Privacy Policy: Wearo Virtual Try-On for Shopify

1. Who we are

Wearo (the "Service", "we", "us", "our") is a virtual try-on widget operated by Wearo SAS, a company registered in France. Our flagship product is Wearo: Virtual Try-On, a Shopify app that lets storefront shoppers preview garments and accessories on themselves using an AI-generated try-on image, embedded directly on the merchant's product detail pages.

• Public website. https://wearo.io
• Privacy contact. contact@wearo.io
• Postal contact. Available on request from the email above.
• Data Protection Officer. Contactable at the same email; subject line DPO request.

This Privacy Policy explains what personal data we collect when a merchant installs Wearo: Virtual Try-On on their Shopify store and when a shopper uses the widget on that store, why we collect it, where it lives, who can see it, and how you can exercise the rights granted to you by the GDPR, the CCPA, and equivalent data-protection laws.

If you are a shopper who has used the widget and you only want to know what happens to your photos, jump straight to §4 Storefront shoppers, which describes it in full.

If you are a merchant evaluating the app, §3 Shopify merchants is the section for you.

If you are a Shopify reviewer auditing the listing, sections §3 through §9 cover the App Store privacy-disclosure requirements; section §7 addresses the mandatory compliance webhooks specifically.

2. Summary of what we do and do not do

If you spot any inconsistency between this section and the more detailed sections that follow, the detailed section is authoritative. If you spot any inconsistency between this document and what the app actually does, please tell us at contact@wearo.io; we treat that as a P0 bug.

3. Shopify merchants: data we process when you install the app

When you install Wearo: Virtual Try-On from the Shopify App Store, you grant us, through Shopify's standard OAuth flow, the permissions described in your shopify.app.toml. As of V1 (2026-05-04), the requested access scope is read_products only. We do not request, and therefore do not receive, any Protected Customer Data.

3.1 What we receive from Shopify at install time

3.2 What we read from your store while the app is installed

• Product catalogue. Through the Admin API we read the handle and online-store URL of your first active product, to link to it from the app's Home page. On a product page, the widget reads the product's image from the page itself, as rendered by your theme, and sends that image to the try-on engine for that request.
• Webhook payloads for the five subscriptions declared in shopify.app.toml (customers/data_request, customers/redact, shop/redact, app/uninstalled, app/scopes_update). The full payload is stored in the GdprRequest audit table for the duration described in §3.4.

3.3 What we explicitly do not read

• Customer records. No read_customers, no email addresses of your shoppers, no phone numbers, no addresses.
• Orders. No read_orders. We deliberately removed this scope on 2026-05-04.
• Inventory, shipping, fulfilments, refunds, discount codes, gift cards, draft orders, Liquid templates, theme files, and any other resource not strictly required to render a try-on. The OAuth token we hold is technically capable of read_products only.
• Shopify Plus checkout extensibility, Shopify Functions, or any other surface that handles payment data. We never see card numbers, billing addresses, or transaction details.

3.4 Retention for merchant data

• Active install. While your app is installed, your shop record and OAuth access token are retained as long as needed to operate the service for you.
• App uninstall. When you uninstall the app, Shopify sends us an app/uninstalled webhook. We mark your Shop.uninstalledAt immediately. Shopify also subsequently sends a shop/redact webhook (typically 48 hours after uninstall, per Shopify's policy). On receipt of shop/redact, we delete your shop record, its sessions, the widget analytics rows keyed to your clientId, and the try-on images held under that clientId in our object storage. Any copy this automatic sweep does not reach is deleted on request to contact@wearo.io.
• GDPR audit log. The GDPR's accountability principle requires us to be able to demonstrate that we comply with it. To that end we log each of the three GDPR webhooks we receive: topic, shop domain, webhook id, the payload as received from Shopify, receipt and processing timestamps, status, and, if processing failed, the error. We keep these GdprRequest records for as long as we may need to demonstrate compliance, and we use them for no other purpose.

3.5 Where merchant data lives

• Primary database. EEA-resident managed PostgreSQL (Frankfurt region). TLS in transit and AES-256 at rest. Backups are also encrypted and EU-resident.
• Application runtime. EEA-resident serverless container runtime (Belgium region). The runtime is stateless; the only persistent state is the managed PostgreSQL database described above.
• Secrets. Shopify API key + secret, the bridge JWT secret, and the database connection strings live in an EEA-resident managed secret-management service, restricted to a single dedicated service account.
• Build artefacts. Container images live in an EEA-resident managed container registry. Source-code uploads for the build pipeline go through EEA-resident managed object storage and are deleted by the build pipeline's own retention policy.

We do not use any sub-processor outside the EEA for merchant data.

