policy for full details Consent is specific, informed, and unambiguous. Customers may withdraw consent at any time by choosing not to use the Virtual Try-On Feature. Any photographs already stored remain subject to the standard lifecycle deletion target and may also be deleted on request. 7. Sharing and Disclosure of Personal Information We do not sell, rent, lease, trade, or otherwise commercially exploit personal information. We share personal information only in the limited circumstances described below. 7.1 Third-Party Service Providers (Sub-Processors) Provider: Google LLC (Gemini Developer API) Processing Activity: AI image generation Data Processed: Customer photographs, product images and generated outputs; Google documents 55-day retention of prompts, contextual information and outputs for abuse monitoring Location: Provider-managed processing; abuse-monitoring data may be transiently stored or cached in any country where Google or its agents maintain facilities Provider: Google Cloud Platform Processing Activity: Cloud infrastructure, temporary file storage Data Processed: Customer photographs (cached), IP addresses, session data Location: europe-west2 (London, UK) Provider: Shopify Inc. Processing Activity: Platform hosting, OAuth authentication, billing, webhooks; transits Virtual Try-On requests (photographs and body measurements) between the Customer's browser and our backend via the Shopify app proxy Data Processed: Merchant store domain, billing data, order identifiers, try-on request data (in transit only) Location: Canada / United States All sub-processors are bound by contractual obligations to process personal information only in accordance with our instructions and applicable Data Protection Laws. 7.2 Other Disclosures We may also disclose personal information where: • Required by law, regulation, court order, or governmental or regulatory authority • Necessary to protect our rights, property, or safety, or the rights, property, or safety of others • In connection with a merger, acquisition, reorganisation, or sale of all or substantially all of our assets, in which case the acquiring entity will be bound by the terms of this Privacy Policy 8. International Data Transfers Personal information processed through the App may be transferred to and processed in countries outside the United Kingdom and the European Economic Area. Specifically: • Rendered Fits application servers and Cloud Storage — hosted in Google Cloud region europe-west2 (London, UK) • Gemini Developer API — provider-managed processing with no verified UK/EU-only restriction; Google states that paid-service abuse-monitoring data may be transiently stored or cached in any country where Google or its agents maintain facilities • Shopify servers — located in Canada and the United States Where personal data is transferred outside the UK or EEA, we ensure that adequate safeguards are in place in accordance with applicable Data Protection Laws, including: • The UK International Data Transfer Agreement (UK IDTA) or the UK Addendum to the EU Standard Contractual Clauses, where applicable • The European Commission's Standard Contractual Clauses (SCCs) for transfers from the EEA • Adequacy decisions, where the destination country has been recognised as providing an adequate level of data protection • Additional technical and organisational measures, including encryption in transit and at rest, and transient-only processing of sensitive data Google LLC participates in the EU-U.S. Data Privacy Framework, which has been recognised as providing adequate protection by the European Commission. 9. Data Retention We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law: Data: Customer photographs Retention: Temporary only — live objects become eligible for lifecycle deletion after 24 hours and versioned, noncurrent copies one day later; target 48 hours, with asynchronous completion Data: Generated virtual try-on images Retention: Same as customer photographs. Download/share links are signed URLs valid for 24 hours; once the underlying image is lifecycle-deleted, shared links stop working. Images a Customer downloads are their own copy on their own device. Data: Gemini Developer API request and response data Retention: Google states that prompts, contextual information and outputs are retained for 55 days for abuse monitoring. This provider-controlled retention is outside the Rendered Fits Cloud Storage lifecycle; no account-specific zero-data-retention exception has been verified. Data: Size recommendation cache (Redis) Retention: Up to 7 days, keyed by product and measurement combination (automatic expiry) Data: Anonymous size prediction records Retention: Retained to improve fit accuracy; contain no name, contact details, or customer identifier; deleted on App uninstallation (shop/redact) Data: Saved measurement profiles (opt-in, logged-in Customers) Retention: Until deleted via customers/redact webhook or App uninstallation (shop/redact) Data: IP addresses (rate limiting) Retention: Session-scoped - expires automatically Data: Session identifiers Retention: Stored in Customer's browser until cleared Data: Merchant account data Retention: Duration of active subscription, plus 90 days for deletion processing following uninstall Data: Conversion attribution data Retention: Duration of active subscription, deleted on uninstall via shop/redact webhook 10. Your Rights Under applicable data protection laws, individuals have the following rights in relation to their personal information: Right: Access — Request a copy of the personal information we hold about you Right: Rectification — Request correction of inaccurate or incomplete personal information Right: Erasure — Request deletion of your personal information (subject to legal obligations) Right: Restriction — Request restriction of processing in certain circumstances Right: Portability — Receive your personal information in a structured, machine-readable format Right: Objection — Object to processing based on legitimate interests Right: Withdraw consent — Withdraw consent at any time where processing is based on consent How to exercise your rights: • Merchants: Contact us at [email protected] with your request. • End Users (Customers): In the first instance, please contact the Merchant whose store you used the Virtual Try-On Feature