Privacy Policy
VEXORMA (vexorma.com) Last updated: 12 November 2026 · Version 2026-11-12-r8
This policy explains what personal data we process when you use VEXORMA, why, for how long, and what rights you have. It follows Articles 13 and 14 of the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Italian Privacy Code (D.lgs. 196/2003).
VEXORMA is a closed pre-release research pilot. It is a virtual try-on tool: you add a photo of yourself and a garment (a screenshot, a product link, or a product you pick from the shop search), and an AI model creates a preview image.
1. Who is responsible (the controller)
AmirMohammad Farhang, private individual Turin, Italy VAT no.: none (private individual) Privacy contact: privacy@vexorma.com
We have not appointed a Data Protection Officer because the law does not require one for our activity. Write to the address above for anything about your data.
2. The short version
| What | Why | Legal basis | How long |
|---|---|---|---|
| Your photo | Create try-on images | Your consent (Art. 6(1)(a) GDPR) | Stays on your device. We do not store it on our servers. |
| Screenshot of a garment | Find and crop the garment, then create the image | Providing the service you asked for (Art. 6(1)(b)) | Processed in memory, not stored by us. |
| Shop search (the words you search for, product pictures) | Show you real products from online shops so you can pick a garment | Providing the service you asked for (Art. 6(1)(b)) | Search words are not stored in your account or our logs. Results are cached for up to 10 minutes, not linked to you. |
| Product pictures on the start screen | Show real winter products when you open the app, so there is something to try on | Our legitimate interest in showing real products (Art. 6(1)(f)) | Not stored by us. Your IP address reaches Shopify when your browser loads the pictures. |
| Your Google account (id, email, name, picture) and credit balance | Sign you in, count free try-ons and bonuses, prevent abuse | Providing the service (Art. 6(1)(b)); legitimate interest in preventing abuse (Art. 6(1)(f)) | Until 12 months after your last visit, or until you delete your data |
| Waitlist consent record (timestamp and wording version) | Remember that you asked to be contacted about a paid plan, and grant the one-off bonus | Your consent (Art. 6(1)(a)) | Until you leave the waitlist or delete your data |
| Hashed IP address, rate-limit counters | Security and abuse prevention | Legitimate interest (Art. 6(1)(f)) | IP hash 30 days; counters 24 hours |
| Usage statistics (counts of visits, sign-ups, try-ons and taps on shop links) | Learn whether the product is used and what it costs us to run | Legitimate interest (Art. 6(1)(f)); you can switch it off in the app | Raw events 90 days; after that only totals that identify no one |
| Messages you send us | Reply to you | Art. 6(1)(b) or (f) | 12 months after the matter is closed |
We do not sell your data. We do not use your photo to train AI models. We do not use face recognition or try to identify you from your photo. We do not make decisions about you by automated means that have legal or similarly significant effects.
3. Details
3.1 Your photo
You choose a photo of yourself. It is stored only in your browser (IndexedDB). When you press generate, the photo is sent from your device through our server to our AI provider to create the preview, and the result is returned to you. Our server does not write the photo or the result to a database, file or log.
You must tick a consent box before your first upload. This is the consent in Art. 6(1)(a) and, to the extent a photo could reveal information in a special category (for example racial or ethnic origin or health), Art. 9(2)(a) GDPR. We do not analyse a photo to infer such information. You can withdraw consent at any time by using Manage my data → Delete my data or by writing to us. Withdrawing does not affect processing already done. Without this consent you cannot use the try-on.
Only upload a photo of yourself. Do not upload photos of other people or of anyone under 18.
3.2 Garment screenshots
You add a garment as a screenshot, by pasting a product link, or by picking a product from the shop search.
- Screenshot: we send it to
fal.aito detect and crop the garment, then to the try-on model. We do not store it. A screenshot can accidentally show notifications or account details: please crop these out before uploading. - Pasted link: on your instruction our server requests that single product page once, reads the product image, and passes the image to the try-on model. We do not crawl retailer sites, we do not store the page or the image, and we do not send your link to any other service. If the retailer's site blocks the request we do not try to get around it; we ask you to add a screenshot instead. Our logs keep only the website's host name, not the full link.
3.2A Shop search (products from real shops)
The start screen has a shop search panel, and also shows a winter grid. Both search the product catalogue run by Shopify, which covers many online shops. We do not keep our own catalogue of products or images.
