genlook

Genlook Privacy Policy

Effective Date:

This Privacy Policy describes how Parakeet Labs SASU, operating as Genlook ("we", "us", "our"), collects, uses, and discloses personal data. It applies worldwide and covers:

  • Merchants: stores using Genlook on Shopify, WooCommerce (WordPress), PrestaShop, or Shopline, including in-store (retail) try-on.
  • API customers: businesses using the Try-On API and its dashboard.
  • Consumer account holders: individuals using Genlook through an AI assistant (MCP) with a Genlook account and prepaid credits.
  • Visitors of genlook.app and our other websites.

If you are a shopper using the try-on feature on a store, the Shopper Privacy Policy applies to you. For shopper data, the store is the data controller and Genlook acts as processor under our Data Processing Agreement.

1. Data we collect

Merchants

  • Shopify and Shopline: at install we store your shop domain and platform access tokens (encrypted). We do not collect the store owner's name, email, or address at install. If you contact support or use the support chat, we receive the contact details you provide.
  • WooCommerce, PrestaShop, and Try-On API: a Genlook dashboard account (email, name), managed through our authentication provider Clerk.
  • Billing data: handled by the billing rail for your platform (see Section 4). We do not store card numbers.
  • Studio and catalog content: product images, and any model photos you upload to generate marketing imagery.
  • Support: emails you send us and chat conversations, including your email address and name.
  • Product usage: how you use the dashboards and in-admin tools (pages viewed, features and assistant tools used, configuration), tied to your shop domain or account.

API customers and consumer account holders

  • Account details (email, name via Clerk), API keys, credit purchases (via Stripe: email, billing country, VAT number where applicable), and the photos you upload for try-on generation, which are subject to the same automatic deletion windows as shopper photos (7 days by default).
  • Your dashboard shows the photos you sent and the results we generated for each of your own generations, so you can review and debug them. They are visible only to your account and disappear from the dashboard when your retention setting deletes them.
  • Technical request data for security and abuse prevention: hashed forms of your IP address, user agent, and request metadata. Raw IP addresses are not stored with generation records.
  • Session recordings of the API dashboard (platform.genlook.app): clicks, scrolls, page views and page layout, recorded with PostHog so we can find and fix usability problems. Images are never recorded, so your photos and try-on results are left out. Form inputs and secrets such as your API key and webhook secret are masked before the recording leaves your browser.

Website visitors

On behalf of merchants (processor role): shopper photos, generated images, optional shopper emails, widget usage events, and conversations with the store's shopping assistant. This processing is described in the Shopper Privacy Policy and governed by the DPA. Merchants never get access to shoppers' photos or generated results; they can read the conversations shoppers have with their store's shopping assistant.

2. How we use personal data

  • Provide and operate the services (virtual try-on generation, dashboards, API).
  • Billing and subscription management.
  • Support and service communications.
  • Product communications and marketing to merchants (you can opt out at any time).
  • Product analytics and service improvement, including dashboard session recordings.
  • Security, fraud and abuse prevention, and error monitoring.
  • Compliance with legal obligations.

AI training: we do not use your content, your customers' photos, generated images, or shopping assistant conversations to train AI models.

Biometrics: we do not use facial recognition anywhere in our services, and we do not create biometric identifiers (faceprints, face templates, embeddings, or scans of face geometry) from any photo, whether uploaded by a shopper, a merchant, or an API customer. The details, including our position under laws such as the Illinois BIPA, are in the "Faces and biometric data" section of the Shopper Privacy Policy and in Annex 1 of our Data Processing Agreement.

3. Legal bases (GDPR / UK GDPR)

Where we act as controller, we rely on:

  • Performance of a contract (Art. 6(1)(b)): operating the service, accounts, billing, support.
  • Legal obligation (Art. 6(1)(c)): accounting and tax retention, responding to lawful requests.
  • Legitimate interests (Art. 6(1)(f)): product analytics, service improvement, security and abuse prevention, error monitoring, and business communications to merchants. You can object at any time.
  • Consent (Art. 6(1)(a)): marketing cookies on our websites and, where required, marketing communications. You can withdraw consent at any time.

