Privacy & Data Retention Policy

Last updated: June 13, 2026

Fittly ("we", "our", or "us") is a virtual try-on application for Shopify stores, developed by ChemanCorp. This policy explains what data we collect, how and where we process it, how long we keep it, and your rights. It applies across Chile (Law 21.719), the European Union (GDPR), the United States (BIPA and state privacy laws), and the rest of Latin America.

1. Who this policy applies to

Merchants — Shopify store owners who install Fittly.
Shoppers — end users who interact with the Fittly widget on a storefront.

2. Where your data is processed

Fittly's data is stored on servers located in the United States (East US, Ohio) through our infrastructure provider (Supabase). Photos are additionally sent to our AI provider Fashn AI, also in the United States, solely to generate the try-on result. If you are in the European Economic Area, this is an international transfer of data — see Section 8.

3. Data we collect

From merchants

Shopify store domain and authentication tokens.
Active subscription plan.
Product metafield configurations (garment image URLs).

From shoppers — without a Fittly account

Uploaded photo — used only to generate the try-on preview. It is not stored by Fittly, is sent to Fashn AI to produce the result, and is deleted within a maximum of 72 hours. It is never shared with the store.
Height and weight — when entered without an account, used only for that calculation and not stored.

From shoppers — with a Fittly account

If a shopper chooses to create an account (always optional), we store, with their explicit consent:

Account email and an encrypted password.
Body photo, if authorized, to avoid re-uploading on other Fittly stores.
Measurements (height, weight) — to recommend sizes across Fittly stores.
Generation history — garments tried and results.
Saved model — the AI-generated model derived from the photo.

A shopper's body photo and measurements are never visible to merchants or other people — merchants only ever see the generated try-on result.

4. Photos and biometric data

A full-body or face photo may constitute biometric data under laws such as Illinois BIPA, Texas CUBI, and Washington's law, and a special category of data under GDPR Article 9. We treat it accordingly:

Shoppers must give explicit consent before a photo is processed.
Photos are stored in a private, encrypted bucket.
Photos used without an account are deleted within 72 hours and never retained by Fittly.
Fittly does not sell, lease, or share biometric information with third parties for commercial purposes. The only third party that processes your photo is Fashn AI, exclusively to generate the result.
Shoppers can withdraw consent and request deletion at any time.

5. Data retention & destruction

This retention schedule is published as required by BIPA.

Data	Retention	When it is deleted
Photo without account (in transit to Fashn)	Max. 72 hours	Automatic
Photo without account (in Fittly)	Not stored	N/A
Account photo / measurements / history	While the account is active	On account deletion or request
Generated model (cached)	Up to 24 hours	Automatic
Try-on / outfit results	While active (or until merchant uninstalls)	On deletion or uninstall
Inactive account	12 months without activity	Notice 30 days before, then automatic deletion
Anonymized usage logs	24 months	Automatic
Privacy requests	5 years	Legal evidence obligation

6. Third-party services

Fashn AI (United States) — AI image generation. Privacy policy.
Supabase (United States, Ohio) — database and encrypted storage. Privacy policy.
Shopify — the platform. Privacy policy.
Railway — hosting; no persistent personal data. Privacy policy.

7. International data transfers

Your data is stored in the United States (Ohio). The legal basis depends on your location:

European Economic Area: Standard Contractual Clauses (SCCs) under GDPR Article 46.
Chile: your consent under Law 21.719.
United States: your consent (CCPA/BIPA) and this published retention policy.
Other Latin American countries: consent and our terms of service.

8. Your rights

Depending on your location, you have the right to:

Access — see the data we hold (within 30 days).
Rectification — update your photo or measurements (within 30 days).
Deletion — delete your entire profile and data (within 30 days).
Portability — export your data in a readable format (within 30 days).
Objection — stop certain processing (immediately).
Opt-out of sale — we do not sell personal data (CCPA).
Withdraw consent for photo processing at any time, and lodge a complaint with your local data protection authority.

Account holders can manage and delete their data directly from their Fittly profile. Other requests: see Section 10. Response time: up to 30 days.

9. Age requirement

Fittly is intended for users aged 16 or older. Users under 16 may not upload a photo or create an account without the express authorization of a parent or legal guardian.

10. Contact & changes

For any privacy request: privacy@fittlyapp.com.

We may update this policy. Merchants will be notified of significant changes via the Shopify admin.