on, as the Merchant is the data controller for your data. You may also contact us directly at [email protected] and we will assist. We will respond to all data subject requests within one (1) month of receipt, or within the timeframe required by applicable law. In complex cases, we may extend this period by a further two (2) months, in which case we will notify you of the extension and the reasons for it. 11. Additional Information for US Residents 11.1 Biometric Information Notice (All US States) This section provides additional information for residents of the United States regarding the processing of biometric data through the Virtual Try-On Feature. When you upload a photograph to the Virtual Try-On Feature, our AI technology (provided by Google's Gemini API) analyses the facial features and body shape in your photograph to generate a virtual try-on image. To the extent that this processing may involve biometric identifiers or biometric information as defined under applicable state law, the following applies: (a) What is collected. Your photograph, which contains your facial image, is transmitted to Google's Gemini AI service for processing. The AI analyses the visual content of your photograph, including your facial features, to generate the composite try-on image. (b) What is NOT collected. Before upload, the widget runs an automated face-detection check (face-api.js) entirely within your browser, solely to confirm that the photo contains exactly one face; this check runs on your own device, the detection result is discarded immediately, and no facial geometry, template, or measurement is transmitted to or stored by us. We do not extract, compute, create, or store any biometric identifier or biometric template from your photograph on our systems. No facial geometry scan, faceprint, iris scan, fingerprint, voiceprint, or other biometric template is created or retained by us at any point during processing. (c) Purpose. Rendered Fits processes your photograph to generate the virtual try-on image you requested. Rendered Fits does not use it for identification, verification, surveillance, profiling, or advertising. Google separately processes paid-service prompts and responses for the safety, policy-enforcement and required legal or regulatory purposes described above. (d) Retention and destruction. Your photograph and generated images are stored temporarily in Rendered Fits-controlled Google Cloud Storage. We target deletion from that storage within 48 hours: live objects become eligible for lifecycle deletion after 24 hours and, because versioning is enabled, noncurrent versions become eligible for permanent deletion one day later. Google Cloud performs lifecycle actions asynchronously, so 48 hours is an operational target, not a guaranteed maximum. Google separately states that Gemini Developer API prompts, contextual information and outputs are retained for 55 days for abuse monitoring; no account-specific zero-data-retention exception has been verified. If you choose to keep a copy saved in your own browser for faster future try-ons, that copy remains on your own device under your control. We do not maintain any permanent application database of photographs or biometric templates. Our full retention schedule and destruction procedures are set out in our Biometric Data Retention and Destruction Policy, available at: renderedfits.com/legal/biometric-policy (e) No sale or disclosure. We do not sell, lease, trade, or otherwise profit from your photograph or any data derived from it. We disclose it to Google's Gemini Developer API to generate your try-on image. Google separately processes paid-service prompts and responses for the safety, policy-enforcement and required legal or regulatory purposes described above. (f) Consent. By uploading your photograph to the Virtual Try-On Feature, you acknowledge that you have received this notice and you provide your informed, written consent and release for your photograph to be processed as described above to generate a virtual try-on image, including the analysis of your facial features and Google's stated safety, policy-enforcement and required legal or regulatory processing. (g) Applicable laws. This notice is provided in compliance with the Illinois Biometric Information Privacy Act (740 ILCS 14) (BIPA), the Texas Capture or Use of Biometric Identifier Act (Tex. Bus. & Com. Code § 503.001), the Washington Biometric Privacy Protection Act (RCW 19.375), and other applicable US state biometric privacy laws. 11.2 California Privacy Rights (CCPA/CPRA) If you are a California resident, the following additional rights and disclosures apply under the California Consumer Privacy Act, as amended by the California Privacy Rights Act: (a) Categories of personal information collected. Photographs (which may constitute biometric information and are classified as sensitive personal information under the CPRA), IP addresses (internet or other electronic network activity information), and session identifiers (unique personal identifiers). (b) Purpose of collection. As set out in Section 4 of this Privacy Policy. We do not use or disclose sensitive personal information for purposes other than those permitted under CPRA Section 1798.121. (c) Sale and sharing. We do not sell personal information. We do not share personal information for cross-context behavioural advertising. (d) Right to know. You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you. (e) Right to delete. You have the right to request deletion of personal information we have collected. Given our transient processing model, your photograph will typically have been automatically deleted before any such request is received. (f) Right to limit use of sensitive personal information. You have the right to limit the use and disclosure of your sensitive personal information. We already limit use to the purposes disclosed in this Privacy Policy. (g) Non-discrimination. We will not discriminate against you for exercising any of your CCPA/CPRA rights. To exercise your California privacy rights, contact us at: [email protected]. We will verify your identity before processing your request. 