4. Billing

We do not store payment card details. Billing runs through:

  • Shopify: Shopify's billing system (app subscriptions billed by Shopify).
  • Shopline: Shopline's billing system, where available.
  • WooCommerce and PrestaShop: Polar, acting as merchant of record.
  • Try-On API and consumer credits: Stripe.

5. Data retention

  • Uploaded photos and generated images (all channels): automatically deleted after the configured retention window, 7 days at most (1 or 3 days where configured). Unprocessed originals are deleted within 1 day.
  • Merchant data (Shopify/Shopline): your access tokens are deleted when you uninstall. About 48 hours after you uninstall our last app, the platform sends us its redaction request, and we then delete everything we hold about your shoppers: shopper records, try-on history, order and refund analytics (in our database and in our analytics warehouse), and your synced catalog. Your store record itself is kept, meaning your settings and installation history, so a reinstall picks up where you left off. What remains is a record of how much our engine ran for your store, with every shopper identifier stripped, which we keep for billing and accounting.
  • Dashboard and API accounts: kept while your account is active; deleted on request at privacy@genlook.app.
  • Billing records: up to 10 years, as required by French accounting and tax law.
  • Usage analytics: widget and storefront events up to 13 months; order and refund analytics up to 3 years; generation logs up to 2 years.
  • Shopping assistant conversations: up to 13 months after the last message, then deleted automatically.
  • Dashboard session recordings: up to 90 days, then deleted automatically.
  • Security and abuse-prevention signals (pseudonymous hashes and scores, never an image): up to 2 years, then deleted automatically.
  • Support communications: for as long as needed to provide support and maintain business records, reviewed periodically.

6. Service providers (subprocessors)

We share personal data with the following providers, only as needed to run the service:

ProviderPurposeLocation
Google Cloud (Storage, BigQuery)Image storage, analytics warehouseEU
Google Cloud (Vertex AI, Gemini)AI image generationGlobal (Google-managed regions)
Comfy CloudAI image generation (specialized engine)US
RunPodGPU hosting for AI image generationEU (US company)
DecartRealtime AI video try-on (live sessions)US
AnthropicAI shopping assistant (chat replies; size recommendations, with the shopper's photo only when they allow it)US
RenderApplication, database, and ML service hostingEU (Frankfurt)
VercelWebsite and dashboard hostingUS
MintlifyDeveloper documentation hosting (genlook.app/docs)US
ClerkDashboard authenticationUS
StripePayments (API and consumer credits)US
PolarMerchant-of-record billing (Woo/PrestaShop)US
Shopify / ShoplinePlatform and billingGlobal
PostHogProduct analytics, dashboard session recordingsEU
SentryError monitoringEU (Germany)
CrispSupport chatEU (France)
Customer.ioMerchant email communicationsEU
ResendDelivery of the emails stores send shoppers via GenlookUS
BouncerChecking a shopper's email can receive mail before a store email is sent (from December 4, 2026)EU
KlaviyoMarketing events, only when you connect itUS
CloudflareCDN for widget files (sees IP addresses in transit)Global

Subprocessor list last updated: November 4, 2026. The providers that process shopper and end-user data on a store's or API customer's behalf are listed in Annex 3 of our Data Processing Agreement.

