Privacy Policy

1. Who Is Responsible for Your Data

If you're a shopper, you're reading this because you used, or are about to use, a virtual try-on widget powered by DrapX on a store's product page. That store decides to offer the try-on feature and is the data controller for your shopper data. DrapX AI provides the technology and processes that data on the store's behalf, as a data processor.

For drapx.com itself (this website, our marketing, and merchant accounts), DrapX AI is the data controller. You can contact us directly at privacy@drapx.com, or reach out to the store you were shopping with.

2. What We Collect

Nothing is collected from the try-on widget until you interact with it. When you do, we process:

• Your photo. The picture you upload or capture with your camera, only after you agree on the upload screen.
• Generated images. The AI try-on results created from your photo and the merchant's product image.
• Email address (optional). Some stores use the try-on flow to capture your email for lead generation or marketing. This is disclosed by the store at the point of collection.
• Usage data. Widget interaction events (opened, try-on started, added to cart), the product and page you were on, and technical device and browser characteristics, used for analytics and to enforce merchant plan limits.

If you're a merchant, we also collect your store name, store URL, contact email, and plan/billing status, handled through Shopify's billing system, so we never see your payment card details.

3. How Your Photo Is Used

Your photo is used to generate the try-on image, and for nothing beyond keeping the service safe and reliable:

• AI generation. Your photo and the product image are processed to render a physics-simulated try-on result in about 8.5 seconds.
• No AI training without consent. We do not use your photos or generated images to train AI models unless you separately opt in.
• No identification. We do not use facial recognition and do not create biometric identifiers from your photo. Your photo is not used to determine who you are.

4. How Long We Keep Your Data

• Photos and generated images are automatically and permanently deleted within 10 days of creation, in most cases much sooner. This is the same 10-day limit described in our App Privacy Policy.
• Usage events are retained in our analytics systems for as long as reasonably needed to operate and improve the service, and are deleted or anonymized on a rolling basis.
• Your email, if a store collected one from you, is kept until you or the store asks us to delete it.
• Shared try-on links remain viewable until the underlying images are deleted under the 10-day window above, or until you request earlier deletion.

5. Who Can See Your Data

• The store cannot see your photos. Merchants never get access to your uploaded photos or generated try-on results, even if you share them. If you provide your email, the store receives it, since that's the purpose of the email form.
• Share links. If you use the share feature, anyone who has the link can view that try-on image until it's deleted under the retention window above. Only share it with people you trust.
• Service providers. We use cloud hosting and GPU inference providers to run generation and store data, each bound by a data-processing agreement. We do not sell your personal data and do not share it with anyone for their own advertising.

6. Consent and Tracking Choices

Photo processing happens only on the basis of your consent: you actively agree on the upload screen before choosing a photo. Analytics tracking respects the cookie/consent choices you make on the store's site where the store provides a consent banner (for example, Shopify's customer privacy settings). Data needed to actually run your try-on, such as your photo and the store's remaining try-on quota, is still processed even if you decline analytics, because the feature cannot work without it. You can withdraw consent at any time by contacting privacy@drapx.com.

7. International Data Transfers

DrapX AI is a United States-based, remote-first company, and our infrastructure providers may process data in the United States and other countries. Where personal data is transferred outside your home jurisdiction, we rely on appropriate legal safeguards, such as standard contractual clauses, under our providers' data-processing terms.

8. Your Rights

You can contact us at privacy@drapx.com, or the store you shopped with, to exercise your rights. Depending on your location, these include:

• European Union, UK, and similar regimes (GDPR / UK GDPR): access, rectification, erasure, restriction, portability, objection, and withdrawal of consent.
• United States (CCPA/CPRA and other state privacy laws): the right to know and access, delete, and correct your personal information, and to opt out of the sale or sharing of personal information. We do not sell your personal information.
• Other jurisdictions (for example Canada, Brazil, Australia): the equivalent rights of access, correction, and deletion under your local law.

Because the store may be the data controller for your shopper data, we may coordinate with the store or redirect your request to it where required, but your request will be handled either way. We aim to respond within one month, or sooner where local law requires.

9. Children

The try-on widget is not intended for children under 16 (or the higher age required in your country). Do not upload photos of children. We do not knowingly collect data from children.

10. Data Security

All data is encrypted in transit (TLS) and at rest. Access to production systems is restricted to authorized personnel, and automated deletion jobs enforce the retention limits described above.

11. Changes to This Policy

When we make material changes, we update the date at the top of this page. The version published at drapx.com/privacy is always the current one.

12. Contact

For privacy questions or data requests, contact us at privacy@drapx.com or through our contact page.