Privacy policy

Who we are (imprint)

This website and the Reflektit Shopify app are operated by:

Contact, support and privacy requests: contact@reflektit.com

Hamza Chtioui is the controller of the personal data described on this page and is responsible for its content.

In short

• The live camera mirror runs in your browser. Your video, face landmarks and measurements are not sent to us.
• An AI photo preview uses a still photo you choose to upload, and only after you tick the consent box. We pass it to our image provider to create the preview. We never save the result on our servers, and we save the photo only if you separately choose to have it remembered (see Saved photo).
• We do not use your photo to identify you, and we do not build face templates or profiles.
• We do not use advertising or tracking cookies.

Camera mirror

The glasses mirror at /try-on and the embeddable widget process your camera image on your own device. No video frame, face landmark or derived measurement leaves your browser.

When you start the mirror, your browser downloads the face-tracking software from two content delivery networks: jsDelivr and Google Cloud Storage. Those services see your IP address and browser details, as any web server does. They do not receive your camera image.

If you calibrate with a card, the resulting scale values are saved in your browser's local storage so you do not have to repeat the step. They contain no image and no landmarks. You can remove them with the widget's clear option or by clearing site data.

AI photo previews

The glasses photo preview and the clothing preview create an AI image from a still photo that you select. Nothing is sent until you choose a photo and tick the consent box shown next to it.

When you generate a preview we receive:

• the photo you uploaded,
• the product image you selected,
• for clothing only, the body details you typed in (for example height and build).

We forward these to our image provider to create the result and return it to your browser. We hold them in memory for the duration of that request and do not store the body details or the generated image in our database. We do not store the photo either, unless you choose the saved photo option described below.

Saved photo (optional)

Where a store offers it, the photo preview asks, as its own step, whether you want your photo saved as a try-on profile so that you do not need to upload it again. Nothing is saved unless you press the button to save it. It is separate from the consent to generate, and the preview works the same if you choose not to.

If you save it, we store the prepared photo, with its location and camera metadata already removed, in encrypted form for that one store. The same step lets you add, if you wish, a second full-length photo and body details chosen from fixed options (gender, a body shape, height and weight). You can see, change or delete all of it under "My profile" in the same window. These are optional, are stored only if you added them before saving, and are kept and deleted together with the photo. Body details are sent to the image provider only when you try clothing or shoes without a full-length photo: the preview is then a full-length picture drawn from your first photo, and the details guide the build of the drawn body. The window tells you before you agree. It is not linked to a name, an email address, a customer account or your IP address. The key that unlocks it is a random value kept in your browser's storage for that store's website; we keep neither the key nor a copy of it, so the stored photo can only be opened while your browser presents that key, and it is not available on another device or another store. We do not derive face landmarks, measurements or templates from it and never use it to identify you.

A saved photo is deleted automatically after the period shown at that step, 90 days unless stated otherwise, and reading it does not extend that period. You can delete it at any time with Forget my saved photo in the same popup. It is also deleted when the store removes the service. Because the photo is not linked to your identity, we cannot find it from your name or email: deletion works from the browser that saved it, and clearing that browser's site data makes the stored copy permanently unreadable until it expires. Do not use this option on a shared device.

Where a store offers it, you can instead press "Continue with Google" to keep the profile on every device. Google confirms who you are to us; we use that only to work out the key that unlocks your profile for that store, and we do not store your Google account, email address or name. Google learns that you signed in to Reflektit. You can sign out on a device at any time, and delete the profile as above.

A saved photo is still sent to the image provider only when you tick the consent box and generate a preview.

Style suggestions (optional)

Where a store offers it, the photo preview lets you pick an occasion and shows that store's products that suit it first. Picking an occasion sends us the occasion and the list of products the page offers, nothing about you. If you also tick the box to use your photo, we send that photo and any body details you entered to our suggestion provider with that one request, so that the clothes you are wearing and the details you gave can be taken into account. The provider is instructed to look only at the clothing and accessories in the photo and returns only a list of products. We do not store the photo, the details or the suggestions.

Chat with the stylist (optional)

Where a store offers it, you can type questions to a stylist that answers from that store's products and can put an outfit together. Each message you type is sent, with the products you are looking at and the outfit so far, to our text provider so that it can answer. No photo or body detail is sent with the chat. The provider is instructed not to describe or guess anything about you. We do not store the conversation, but the provider may keep the messages in its own records, so please do not type personal details. The window says so next to the message box.

On a website that uses our dashboard, the stylist keeps short notes of the style you describe, such as colours you like. They are forgotten when you close the window unless you tick "Remember my style notes on this device". The notes are then kept in your browser's local storage and go only with your own later messages to the stylist. If you have also saved a try-on profile on that website, the notes are kept in it too, encrypted in the same way and for the same period, so they follow you when you sign in on another device; deleting the profile deletes them. The stylist is instructed to note only what you say about clothes, never anything about your body or appearance, and you can remove any note from the chat. Untick the box, or clear your browser's site data, to erase them. We rely on your consent for this (Art. 6(1)(a) GDPR and the consent rule for storing information on your device).

