Privacy policy

Last updated 16 September 2026

Shopaxolic is a fitting room. You bring a photo of yourself and a garment from a shop’s own page, and an AI model shows you the two together. That needs your photo, so this page says exactly what we hold, who else sees it, how long we keep it and how you get rid of it.

Who is responsible

The controller of your personal data is RBN SPC LTD, Makariou III Avenue 228, 3030 Limassol, Cyprus, Cyprus. Write to us at hello@shopaxolic.com about anything on this page.

What we collect, and why

Your email address

To make your account and to sign you in. You give it when you ask for a sign-in code, or Apple gives it to us when you use Sign in with Apple — and if you chose to hide it, the only address we ever see is Apple’s private relay one. Disposable-address providers are refused. This is linked to you: it is your account.

Your Apple user identifier

If you use Sign in with Apple we store the stable identifier Apple gives us (Apple calls it the “sub”), so we recognise the same account next time. Apple also offers your name once at first sign-in: we have nowhere to put a name, so we accept it and store nothing.

Your Google user identifier

If you sign in with Google, we keep your Google user identifier and email address to recognise your account; Google Ireland Ltd is the processor.

Sign-in codes

A six-digit code is emailed to you. We store a keyed hash of it, never the code itself; it expires after 10 minutes, allows six attempts, works once, and the record is removed as soon as it has expired.

Your photos and the pictures you import

The photo of yourself you choose, and pictures of garments you import from shop pages. They are stored privately in our own storage, in the European Union, and are readable only through your signed-in account. There is no public link to them; the storage buckets have their public URLs switched off.

The safety check on photos of people

When you upload a photo of a person, the image is sent to Google Cloud Vision (SafeSearch) before anything is stored. If the check refuses the photo, the photo is never stored at all. If the check cannot run, the upload is refused rather than stored unchecked. If it passes, we keep the five likelihood ratings the check returns — adult, spoof, medical, violence, racy — beside the photo, and nothing else from it.

Try-on images

When you ask for a try-on, the photo you chose and the garment picture are sent to Google’s Vertex AI Virtual Try-On model, which runs in the region us-central1 in the United States, and it returns the generated image. We send Google’s strictest safety setting and ask for adults only; when Google’s filter declines a request, you get a refusal and no image, and your try-on allowance and credit are returned. The generated image is stored privately with your looks, in the European Union.

Your wardrobe and looks

The items you import (the garment’s name, the shop, the price as captured on the day, the link and the picture), the looks you make, and the boards you sort them into. If you create a share link for a look, anyone holding that link can open it until it expires after 30 days or you revoke it. Your original photo is never part of a share.

How the app is used

We measure our own app, with our own code, and nothing else. There is no third-party analytics kit, no advertising, no ad identifier and no tracking of you across other apps or websites. An event is one of a fixed list of kinds — the app opened, a brand viewed, a shop opened, a try-on requested, a look saved, a sign-in started — with a short allow-listed set of properties; free text cannot get in. It carries at most two opaque identifiers: a one-way HMAC of your user id and a one-way HMAC of a random session id the app invents, both keyed with a secret we hold. Neither can be turned back into you, and rotating that secret makes every earlier event unlinkable.

Location, only when you ask for shops near you

If you use Nearby, your device’s coordinates are used to answer that one request and are not stored. The event we keep for that request records only a cell rounded to a tenth of a degree — roughly eleven kilometres — never your precise position, and never a location history.

Technical data

Your IP address is used, in the moment, for rate limits and the bot check; what we store is a one-way hash of the rate-limit bucket, not a log of addresses. A session cookie or token identifies your signed-in session for 30 days. Cloudflare, as our host, processes connection data (including your IP address) to deliver and protect the service.

Who else processes your data

• Cloudflare — hosting, the database and the photo and result storage, all in the EU jurisdiction, plus the Turnstile bot check on the sign-in door (your token and IP address are checked with Cloudflare).
• Google — Vertex AI in us-central1 (United States) generates try-on images; Cloud Vision SafeSearch checks photos of people. Both receive the images involved in the request you made.
• Resend — delivers the sign-in code email from hello@shopaxolic.com. It receives your address and the message.
• Apple — only if you choose Sign in with Apple. Apple verifies you and tells us the identifier and, unless you hide it, your address.

That is the whole list. We do not sell personal data, we do not share it with data brokers, and we run no advertising.

Data leaving the European Union

Your account, your photos, your looks and your events are stored in the EU. The two Google services above are the exception: an image you send for a try-on, and a photo of a person that is being checked, are processed in the United States.

Why we are allowed to hold it

• Your contract with us — the account, your wardrobe, the try-ons you request.
• Your consent — storing your chosen photo and sending it to the AI provider. The app shows the exact wording and records which version you accepted and when. You can withdraw it by deleting the photo or the account.
• Our legitimate interests — keeping the service standing up: rate limits, the bot check, the caps on generation, the safety checks, and measuring our own app with the opaque events above.

How long we keep it

• Photos, imported items, looks and boards — until you delete them, or until you delete your account.
• Sign-in codes — 10 minutes.
• Sessions — 30 days, and they end when you sign out.
• Share links — 30 days, or until you revoke the share.
• Events — deleted with your account; otherwise no longer than 400 days, after which they are removed automatically.

Two honest limits. We cannot reach inside our host’s own backups to remove a copy on demand, and we do not control how long Google keeps a request it processed under its own terms. Everything we can reach, we remove as described below.

Deleting your data

In the app, open your account and choose Delete account. It is one confirmed action, and it removes your identity, your sessions, any pending sign-in codes, your wardrobe, your items, your looks, your boards, your shares, your notifications and your wallet from the live database, and queues every photo and every generated image for deletion from storage. The queue is emptied in the same request, and a scheduled job retries anything storage was briefly too busy to delete. Your events are deleted with you. If you signed in with Apple, we also ask Apple to revoke the token where we hold the key to do it.

You do not have to go that far: a single photo, item or look can be deleted on its own at any time, and a share link can be revoked.

Your rights

Under the GDPR you can ask us for a copy of your data, to correct it, to delete it, to restrict or object to what we do with it, and to receive it in a portable form. You can withdraw your photo consent at any time. Write to hello@shopaxolic.com and we will answer within one month.

If you think we have got it wrong you can complain to your national supervisory authority — in Cyprus, the the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus (www.dataprotection.gov.cy).

Children

Shopaxolic is not for children. You must be at least 16 to have an account, and no photo of a child may be uploaded. The AI provider is configured to generate adults only.

Changes

When this policy changes we publish the new text here and change the date at the top. If a change affects what we do with your photo, the app asks you to accept the new wording before that photo is used again.