- What we send to Shopify. The words you search for when you use the search box, and a fixed country setting (Italy). For the start screen we send only a fixed set of winter searches that is the same for every visitor and contains nothing about you. We do not send your name, email address, Google account details, IP address or photo. Shopify also receives our server's own network address and an identifier for VEXORMA as the app that is asking.
- What comes back. Product names, prices, pictures, shop names and links. We show them to you and do not store them. To keep the service fast and within Shopify's limits we hold each set of results for up to 10 minutes in a shared cache that is not linked to you. We do not store your search words in your account or write them to our logs.
- Start screen. When you open VEXORMA we show a selection of winter clothing from shops that Shopify lists as shipping from Italy. The selection is made automatically and is the same for every visitor; shops do not pay to appear. Because the pictures load when the page opens, Shopify can see your IP address even if you never tap a product. The basis is our legitimate interest (Art. 6(1)(f)): without it the start screen would be empty. You can object (section 8), and you can block third-party images in your browser; the app still works with your own garment.
- Pictures. Your browser loads the product pictures directly from Shopify's servers, so Shopify can see your IP address and basic browser details, as with any website you visit. We ask your browser not to tell Shopify which page you were on.
- If you pick a product. We send its picture to our AI provider to create the preview, exactly like a garment picture you add yourself (section 3.2). The result shows the name of the shop and a link to the product page.
- Links. When you follow a link you leave VEXORMA and the shop's own privacy and cookie policies apply. The link is the one Shopify provides, with any attribution parameters it contains left unchanged, so that the shop can tell the visit came through an app built on Shopify's catalogue. We add no tracking parameters of our own to these links. We do count that a link was tapped and the shop's domain name (section 3.6); we cannot see what you do on the shop's site.
Please do not type personal information into the search box. Shop search is optional: without it you can still add a screenshot or paste a link. We do not use your searches to build a profile about you.
3.3 Google sign-in and credits
To use the free try-ons you can stay anonymous, identified only by a keyed hash of your IP address, or sign in with Google. If you sign in we receive your Google account id, email address, name and profile picture. We store the id and email with your credit balance so the same account keeps its free fittings and any bonus across browsers. We do not receive your Google password and we do not access your mail, contacts or files.
3.4 Waitlist
When you run out of free try-ons we offer a waitlist for a paid plan that does not exist yet. Signing in with Google also adds you to the waitlist — we say so on the sign-in button and in the account panel before you sign in. We store a consent record on your account (the timestamp and the wording version shown to you) and we grant 5 extra try-ons once per account. If you leave and rejoin, you do not receive the bonus again. There is no confirmation email and we do not email you today. You can leave the waitlist at any time from the credits panel: the record is deleted and you keep the 5 try-ons, so leaving stays free.
3.5 Security and abuse prevention
To stop people farming free credits and to protect the service we keep: a keyed hash of your IP address (we never store the plain IP in our database), rate-limit counters, and keyed hashes of your email address and device ID that record that a waitlist bonus was already claimed. These hashes let us honour a deletion request without letting the same person claim the bonus again. This is our legitimate interest in preventing abuse; you can object (section 8). We keep these hashes for up to 24 months.
Our hosting provider and infrastructure keep technical logs (time, URL path, status code and the IP address your request came from) for up to 30 days for security and troubleshooting. Logs do not contain images.
3.6 Usage statistics
We keep our own simple record of how VEXORMA is used, so that we can tell whether it is useful and what it costs to run. It is our own system, hosted by First-party counters on our own Cloudflare account (no third-party analytics). It is not a third-party analytics service, it sets no cookies, it does not follow you across other sites and it shares nothing with advertisers.
- What we count. That a page was opened (with the website you came from and any campaign tag in the link, and your country, which we work out from your IP address without keeping the address), your device and browser type in broad classes such as "iPhone Safari", sign-ups and waitlist signups, that you passed the first-upload notice, that a photo was added, that a try-on started, finished or failed (with how long it took and which kind of garment source it used), that you downloaded or shared a result, that you ran out of free credits, searches in shop search (that one happened and how many results it returned), and taps on links to shops (that a tap happened and the shop's domain name).
- What we never put in these statistics. Your photo or screenshot, the words you searched for, the full address of any product page you pasted or tapped (only the shop's domain), your email address or name, your IP address and the exact browser description.