Our image and text providers may keep the inputs and results in their own history. See Who receives data.

We record that a generation happened: its time, duration, outcome, the AI model used and what it cost us. This record does not contain your photo, your IP address or anything that identifies you.

On stores that use Reflektit through a website integration, the preview window also keeps some things in your own browser, never on our servers: the photo, full-length photo and details you are working on, in session storage until you close the tab, so a reload does not lose them; and your finished previews, in your browser's database for 7 days (the 12 most recent), so you can look back at them. They are removed when you delete your saved profile, and you can remove them at any time by clearing this site's data in your browser. On Shopify, YouCan and Zid stores nothing is kept in your browser.

The result is an AI-created appearance preview. It is not a measurement of you and does not confirm fit or size.

Reflektit for Shopify

Information we collect through Shopify

The app requests the read_products permission only. From a store that installs it we read the shop name, its myshopify.com and primary domains, and the names, variants, status and images of its products. We do not request or receive Shopify customer or order data.

For a store that Reflektit has enabled for the stylist chat, we keep a copy of its published eyewear product titles, prices and image addresses, refreshed every few hours, so that the stylist can answer from that store's own products. The copy is deleted when the merchant uninstalls the app.

Information we collect from the merchant

We store the store's access token in encrypted form, the installation's settings (whether previews are enabled), and a session that lets the merchant use the app. Subscription status is read from Shopify; payment is handled entirely by Shopify.

Information we collect from shoppers

A shopper on a merchant's product page can upload a still photo to preview the selected glasses. This works exactly as described under AI photo previews: explicit consent first, no storage of the result by us, and no storage of the photo unless the shopper chooses the optional saved photo.

If the shopper adds the glasses to the cart from a finished preview, we record the Shopify variant ID, the action and the time for that store. This is not linked to a Shopify customer, an order, the photo or the shopper's identity.

Live video try-on for glasses is offered only on stores Reflektit has enabled for it and whose merchant switched it on. The shopper must first tick a separate, unticked consent box. Their live camera video and the selected product's image then go from their browser directly to Decart, an AI video service, which may keep them under its own terms. Reflektit receives no video and stores nothing from the session; we record only that a session started, for the store's usage and cost. Each session stops after 60 seconds.

The stylist chat is offered only on stores Reflektit has enabled for it. The messages a shopper types and the products in view go to our configured text model, which answers, as described under Chat with the stylist. The provider may keep the messages in its usage log; Reflektit does not store them. On Shopify the stylist reads no photo and keeps no style notes.

The storefront button sets no cookies.

How we use it

To show the correct product in the preview, to generate the preview the shopper asked for, to show the merchant how often previews were used and how many remain in their plan, and to keep our provider costs within limits.

Uninstalling and deletion

When a merchant uninstalls the app we disable the installation and delete its access token and sessions immediately. When Shopify sends its shop-erasure request (about 48 hours after uninstall) we delete the installation record and its add-to-cart events. The product copy kept for the stylist chat is deleted when the merchant uninstalls. Shopify's customer data requests are acknowledged; we hold no Shopify customer records to return or erase.

Reflektit for YouCan, Zid and Salla

From a store that installs our YouCan, Zid or Salla app we read the store's name and domain and its products' names, categories and images (and on Zid and Salla their prices), and we store an encrypted access token and the merchant's settings. We do not request customer or order data. On Zid and Salla we keep a copy of the store's product details so that the storefront does not have to ask the platform on every page view; it is refreshed when products change.

Shoppers on these stores can upload a still photo, a portrait for glasses or a portrait or full-length photo for clothing, to create an AI preview of the selected product. It works as described under AI photo previews, with consent before each generation, but with no saved photo and no body details. Nothing is kept in the shopper's browser. The live 3D try-on on Zid and Salla runs entirely in the browser. On Zid and Salla stores that we have enabled for it, the stylist and its chat are offered as described under Style suggestions and Chat with the stylist.

Our storefront script does not read the platform's shopper account information. Uninstalling the app deletes the store's record, token and product copy. Platform-specific notices are at /youcan/privacy, /zid/privacy and /salla/privacy.

Merchant dashboard accounts

If you create a dashboard account we store your name, your email address and a salted hash of your password. We also store what you add to the account: registered websites, webhook settings, API keys (as hashes) and product catalogue data including product images.

Signing in sets one strictly necessary session cookie, valid for seven days. The dashboard also remembers which view you had open in your browser's session storage.