11.3 Other US State Privacy Laws Residents of other US states with applicable consumer privacy or biometric privacy laws (including but not limited to Colorado, Connecticut, Virginia, Utah, Montana, Oregon, and New Jersey) may have additional rights regarding their personal information. To the extent required by applicable state law, we will honour requests to access, correct, delete, or opt out of the processing of your personal data. To exercise any such rights, please contact us at: [email protected] For full details of our biometric data retention and destruction practices, please refer to our Biometric Data Retention and Destruction Policy at: renderedfits.com/legal/biometric-policy 12. Under-18s The Virtual Try-On Feature and Fit Passport are intended only for adults aged 18 or over. People under 18 must not use either service or upload a photograph. We do not permit a photograph of any person under 18 to be uploaded, including where a parent or guardian has consented. If we learn that information about a person under 18 has been submitted, we will restrict further use and handle it in accordance with applicable law and our published retention and deletion processes. If you believe an under-18’s information has been submitted, contact us at [email protected]. 13. Data Security We implement appropriate technical and organisational security measures to protect personal information against unauthorised access, alteration, disclosure, or destruction. These measures include: • Encryption of data in transit using TLS/HTTPS • Transient processing of Customer photographs with automated lifecycle deletion (target 48 hours; asynchronous cloud processing can complete later) • Session-scoped data storage with automatic expiry • Authentication via Shopify's OAuth 2.0 Token Exchange (no separate credentials stored) • Rate limiting to prevent abuse and protect system resources • Access controls restricting access to personal data to authorised personnel only • Regular review and monitoring of security measures While we take reasonable steps to protect personal information, no method of transmission over the internet or method of electronic storage is 100% secure. We cannot guarantee absolute security. 14. Cookies and Similar Technologies The App uses a small number of first-party cookies and browser storage items, all of which are functional (no advertising, analytics, or third-party tracking). All device-side items can be cleared by the Customer at any time through their browser settings. Cookies (first-party): • rf_id — a first-party attribution/session identifier, valid for 24 hours. It is also written as a Shopify cart attribute so that the Merchant's order records reflect try-on involvement. • rf_user_rate_limit — a 24-hour fair-use counter used to enforce rate limits. localStorage (stored on the Customer's own device until cleared by the Customer): • rf_user_photos_v1 — the Customer's uploaded face/body photographs, saved on the Customer's own device for convenient reuse; sent to our systems only when the Customer starts a new try-on. • rf_user_measurements_v2 — the Customer's saved body measurements. • rf_pending_generation_v1 — resume state for an in-progress generation. • rf_nudge_last_shown — a timestamp limiting a one-off UI prompt. sessionStorage (cleared when the browser tab is closed): • rf_looks — the Customer's generated looks for the current browsing session. • rf_entry_sub_ok_v1 — caches the subscription check on collection pages. We do not log browsing behaviour, store navigation data, or use any form of behavioural tracking. 15. AI-Generated Content Transparency Virtual Try-On Images produced by the App are generated using artificial intelligence (currently Google's Gemini API). In accordance with the EU AI Act (Regulation (EU) 2024/1689), Article 50, and in the interests of transparency: • All Virtual Try-On Images are clearly identified to the Customer as AI-generated within the storefront widget • Virtual Try-On Images are illustrative only and do not constitute photographs or exact representations of real-world products • We will implement machine-readable marking of AI-generated content in accordance with applicable legal requirements as they come into force 16. Changes to This Privacy Policy We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Material changes will be notified to Merchants via email or in-app notification at least thirty (30) days in advance. We encourage you to review this Privacy Policy periodically. The "Last Updated" date at the top of this policy indicates when it was last revised. 17. Complaints If you have any concerns or complaints about our processing of personal information, we encourage you to contact us first at [email protected] so that we can attempt to resolve the matter. You also have the right to lodge a complaint with a supervisory authority. In the United Kingdom, this is the Information Commissioner's Office: • Website: ico.org.uk • Telephone: 0303 123 1113 • Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF If you are located in the European Economic Area, you may lodge a complaint with the data protection authority in your country of residence. 18. Contact Us If you have any questions about this Privacy Policy, our data practices, or wish to exercise your data subject rights, please contact us at: Rendered Fits Ltd Email: [email protected] Post: 50-54 Oswald Road, Scunthorpe, North Lincolnshire, DN15 7PQ, United Kingdom Note on the Fit Passport and API access: The optional Fit Passport is a consumer account for which Rendered Fits Ltd acts as an independent data controller (not the Merchant's processor). It stores a Customer's email and, behind separate opt-in consents, their measurements and photographs; passport photographs are retained for repeat try-ons rather than following the standard 48-hour deletion target, are stored on Google Cloud in London (UK), are never used to identify anyone, and are deleted on request or on deletion of the passport. Full details are in the Fit Passport Privacy Notice at renderedfits.com/legal/fit-passport-privacy-notice. The App also exposes API/MCP endpoints through which Merchants and AI shopping assistants may request fit outputs; such callers receive outputs only (a size recommendation, a fit statement, or a rendered image) and never a Customer's raw photograph or measurements. End of Merchant Terms and Conditions & App Privacy Policy — Version 1.2 — Revision prepared: 21 September 2026; prior embedded source dates: 6 and 16 July 2026