- How it is linked to you. Each event carries your random device ID (and your account ID if you signed in) and a code made from your IP address and browser type that changes every day, so it cannot be used to follow you from one day to the next. We keep these events for up to 90 days so that we can see whether people come back. After that we keep only totals that identify no one.
- Your choice. You can switch usage statistics off at any time under Manage my data → Usage statistics. We then stop recording your visits and actions. Free credits, abuse limits and security keep working as before, because they are needed to run the service. Delete my data also removes the events linked to your device ID and account.
- Legal basis. Our legitimate interest (Art. 6(1)(f)) in knowing whether the service is used and what it costs. We keep the data minimal, short-lived and out of any profile, and we offer the switch above. You can also object (section 8).
- What we cannot tell. We count that a link was tapped. We cannot see what you do on the shop's website, and we do not know whether you buy anything.
3.7 Messages to us
If you email us we use your address and message to reply and keep a record for 12 months after we close the matter.
3.8 Affiliate links to retailers
Some links to retailer products may earn us a commission. We do not send the retailer any data about you. When you click, you leave VEXORMA and the retailer's own privacy and cookie policies apply. Products from shop search (section 3.2A) currently earn us no commission, because we are not enrolled in a commission programme with Shopify. If that changes, we will say so here before it takes effect.
4. Who receives your data (processors and recipients)
We use service providers who process data on our instructions under a data processing agreement:
| Provider | What they do | Where |
|---|---|---|
| fal.ai | Runs the AI try-on models and delivers the result | United States |
| Shopify | Answers your shop search and delivers product pictures to your browser | Outside the EU/EEA (see section 5) |
| fal.ai | Detects and crops the garment in your screenshot | United States |
| Cloudflare, Inc. | Hosts the website and API | United States / EU edge network |
| Cloudflare Durable Objects | Stores account ids, credits and waitlist consent records | European Union (jurisdiction set in the Cloudflare dashboard) |
| Google Ireland Limited / Google LLC | Sign-in only; confirms who you are | Ireland / United States |
| Cloudflare Email Routing (receives messages sent to our contact addresses; we do not currently send email) | Sends confirmation and unsubscribe emails | Cloudflare global network |
| First-party counters on our own Cloudflare account (no third-party analytics) | Runs our own cookie-free usage statistics (section 3.6) | Cloudflare global network |
The try-on models run as API endpoints on fal.ai's infrastructure in the United States. We send only the images, never your name, email or account details.
Shopify is a separate company that runs the product catalogue behind shop search. It receives your search words to answer them, and your browser contacts its servers directly to load product pictures. Shopify is responsible for its own processing of that data under its privacy policy.
We configure our requests to fal.ai so that fal does not store the request payloads and so that generated images on its network expire shortly after creation. We do not give your data to anyone else except where the law requires it (for example a court order).
5. Transfers outside the EU/EEA
fal.ai is based in the United States. Where data goes to a country without an EU adequacy decision for that recipient, we rely on the European Commission's Standard Contractual Clauses and the provider's data processing terms under the European Commission's Standard Contractual Clauses contained in the provider's data processing terms. You can ask us for a copy of the safeguards using the contact in section 1.
Shopify is a global company with operations outside the EU/EEA (for example in Canada and the United States). Data you send to it through shop search, and requests your browser makes to its servers, may be processed there under the safeguards Shopify describes in its own privacy policy and terms.
6. How long we keep data
| Data | Retention |
|---|---|
| Photo | On your device until you delete it. Not stored on our servers. |
| Generated image | Returned to you; not stored by us. Any temporary copy on our AI provider's network is set to expire within about an hour. |
| Shop search words and results | Search words are not stored in your account or our logs. Results are cached for up to 10 minutes in a shared cache, not linked to you. Product pictures are not stored by us. |
| Google account id, credit ledger, consent records | Until 12 months after your last visit, or until you delete your data |
| Waitlist consent record | Until you leave the waitlist or delete your data |
| IP hash | 30 days; rate-limit counters 24 hours |
| Hashes recording that a bonus was claimed | Up to 24 months |
| Raw usage events (with the device ID, account ID and daily visitor code attached to them) | 90 days, or until you delete your data. After that only totals that identify no one |
| Server logs | 30 days |
| Support messages | 12 months after the matter is closed |
7. Security
We use HTTPS, limit access to production systems, keep keyed hashes instead of raw identifiers where we can, and avoid storing images at all. No system is perfectly secure; if a breach affecting you occurs we will notify you and the authority where the law requires.