You can delete your account and its data yourself with Delete account in the dashboard, after entering your password again. This removes the account, its websites with their products, keys and webhooks, and the try-on profiles shoppers saved on those websites. You can also write to contact@reflektit.com.

Technical data

Like every website, our server receives your IP address, the page requested, the time and your browser's user agent when you visit. This appears in server logs used to operate and secure the service.

To prevent abuse and control costs we count requests per IP address, for example sign-in attempts and photo generations. We store each counter under a keyed hash, so the IP address itself is not kept. A counter is deleted when its window ends, which is at most 24 hours.

When you open our home page, our network provider Cloudflare tells our server which country your connection comes from. We use it only to show the page in a matching language, and keep neither the country nor your IP address. If you then choose another language from the page’s language menu, a cookie named reflektit_lang remembers that choice in your browser for one year; it holds only the language code.

We use no analytics service, advertising network or social media plug-in on this site.

Who receives data

• Image generation. Uploaded photos and product images are sent through Aigen, our own image gateway, which runs on our server and passes them to Google's Gemini models on Google Cloud Vertex AI. The gateway is set not to keep Reflektit's photos, results, prompts or messages; it records only the time, model and cost of each request. Google may keep inputs and results under its own terms. Depending on the model's region, Google may process them outside the European Union. Where we have configured it instead of, or as a fallback for, that gateway, the same inputs go to OpenAI's image models, which process them under OpenAI's terms and may do so outside the European Union. Where we have configured Runware (Runware Ltd, England), the same inputs go to Runware, which runs Google's Nano Banana image models and processes them under Runware's terms. Runware does not publish how long it keeps inputs and results, and it may process them in the European Union or the United States. The consent box names the provider before anything is sent.
• Preview quality check. Where enabled, before a clothing preview is shown, your photo, the product image and the generated result are sent to OpenAI to check that the result is usable. It returns only a verdict. We ask it not to store the request.
• Stylist chat. Where a store offers it, the messages you type, with the products in view and the store's product descriptions, are sent through the Aigen gateway to Google's Gemini models, or to OpenAI. The gateway does not keep them. When OpenAI is used we ask it not to store the request.
• Style suggestions. Where a store offers them and you tick the box to use your photo, the photo, your body details and the product list are sent to OpenAI, which processes them under its own terms and may do so outside the European Union. We ask it not to store the request.
• Live video try-on. Where a store offers it and you tick its separate box, your live camera video and the product image stream from your browser directly to Decart, which may keep them under its own terms. Reflektit receives no video.
• Hosting. Our application and database run on a server located in Frankfurt am Main, Germany.
• Shopify, YouCan, Zid and Salla. For stores using our apps on those platforms, the platform provides the store, product and subscription information described above.
• Content delivery. jsDelivr and Google Cloud Storage deliver the face-tracking software for the camera mirror. Each of these services receives your IP address when your browser fetches the files.

Where Google or OpenAI processes data outside the European Economic Area, the transfer is covered by their data processing terms, which incorporate the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR), and, for transfers to the United States, by the provider's certification under the EU-US Data Privacy Framework (Art. 45 GDPR). You can ask us for a copy of the relevant safeguards at contact@reflektit.com.

We do not sell personal data and do not share it for advertising.

How long we keep it

Values saved in your own browser stay there until they expire or you clear them: card calibration until cleared; a preview in progress until you close the tab; finished previews for 7 days.

Legal bases

Where the EU General Data Protection Regulation (GDPR) applies, we rely on:

• Your consent (Art. 6(1)(a) GDPR) for processing a photo you upload for an AI preview. You can withdraw consent at any time for the future by not generating further previews and by contacting us. A saved photo is stored on the same basis, under its own separate consent, which you withdraw by deleting it in the popup.
• Your explicit consent (Art. 9(2)(a) GDPR) where a photo or the body details you enter may reveal special categories of personal data, for example health information from a weight, or ethnic origin or religious beliefs from a photo. We ask for it in the same consent box, which says so, and we use these data only to create the preview or suggestions you asked for, never to draw conclusions about you. Previews and the stylist are for adults: the consent box asks you to confirm that you are 18 or older, and the stylist chat says it is for adults only.
• Performance of a contract (Art. 6(1)(b) GDPR) for merchant accounts and the Shopify app.
• Legitimate interests (Art. 6(1)(f) GDPR) in operating a secure service, preventing abuse and controlling costs, for server logs and request counters.

Your rights

You may ask us for access to your personal data, for its correction or deletion, for restriction of processing, and for a copy in a portable format. You may object to processing based on legitimate interests and withdraw a consent you gave. Write to contact@reflektit.com; we answer within one month.

If you used a preview on a merchant's store, you can also contact that merchant.

You have the right to complain to a data protection supervisory authority. The authority responsible for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit.

Changes to this policy

We update this page when the service changes how it handles data. The date at the top shows the latest version.