Privacy Policy — Nova Vision (Virtual Try‑On & Look Creator)

_Last updated: July 13, 2026._

Nova Vision (the "App") is a Shopify app operated by Nova (the developer of Nova Vision) ("we", "us") that adds an AI virtual try‑on, look creator, and product‑photoshoot studio to Shopify stores. This policy explains what data the App processes, why, where it goes, and how it is deleted.

1. Who the data belongs to

Merchants — the Shopify store owners who install the App.
Shoppers — visitors to a merchant's storefront who use the widget.

We act as a data processor on behalf of the merchant for shopper data, and as a controller for the merchant's own account/config data.

2. What we collect and why

Data	Whose	Why	Where it lives	Retention
Shopper photo (uploaded for try‑on)	Shopper	Generate the try‑on / look image	In server memory only, per session — never written to disk or a database by us	Discarded when the session ends / expires; never persisted
Generated try‑on / look images	Shopper	Shown back to the shopper	Held in memory for the session; returned to the shopper's browser	Not persisted server‑side after the session
Email + phone (if the shopper submits them)	Shopper	Merchant lead capture / order contact	Stored server‑side (encrypted), scoped to the merchant, and mirrored into the merchant's own Shopify Customers (tagged `virtual-tryon`) so the merchant owns the lead	Until the merchant deletes them or a GDPR delete request is received
Product images & catalog data	Merchant	Assemble looks, run the photoshoot studio	Fetched live from Shopify via the Admin API; not stored	Not stored
Usage analytics (counts of chats, generations, add‑to‑carts, orders, revenue)	Merchant/aggregate	Merchant dashboard + our billing/metering	Stored as aggregate daily counters per store — no shopper PII	Retained for reporting
App configuration (branding, targeting, plan, uploaded logos)	Merchant	Run the App	Stored server‑side per store	Until uninstall / shop redaction
Shopify session tokens	Merchant	Authenticate Admin API calls	Stored server‑side (session store)	Deleted on uninstall

The full chat transcript is stored on the shopper's own device (their browser localStorage) and auto‑deletes after 1 week. Individual messages are transmitted to our server and to the AI provider (see §3) to generate each reply, but the transcript itself is not persisted server‑side — we retain only aggregate analytics and which products were tried on / made into a look.

3. Third parties we share data with (sub‑processors)

OpenAI and/or Google (Gemini) — the shopper's photo + selected product images,

and chat messages, are sent to the configured AI provider to generate the try‑on/look/photoshoot image and to power the shopping chat. Governed by the provider's API data policies (API inputs are not used to train their models). We do not deliberately send email, phone, or order data to the AI provider; only the shopper's photo, selected product images, and their chat messages are sent (a shopper could include contact details in free‑text chat).

Shopify — we read catalog/order data, create draft orders, and write

captured leads back into the merchant's own Shopify Customers, via the Shopify Admin API under the scopes the merchant approves. (Data written to the merchant's Shopify store stays within the merchant's own Shopify account.)

Hetzner — infrastructure hosting (EU / Germany), where app data is stored.
Resend (only if the merchant enables "email me my look") — used to email a

shopper their generated image. Disabled by default.

We do not sell data, do not use it for advertising, and do not share it with any party other than the sub‑processors above.

4. Payments

We never handle card data. Orders are completed on Shopify's own hosted checkout (a draft order + checkout link). Subscription billing is handled by Shopify Billing.

5. Data subject rights & GDPR

The App implements Shopify's mandatory privacy webhooks:

customers/data_request — on request, we report the shopper data we hold

(email/phone leads) for that customer.

customers/redact — deletes all leads matching that customer's email/phone,

and strips the app's tags (virtual-tryon and related) from the merchant's Shopify customer record. (Shopify redacts the native customer record itself.)

shop/redact — deletes all data for the store (fires ~48h after

uninstall): settings, leads, analytics, sessions.

app/uninstalled — deletes store settings and leads immediately on uninstall.

Shoppers or merchants can also request deletion directly at essentia.kids@gmail.com.

6. Data security

All traffic is over HTTPS/TLS (encryption in transit).
Personal data is encrypted at rest: shopper email/phone are stored using

AES‑256‑GCM; the encryption key is held only in the server environment.

Encrypted backups: app data is backed up daily to AES‑256‑encrypted, rotated

archives, restorable for disaster recovery.

Access logging: every view/export of stored lead data is recorded in an audit log.
Access control: production access is limited to the operator via SSH key

authentication (no password login).

Shopper photos are processed in memory and never persisted at rest.
Admin API requests are authenticated with Shopify session tokens; the storefront

API is verified with Shopify's App Proxy HMAC signature; webhooks are HMAC‑verified.

AI provider keys are held server‑side only and never exposed to any browser.
Development/testing runs on Shopify development stores with test billing, separate

from production data.

Full details: see our Data Protection Overview, Data Retention Policy, and Security Incident Response Policy (available on request).

7. International transfers

Data is hosted in Germany (Hetzner, EU) and may be processed in the USA by the AI provider (OpenAI / Google). Standard contractual clauses / equivalent safeguards apply where required.

8. Children

The App is not directed to children under 16 and should not be used to upload photos of minors without appropriate consent.

9. Changes & contact

We may update this policy; the "last updated" date will change. For any privacy question or data request (access, correction, deletion), contact us by email at essentia.kids@gmail.com and we will respond promptly.

Appendix A — Data‑flow summary (for Shopify app review)

Shopper uploads photo (browser)
   │  downscaled in-browser to ≤1280px JPEG
   ▼
App Proxy (HMAC-verified)  →  App backend (in-memory session; NOT persisted)
   │
   ├─ photo + product image(s) ─→ OpenAI image API ─→ generated image ─→ back to shopper
   │
   └─ if shopper submits email/phone ─→ stored as a "lead" (merchant-scoped, encrypted)
                                          ├─ mirrored into the merchant's Shopify Customers (tagged)
                                          └─ deletable via customers/redact, shop/redact, uninstall

Merchant admin (embedded, App Bridge session-token auth)
   └─ reads its own settings, leads, aggregate analytics — no cross-store access

Aggregate analytics only (chats, generations, carts, orders, revenue counts)
   └─ no shopper PII; used for the merchant dashboard + usage-based billing

PII inventory: shopper photo (ephemeral, in-memory), shopper email + phone (stored, deletable). Everything else is merchant config or aggregate counters.