4. Storefront shoppers: data we process when you use the widget

This section describes in full what happens to your photo and to the image we generate from it.

4.1 What we collect and why

4.2 What we do not collect

• We do not read your name, email, phone number, address, payment information, social-media handles, or any other identifying field. The widget never asks for them and the API contract of our backend does not accept them.
• We do not run facial recognition, biometric identification, age estimation, gender inference, ethnicity inference, expression analysis, or any other inference on your image other than the try-on rendering itself.
• We do not use your image to train or fine-tune any machine-learning model. Our AI inference partner is contractually bound to operate as a stateless inference API: each request is independent, and no model weights are updated based on what we send.
• We do not place advertising cookies. The visitor identifier described in §4.1 is a single random number, not a tracking cookie, and is never shared with ad networks.

4.3 Legal basis (GDPR Article 6)

• For your photo and the generated result: your explicit consent under Article 6(1)(a), given by uploading a photo to the widget. You may withdraw it at any time by closing the widget without uploading a new photo, or by emailing us; see §9.
• For the visitor identifier and analytics in §4.1: legitimate interest under Article 6(1)(f) in attributing conversions and operating the service. This processing involves no special-category data and uses only randomly-generated identifiers; the residual risk to your rights is minimal.
• For the IP address in access logs: legal obligation under Article 6(1)(c), to detect and prevent fraud and abuse.

4.4 Special-category data (GDPR Article 9)

A photograph of a person is, in many jurisdictions, special-category personal data ("biometric data" once processed for unique identification). We do not process your photo for unique identification, biometric profiling, or any Article 9 purpose. The processing is limited to the generation of a single try-on image and its return to you. Were we ever to expand into Article 9 territory, we would request your explicit opt-in consent for that specific new purpose; this Privacy Policy would be amended in the same release; merchants would be re-notified.

4.5 Children

The widget is not directed at children under 16 (under 13 for U.S. users). Merchants who market to under-16 audiences MUST obtain parental consent before letting a child use the widget; this is a contractual obligation under our Terms of Service (section 5). If we become aware that we have processed a photo provided by a child without verifiable parental consent, we delete it.

5. Sub-processors

We use the following sub-processors. The list is exhaustive for the V1 of the Shopify app.

We will update this list before any new sub-processor is engaged for production data, and we will give merchants 30 days' notice (via email to the address registered on the Shopify App Store, or via in-app banner) before any change that affects their data. Merchants may object to a change by uninstalling the app within that window, which triggers the deletion described in §3.4.

6. International transfers

All sub-processors that touch merchant or shopper personal data store that data inside the EEA, with the single exception of Shopify itself, which is the data exporter for the OAuth flow and the GDPR webhooks. Shopify's standard EU-U.S. Data Privacy Framework certification and SCCs are the transfer mechanism for that flow; this is an inherent property of being a Shopify app.

We do not transfer shopper photos or AI-generated try-on results outside the EEA at any point in the pipeline. Each sub-processor in our chain is contractually bound to keep that category of data EEA-resident.

7. Shopify mandatory GDPR webhooks

Shopify requires every public app to subscribe to three compliance webhooks. We do.

• customers/data_request. Triggered when a customer asks the merchant for a copy of the data we hold about them. The only customer-identifying data we ever receive is what Shopify itself places in this webhook and in customers/redact: a customer id, and, where the store holds them, an email address and a phone number. We store that payload in our GDPR audit log (§3.2) and use it only to handle the request. Nothing else we hold is tied to a Shopify customer — a try-on carries only a random identifier generated in the shopper's browser. We record the request and acknowledge it to Shopify; a merchant who needs us to look for a specific try-on can ask us at contact@wearo.io, and we answer within 30 days.
• customers/redact. Triggered when a customer asks the merchant to delete their data. We record the request in our GDPR audit log and forward it to our backend, which removes any widget analytics row linked to the orders listed in the payload. No try-on image is keyed to a Shopify customer, so this endpoint does not delete images: images are deleted shop by shop by shop/redact below, or on request at any time.
• shop/redact. Triggered 48 hours after a merchant uninstalls our app. We delete the shop record, its sessions, the widget analytics rows keyed to the shop's clientId, and the try-on images held under that clientId on the shopper tier described in §5. Any copy this automatic sweep does not reach is deleted on request. The shop's GdprRequest audit records are retained as described in §3.4.

We sign every webhook handler with HMAC-SHA256 verification of Shopify's X-Shopify-Hmac-Sha256 header before processing. Failed HMAC → 401 → Shopify retries on its own schedule.

