Privacy Policy for Shoppers

Applicable to the Genlook virtual try-on experience

You are reading this because you used, or are about to use, a virtual try-on experience powered by Genlook. This can happen in two places:

• In an online store, when you tap "Try it on" on a product page. The store you are visiting has installed Genlook.
• In a physical store, when you scan a QR code that opens a Genlook try-on page in your browser.

This policy explains what data is processed, by whom, and what your choices are. It is written for everyone, wherever you are in the world.

1. Who is responsible for your data

The store you are shopping with (online or physical) decides to offer the try-on feature and is the data controller for your data. Genlook (Parakeet Labs SASU, 4 Rue de la République, 69001 Lyon, France) provides the technology and processes your data on the store's behalf, as a data processor. You can contact either the store or us directly at privacy@genlook.app.

2. What we collect

Nothing is collected until you interact with the try-on feature. When you do, we process:

• Your photo. The picture you upload or take with your camera, only after you agree on the upload screen. We prepare it for try-on (for example, detecting the person in the frame and cropping the image).
• Generated images. The AI try-on results created from your photo.
• Email address (optional). Some stores ask for your email to unlock try-ons or send you results. Marketing use of your email requires a separate, unticked checkbox, and your choice is recorded.
• Usage data. A random identifier stored in your browser, a session identifier, the events you trigger in the widget (opened, try-on started, added to cart), the product and page you were on, your country (derived from your IP address, which we do not store in our analytics), and technical device and browser characteristics. These identifiers are random values: they tell us that the same browser came back to the same store, not who you are.
• Order reference. When you add a product to your cart on a store that uses Genlook, that same random identifier is attached to the cart or checkout, so the store can tell that one of its orders followed a try-on on its own site. On PrestaShop stores it is kept in two first-party cookies (genlook_anon and genlook_session) that expire after 7 days; on the other platforms it travels with the cart or checkout data and sets no cookie. It carries no name, email, address, or profile.
• Safety and anti-abuse signals. To keep the service safe and prevent fraud, we compute technical signals when you run a try-on: content fingerprints of images (hashes that let us recognize a repeated image without storing the image itself), technical photo metadata, a hashed device signal, and hashed forms of your IP address. Raw IP addresses are never stored with these signals.

3. How your photo is used

Your photo is used to generate the try-on image, and for nothing else beyond keeping the service safe:

• AI generation. Your photo and the product image are processed by AI models to render the result. Depending on the product, this runs on Google Cloud (Vertex AI and Gemini models) or on Comfy Cloud, a specialized generation provider. These providers process your photo transiently to produce the result and do not use it to train their models.
• Automated safety screening. Before generation, our own service (hosted in the EU) automatically checks photos to block inappropriate content and to prevent the use of photos of children. These checks produce scores only; no facial template or embedding is stored.
• No AI training. We do not use your photos or your generated images to train AI models.
• No identification. We do not use facial recognition and we do not create biometric identifiers. Your photo is not used to identify who you are.

4. How long we keep your data

• Photos and generated images are automatically and permanently deleted from our servers after 7 days at most. If the store that brought you here uses a shorter window, the number above reflects it. Unprocessed originals are deleted within 1 day.
• Usage events are kept in our analytics systems for up to 13 months.
• The identifiers stored in your browser stay there until you clear your browser data. The PrestaShop attribution cookies expire on their own after 7 days.
• Safety and anti-abuse signals (hashed, non-identifying) are kept separately from your photos for as long as needed to prevent abuse of the service.
• Your email, if you provided it, is kept until you or the store ask us to delete it.

You do not have to wait: the widget includes a "delete my data now" control (in your try-on history) that immediately deletes your photos, generated images, try-on records, share links, and analytics events from our systems.

5. Who can see your data

• The store cannot see your photos. Merchants never get access to your uploaded photos or your generated try-on results, even if you share them. If you provide your email, the store receives it (that is the point of the email form). The store also sees the random reference described above on its own orders, which tells it that an order followed a try-on.
• Share links. If you use the Share feature, we create a link to your try-on image. Anyone who has that link can view the image until the link expires (7 days at most) or until you delete your data. Only share it with people you trust.
• Genlook processes your data to operate the service, as described in this policy.
• Service providers. We use Google Cloud (image storage in the EU, AI generation, analytics warehouse in the EU), Comfy Cloud (AI generation), PostHog (usage analytics, EU), and Render (application hosting, EU/Frankfurt). We do not sell your personal data, and we do not share it with anyone for their own advertising.

