Privacy & Data Retention Policy
Last updated: July 25, 2026
Fittly ("we", "our", or "us") is a virtual try-on application for Shopify stores, developed by Fittly SpA (Chile). This policy explains what data we collect, how and where we process it, how long we keep it, and your rights. It applies across Chile (Law 21.719), the European Union (GDPR), the United States (BIPA and state privacy laws), and the rest of Latin America.
1. Who this policy applies to
- Merchants — Shopify store owners who install Fittly.
- Shoppers — end users who interact with the Fittly widget on a storefront.
- Partners — creators and agencies enrolled in the Fittly Partner Program.
2. Where your data is processed
Fittly's data is stored on servers located in the United States (East US, Ohio) through our infrastructure provider (Supabase). Photos are additionally sent to our AI provider Fashn AI, also in the United States, solely to generate the try-on result. If you are in the European Economic Area, this is an international transfer of data — see Section 7.
3. Data we collect
From merchants
- Shopify store domain and authentication tokens.
- Active subscription plan.
- Product metafield configurations (garment image URLs).
From shoppers — without a Fittly account
- Uploaded photo — used only to generate the try-on preview. It is not stored by Fittly, is sent to Fashn AI to produce the result, and is deleted within a maximum of 72 hours. It is never shared with the store.
- Height and weight — when entered without an account, used only for that calculation and not stored.
From shoppers — with a Fittly account
If a shopper chooses to create an account (always optional), we store, with their explicit consent:
- Account email and an encrypted password.
- Body photo, if authorized, to avoid re-uploading on other Fittly stores.
- Measurements (height, weight) — to recommend sizes across Fittly stores.
- Generation history — garments tried and results.
- Saved model — the AI-generated model derived from the photo.
A shopper's body photo and measurements are never visible to merchants or other people — merchants only ever see the generated try-on result.
From partners (Fittly Partner Program)
If you enroll as a Partner (you must be 18+), we collect and process:
- Account and contact details — name, email, and the information you provide when you apply.
- Payout details — your PayPal or Wise account (or other payout method).
- Tax information — tax forms and identifiers you provide (e.g., W-8/W-9, or Chilean RUT and tax documents), as required to pay you and comply with tax law.
- Referral activity — clicks on your referral link (with IP address stored in hashed form), stores attributed to you, and your dashboard usage.
We use this to run the Partner Program, calculate and pay commissions, prevent fraud, and meet our legal and tax obligations.
4. Photos and biometric data
A full-body or face photo may constitute biometric data under laws such as Illinois BIPA, Texas CUBI, and Washington's law, and a special category of data under GDPR Article 9. We treat it accordingly:
- Shoppers must give explicit consent before a photo is processed.
- Photos are stored in a private, encrypted bucket.
- Photos used without an account are deleted within 72 hours and never retained by Fittly.
- Fittly does not sell, lease, or share biometric information with third parties for commercial purposes. The only third party that processes your photo is Fashn AI, exclusively to generate the result.
- Shoppers can withdraw consent and request deletion at any time.
5. Data retention & destruction
This retention schedule is published as required by BIPA.
| Data | Retention | When it is deleted |
|---|
| Photo without account (in transit to Fashn) | Max. 72 hours | Automatic |
| Photo without account (in Fittly) | Not stored | N/A |
| Account photo / measurements / history | While the account is active | On account deletion or request |
| Generated model (cached) | Up to 24 hours | Automatic |
| Try-on / outfit results | While active (or until merchant uninstalls) | On deletion or uninstall |
| Inactive account | 12 months without activity | Notice 30 days before, then automatic deletion |
| Anonymized usage logs | 24 months | Automatic |
| Privacy requests | 5 years | Legal evidence obligation |
| Partner data | While enrolled, then as required for tax/legal records | Up to 7 years after the program relationship ends |
6. Third-party services
7. International data transfers
Your data is stored in the United States (Ohio). The legal basis depends on your location:
- European Economic Area: Standard Contractual Clauses (SCCs) under GDPR Article 46.
- Chile: your consent under Law 21.719.
- United States: your consent (CCPA/BIPA) and this published retention policy.
- Other Latin American countries: consent and our terms of service.
8. Your rights
Depending on your location, you have the right to:
- Access — see the data we hold (within 30 days).
- Rectification — update your photo or measurements (within 30 days).
- Deletion — delete your entire profile and data (within 30 days).
- Portability — export your data in a readable format (within 30 days).
- Objection — stop certain processing (immediately).
- Opt-out of sale — we do not sell personal data (CCPA).
- Withdraw consent for photo processing at any time, and lodge a complaint with your local data protection authority.
Account holders can manage and delete their data directly from their Fittly profile. Other requests: see Section 10. Response time: up to 30 days.
9. Age requirement
Fittly is intended for users aged 16 or older. Users under 16 may not upload a photo or create an account without the express authorization of a parent or legal guardian.
10. Contact & changes
We may update this policy. Merchants will be notified of significant changes via the Shopify admin.