8. Cookies and local storage

We use the browser's localStorage and IndexedDB, and only on the merchant's storefront (never in the merchant's Shopify admin), to store:

• wearo_visitor_id: a value that distinguishes your successive try-ons in the merchant's aggregate statistics — a UUIDv4 where your browser can generate one, otherwise a random string. Held in localStorage; when localStorage is unavailable (Safari private browsing, for instance) the widget falls back to a value kept in memory for the current page only. We do not transmit it to the merchant, but your browser stores it against the site you are on, so scripts on that site can read it.
• tryon_history: the list of try-ons made from this browser — an identifier, a link to the resulting image, and a timestamp — so the widget can show you your own gallery when you reopen it. localStorage only.
• Your try-on photo, in an IndexedDB database named wearo-widget. It is saved after a successful try-on, when your browser allows it, so that you do not have to upload it again next time; it stays on your device. Because the widget runs from wearo.io inside a frame, that saved photo belongs to the wearo.io frame rather than to the merchant's site, and is available to you on any store using Wearo, in this browser and on this device only. It expires 30 days after it was saved: the first time the widget opens after that, the expired photo is deleted and never reused. Clearing your browser storage removes it immediately.

We do not set HTTP cookies on the storefront, neither first- nor third-party. We do not use any analytics, advertising, or fingerprinting library on the storefront.

9. Data subject rights (GDPR / CCPA)

You have the right to:

• Access your personal data and obtain a copy of it,
• Rectify any inaccurate data,
• Erase your personal data ("right to be forgotten"),
• Restrict or object to processing under the conditions of Articles 18 and 21 GDPR,
• Port your data to another controller in a structured machine-readable format under Article 20,
• Withdraw consent at any time without affecting the lawfulness of processing performed before the withdrawal,
• Lodge a complaint with your supervisory authority: for France, the CNIL; for other EEA states, the relevant DPA.

For California residents under the CCPA: you have analogous rights of access, deletion, and to opt out of sale or sharing of personal information. We do not sell or share personal information for cross-context behavioural advertising; the right to opt out therefore has no practical scope, but you may still exercise the right of access and deletion.

To exercise any of the above, email contact@wearo.io. We respond within 30 days (15 days where required by California). For deletion requests, please use the subject line GDPR - Erasure request (or CCPA - Deletion request) so the message lands in our compliance queue.

10. Security

• Data in transit is encrypted with TLS 1.2+ on every hop (browser ↔ Wearo, Wearo ↔ Shopify, Wearo ↔ AI inference partner, Wearo ↔ database, Wearo ↔ object storage).
• Data at rest is encrypted with AES-256 by every underlying managed service in our chain.
• Application secrets (Shopify API key, Shopify API secret, the bridge JWT secret, database connection strings) live in an EEA-resident managed secret-management service, accessed only by a dedicated service account with least-privilege access. There is no human standing access to these secrets.
• Field-level encryption of the OAuth accessToken field (additional defence against a database-level compromise) is on our roadmap and will ship before the app crosses the threshold of 50 active merchants. We disclose this publicly here, in good faith, because it is the most material residual risk in V1.
• We rely on Shopify's HMAC signing for all incoming webhooks and on a HS256 JWT bridge between the storefront widget and our AI generation backend; the bridge secret is rotatable and is held in the secret-management service described above.
• We monitor application logs and have alerting on 5xx error rates above 1 % over 5 minutes.

11. Data breach notification

In the event of a personal-data breach affecting your data, we will notify the relevant supervisory authority within 72 hours of becoming aware of it (Article 33 GDPR), and we will notify you (the merchant or the affected shopper) without undue delay where the breach is likely to result in a high risk to your rights and freedoms (Article 34 GDPR).

12. Changes to this policy

We may update this policy. When we do, we update the Last updated line at the top, we re-publish the document at the public URL, and, for any change that materially expands the categories of data we collect, the purposes for which we use it, or the sub-processors that touch it, we notify merchants 30 days in advance via the email address registered on the Shopify Partner Dashboard, and we surface a banner inside the embedded admin until the merchant acknowledges it. Continued use of the app after the effective date constitutes acceptance of the updated policy.

13. Governing law and jurisdiction

This policy is governed by French law. Disputes shall be subject to the exclusive jurisdiction of the courts of Paris, France, subject to any non-waivable consumer-protection rights you may have under the law of your habitual residence.

14. Contact

For any question, request, or complaint relating to this policy or to the personal data we hold:

• Email. contact@wearo.io (subject lines: GDPR - Erasure request, CCPA - Deletion request, DPO request, or any other descriptive subject)
• Mail. Available on request from the email above.
• Response SLA. 30 days (15 days for CCPA where applicable). Acknowledgement sent within one business day.

We are committed to handling your data with the care and the discipline you should expect from a privacy-respectful AI service. If anything in this policy is unclear, write to us; we treat ambiguity as a bug.