DrapX Shopify App Privacy Policy

1. Who We Are

DrapX AI ("DrapX", "we", "us") provides a physics-simulated AI virtual try-on widget that merchants install on their Shopify stores. The widget lets shoppers upload a photo and see a photorealistic preview of how a garment looks on them, generated in roughly 9 seconds.

2. Information the App Collects

When a merchant installs DrapX, or a shopper uses the try-on widget, we process:

• Merchant / store data: store name, store URL, contact email, plan and billing status (handled through Shopify's billing system), and product data (titles, images, variants) needed to render try-ons.
• Shopper-provided images: photos a shopper voluntarily uploads or captures to use the try-on feature.
• Generated images: the AI try-on results produced from the shopper's photo and the merchant's product image.
• Usage data: anonymous widget interaction events (try-on counts, generation times, error rates) used for analytics and billing quotas.

We do not collect payment card details. All app charges are processed by Shopify. We do not intentionally collect data from children under 16.

3. Image Storage & 10-Day Retention

• Uploaded photos and generated try-on images are stored only as long as needed to deliver the try-on experience.
• We never store provided or generated images for more than 10 days. All such images are automatically and permanently deleted from our systems within 10 days of creation, in most cases much sooner.
• Images are stored encrypted at rest and transferred exclusively over encrypted connections (TLS).
• We do not use shopper photos to train our AI models without explicit consent, and we never sell or share shopper photos with third parties.

4. How We Use Data

• To generate virtual try-on images and deliver them to the shopper in real time.
• To operate merchant dashboards, quotas, and analytics (aggregated and anonymized).
• To provide customer support and improve service reliability.
• To comply with legal obligations and Shopify's API and partner requirements.

5. Data Sharing

We do not sell personal data. We share data only with infrastructure providers required to run the service (secure cloud hosting and GPU inference providers), all bound by data-processing agreements, and with Shopify as required for app functionality and billing.

6. GDPR & CCPA Compliance

DrapX supports Shopify's mandatory privacy webhooks and responds to them automatically:

• customers/data_request: we provide any stored data related to the customer.
• customers/redact: we delete all data related to the customer.
• shop/redact: we delete all data related to the store within 30 days of app uninstall.

Shoppers and merchants in the EU/EEA, UK, and California may exercise their rights of access, correction, deletion, and portability at any time by contacting us.

7. Data Security

All data is encrypted in transit (SSL/TLS) and at rest. Access to production systems is restricted to authorized personnel, and images are isolated per store. Automated deletion jobs enforce the 10-day image retention limit described above.

8. App Uninstallation

When a merchant uninstalls the DrapX app, we stop all data collection immediately. Remaining shopper and store data is deleted in accordance with the retention windows above and Shopify's shop/redact webhook.

9. Changes to This Policy

We may update this policy as the app evolves. Material changes will be announced to merchants by email and reflected on this page with a new "Last updated" date.

10. Contact

For privacy questions or data requests, contact us at privacy@drapx.com or through our contact page.