6. Consent and tracking choices

Using the try-on is a deliberate act, and it is what sets this policy in motion. Until you open it, none of this happens: no photo, no try-on record, no try-on analytics. The screen where you start says that by continuing you agree to this policy, and tapping it is your agreement to what this section describes.

• Your photo is processed only on the basis of that agreement. You actively agree before choosing a photo, and your agreement is recorded.
• Your try-on activity. The events of the try-on you chose to run (widget opened, photo added, result shown, shared, added to cart) are recorded under that same agreement. We use them to operate the feature, to keep it safe, and to give the store figures on how its own try-on feature performs. They are never used for advertising, never sold, and never combined into a profile of you across different stores.
• The store's cookie banner. Where the store shows a consent banner (for example Shopify's customer privacy settings) and you decline analytics, we stop the analytics we would otherwise collect about your browsing of that store, meaning the pages and products you look at outside the try-on, and we delete the analytics identifiers we had stored in your browser. Declining there does not turn the try-on off. If you then choose to open the widget and run a try-on, that try-on and its own activity are processed on the basis of your agreement above, because the feature cannot work without them.
• What continues whatever you answer. The random, store-scoped reference described in section 2 is written when you use the try-on or add a product to your cart, regardless of the banner. It is a functional identifier: it is what lets us hand you back your own results and history, count your remaining try-ons, and let the store attribute its own orders to its own try-ons. It is first-party and specific to that single store, it is never read on other websites, never shared with advertisers, and never sold. We rely on the store's legitimate interest in running and measuring its own feature for this, not on marketing consent.
• What never happens, whatever you answer. We do not build advertising profiles, we do not follow you across other websites, we do not sell your data, we do not use your photo to recognize you, and we do not train AI models on it. Nothing that identifies you by name reaches us unless you type it in yourself, for example in the optional email form.
• Withdrawing. You can stop at any time by using "delete my data now" in the widget, by writing to privacy@genlook.app, or simply by not using the try-on again. Withdrawal does not affect processing that happened before it.

7. International transfers

Your photos are stored in the European Union. The AI generation step runs on Google Cloud (Vertex AI and Gemini models), which serves generation requests globally, so your photo may be processed in the United States or another Google Cloud region. For some products it runs instead on Comfy Cloud, a specialized generation provider operated from the United States. Where your data leaves the EU, these transfers are protected by appropriate safeguards under EU law, such as the European Commission's Standard Contractual Clauses in our providers' data processing terms and, where the provider is certified, the EU-US Data Privacy Framework.

8. Your rights

Wherever you are, you can use the in-widget deletion control or contact privacy@genlook.app (or the store) to exercise your rights. Depending on your location, these include:

• European Union, United Kingdom, and similar regimes (GDPR / UK GDPR): access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and the right to complain to your local data protection authority. Our lead authority is the French CNIL (cnil.fr).
• United States (California CCPA/CPRA and other state privacy laws): the right to know and access, delete, and correct your personal information, and the right to opt out of "sale" or "sharing" of personal information. We do not sell your personal information and do not share it for cross-context behavioral advertising. We honor the Global Privacy Control signal where consent banners are geo-enabled. You will not be discriminated against for exercising your rights.
• Other jurisdictions (for example Canada PIPEDA, Brazil LGPD, Australia Privacy Act): the equivalent rights of access, correction, and deletion under your local law.

Because the store is the data controller, we may coordinate with the store or redirect your request to it where the law requires; either way, your request will be handled. We respond within one month (or the shorter period your local law requires).

9. Children

The try-on feature is not intended for children under 16 (or the higher age required in your country). Do not upload photos of children. Our automated safety screening is designed to block photos of children from being processed.

10. Changes to this policy

When we make material changes, we update the date at the top of this page. The version published at genlook.app/privacy/widget is always the current one.

11. Contact

Genlook (Parakeet Labs SASU), 4 Rue de la République, 69001 Lyon, France privacy@genlook.app