7. International transfers

We host applications, databases, image storage, our own ML services, and our dedicated AI generation GPUs in the European Union (the GPUs are rented from RunPod, Inc., a US company). Error monitoring (Sentry), product analytics (PostHog), support chat (Crisp), merchant email communications (Customer.io), and shopper email address checks (Bouncer) also run in the EU. Some processing happens outside the EEA: AI image generation on Google Vertex AI uses Google's global serving endpoint, so a given request may be processed in the United States or another Google Cloud region; the specialized Comfy Cloud generation engine is operated from the United States; the Decart realtime video engine is provided by Decart AI, Inc., a US company; the shopping assistant's replies are generated by Anthropic, PBC, a US company; the emails stores send shoppers through Genlook are delivered by Resend, Inc., a US company; and website hosting (Vercel), documentation hosting (Mintlify), authentication (Clerk), and payments (Stripe, Polar) run in the United States. Where personal data leaves the EEA or UK, we rely on appropriate safeguards under Chapter V GDPR, primarily the European Commission's Standard Contractual Clauses in our providers' data-processing terms and, where the provider is certified, the EU-US Data Privacy Framework. Details: privacy@genlook.app.

8. Your rights

European Union, United Kingdom, and similar regimes: access, rectification, erasure, restriction, portability, objection (including to marketing), withdrawal of consent, and the right to lodge a complaint with your supervisory authority. Our lead authority is the French CNIL (cnil.fr).

United States (California CCPA/CPRA and other state laws): the right to know and access, correct, and delete your personal information, and to opt out of "sale" or "sharing". We do not sell personal information and do not share it for cross-context behavioral advertising. Our website marketing cookies load only with your consent in the regions where we ask for it, and elsewhere a Global Privacy Control signal turns them off. We do not discriminate against you for exercising your rights.

Other jurisdictions (for example Canada PIPEDA, Brazil LGPD, Australia Privacy Act): the equivalent access, correction, and deletion rights under your local law.

To exercise any right, email privacy@genlook.app. We respond within one month, or sooner where your local law requires. If your request concerns shopper data controlled by a merchant, we will assist or redirect it to that merchant.

9. Data Processing Agreement

When you offer Genlook try-on to your customers, you are the controller of their data and we process it on your behalf (GDPR Art. 28 and equivalent laws). Our Data Processing Agreement, including security measures and the subprocessor list, is incorporated into our Terms of Service for all platforms. It is published at genlook.app/dpa, with every earlier version and a PDF copy of each.

10. Informing your customers (template)

You should mention the try-on feature in your own store's privacy policy. You can adapt this text:

Virtual Try-On. Our store uses Genlook, a virtual try-on service. If you choose to use it, you will be asked to upload a photo, which is processed by AI to generate a try-on image after you agree on the upload screen. Photos and results are automatically deleted after at most 7 days and are never used to train AI models. No facial recognition is used and no biometric identifiers are created from your photo. We (the store) never receive access to your photos. See the Genlook Shopper Privacy Policy.

11. Cookies and analytics on genlook.app

When you visit genlook.app, a consent banner is shown based on your region (opt-in in the EU/EEA, UK, and Switzerland; notice elsewhere). Where only a notice is shown, a Global Privacy Control signal from your browser turns marketing cookies off.

  • Analytics (loaded only with consent where required): PostHog (EU, via our first-party proxy) and Google Analytics.
  • Marketing (loaded only with consent where required): Meta Pixel and the OpenAI ads pixel, for measuring our ads on those platforms.
  • Support chat: Crisp, loaded only when you open the chat, so no chat cookies are set until you choose to use it.

You can change your choice at any time via the cookie settings link in the site footer. Your choice is remembered for 12 months, after which we ask again.

12. Security

Data is encrypted in transit (TLS) and at rest. Platform access tokens are stored encrypted. Access to production data is restricted and protected with multi-factor authentication. Our security measures are described in Annex 2 of our Data Processing Agreement.

13. Children

Our services are for businesses and adults; you must be 18 or older to hold an account. For protections applying to shoppers, see the Shopper Privacy Policy.

14. Changes to this policy

When we make material changes we update the Effective Date above and, where appropriate, notify you in-app or by email.

15. Contact

Parakeet Labs SASU (operating as Genlook) 4 Rue de la République, 69001 Lyon, France RCS Lyon, SIREN 105 375 349