8. Your rights
You can ask us at any time to:
- access your data and get a copy;
- correct inaccurate data;
- erase your data ("Manage my data → Delete my data" does this for the data we hold about your device; for email requests write to privacy@vexorma.com);
- restrict processing;
- receive your data in a portable format where the processing is based on consent or contract;
- object to processing based on our legitimate interest (sections 3.5 and 3.6);
- withdraw consent whenever processing is based on consent (photo, waitlist email), without affecting what happened before.
We answer within one month. To protect you we may ask you to prove the request comes from your device or email address; because we hold no account details, we may only be able to find data that you can link to your device ID or email.
Complaints. You have the right to complain to a supervisory authority. In Italy this is the Garante per la protezione dei dati personali (garanteprivacy.it). You can also complain to the authority in the EU country where you live or work.
9. Providing data: what is required
Giving us a photo and a screenshot is necessary to use the try-on; without them we cannot create an image. Using shop search is optional; you can always add your own screenshot or link instead. Giving us your email is optional and only needed for the waitlist bonus. Everything else on this page happens in the background and is needed to run and protect the service.
10. Children
VEXORMA is for adults only (18+). We do not knowingly process data of minors. If you think a minor has used the service, write to privacy@vexorma.com and we will delete the data.
11. Cookies and similar technologies
We set only strictly necessary cookies: the Google sign-in session and a short-lived anti-CSRF cookie for the sign-in redirect. Everything else is strictly necessary browser storage. See the Cookie Policy.
12. Changes
If we change this policy in a way that matters to you we will update the date above and, where the change affects consent, ask you again. Older versions are available on request.
Appendix A — Short notices shown in the app
These are the layered "just-in-time" notices that the app shows at the point of collection. They summarise this policy and link to it.
First photo upload (EN)
Your photo stays on your device. For each try-on it is sent briefly to our AI provider to create the image, and we do not store it. We don't use it to train AI and we don't identify you from it. Details: Privacy Policy.
First photo upload (IT)
La tua foto resta sul tuo dispositivo. Per ogni prova viene inviata per pochi istanti al nostro fornitore di IA per creare l'immagine e noi non la conserviamo. Non la usiamo per addestrare modelli di IA e non ti identifichiamo da essa. Dettagli: Informativa sulla privacy.
Waitlist form (EN)
AmirMohammad Farhang, private individual will use your email to send a confirmation and one message when credit packs launch. Basis: your consent. We keep it until the launch email or 12 months, and 7 days if you don't confirm. You can unsubscribe any time and keep your credits. Details and your rights: Privacy Policy.
Waitlist form (IT)
AmirMohammad Farhang, private individual userà la tua email per inviarti una conferma e un solo messaggio quando i pacchetti di crediti saranno disponibili. Base giuridica: il tuo consenso. La conserviamo fino all'email di lancio o per 12 mesi, e per 7 giorni se non confermi. Puoi annullare l'iscrizione in qualsiasi momento e tenere i crediti. Dettagli e diritti: Informativa sulla privacy.
Start-screen product grid (EN), always visible under the grid
Products shown live from Shopify shops, selected automatically; shops do not pay to appear. Pictures load from Shopify's servers, so Shopify can see your IP address. Privacy Policy.
Start-screen product grid (IT)
Prodotti mostrati in tempo reale da negozi Shopify, selezionati automaticamente; i negozi non pagano per apparire. Le immagini si caricano dai server di Shopify, quindi Shopify può vedere il tuo indirizzo IP. Informativa sulla privacy.
Shop search box (EN), next to the box
Your search words go to Shopify. We don't store your searches. Privacy Policy.
Shop search box (IT)
Le parole che cerchi vengono inviate a Shopify. Non conserviamo le tue ricerche. Informativa sulla privacy.
Usage statistics switch, under Manage my data (EN)
Usage statistics: we count visits, try-ons and taps on shop links to learn whether VEXORMA is useful. No photos, no search words. You can switch this off. Privacy Policy.
Usage statistics switch, under Manage my data (IT)
Statistiche d'uso: contiamo visite, prove e tocchi sui link dei negozi per capire se VEXORMA è utile. Nessuna foto, nessuna parola cercata. Puoi disattivarle. Informativa sulla privacy.
Italian version of this policy
La versione italiana completa di questa informativa è in preparazione. Fino alla pubblicazione fa fede la versione inglese.