Trust & data

Plain answers about what AI Frame stores for Virtual Try-On and Size Chart, where it lives, how long we keep it, what agents and public metafields can see, and how we talk about impact without overclaiming.

What we store

For shoppers using the storefront widget:

Try-on photos — the selfie used for Virtual Try-On / Fit Profile (when the shopper saves it).
AI-generated try-on results — rendered images marked as AI-generated (visible badge + machine-readable C2PA / IPTC provenance on output images).
Fit Profile measurements — body measurements the shopper enters or estimates (e.g. bust / waist / hips in cm; optional height, weight, age for estimation). We do not infer body attributes from the uploaded photo.
Consent records — version and timestamp for Fit Profile save and Mirror Mode auto-render opt-in.
Anonymous shopper ID — a client UUID (not a Shopify customer id by default) used to reconnect the Fit Profile on later visits.
Widget analytics — try-on sessions / results, events such as add-to-cart and favorited, Web Pixel events used for impact stats, and purchase attribution rows (no buyer email on attribution records).

For merchants:

Store settings, size charts, billing/credits, collaborator tokens, and optional integration tokens (e.g. Klaviyo OAuth when connected).
When Klaviyo is connected, we may send event names and product metadata (and customer email only if it is already available in that request) to the merchant's Klaviyo account.

Where (EU)

Image storage: shopper-facing image hosting uses AWS S3 in eu-north-1 (Stockholm). In-product copy states Fit Profile data is stored in the EU / Europe.
Application database: MongoDB Atlas (shop, session, Fit Profile, analytics documents). Exact Atlas region: [confirm with ops].
App hosting: the Shopify app runs on Vercel (virtualfittingroom.vercel.app). Exact region pin: [confirm with ops].
AI processing: try-on generation may call Gemini and/or fal.ai. Photos can be processed outside the EU during generation. Production routing: [confirm with ops].
Optional merchant tools: Klaviyo (when connected) and Shopify itself process data under those providers' terms.

Retention

Mirror Mode render cache: result images expire after 1 day (matches the coded S3 lifecycle window for that cache).
Unsaved shopper photo: Your photo is deleted after your try-on unless you save it. The uploaded file is deleted when the try-on finishes or fails. A checked-in S3 lifecycle rule on tryon-inputs/ expires a leftover after 1 day once that rule is applied to the bucket.
Saved selfie / Fit Profile: Saved photos stay until you delete them. Deleting the photo or Fit Profile in the widget ("My Fit") removes the S3 object and clears measurements. No automatic selfie expiry.
Web Pixel events: schema documents an intended 13-month retention window; the nightly purge job is not present in the current cron config — [confirm with ops].
Merchant uninstall: Shopify's shop/redact compliance webhook deletes sessions, subscriptions, and store-linked try-on / pixel / attribution data (Shopify delivers this after the uninstall grace period; comments in code reference ~48h).

Shopper rights

Erase Fit Profile: shoppers can delete photo, measurements, and consent from "My Fit" in the widget (one cascade delete).
Delete selfie only: photo can be removed without keeping a saved body profile.
Access / other requests: email hello@aiframe.app. Merchants can also open Intercom from the app.
Shopify customer data-request / redact webhooks currently treat Shopify customer records as not stored in AI Frame (shopper data is keyed by AIFrame's anonymous UUID, not Shopify customer id).

Agents & published metafields

What Sidekick / merchant agents can access (store admin context only): aggregate try-on usage, category / product analytics, widget settings (colors, labels, categories, share reward), and size chart names / publish state — plus size recommendation tools when the merchant plan allows.

What they cannot access: shopper selfies, Fit Profile body measurements, consent payloads, or other shopper PII. Those never appear in Sidekick tool responses.

Agent fit (commerce agents) — the agent product is a size verdict (recommended size + confidence) from shopper-declared measurements, not a dump of published chart tables. Photos are rejected. Growth+ merchants can enable Agent fit and create a hashed shop API key in the app. POST /api/fit/recommend stays environment-flagged (FIT_RECOMMEND_API_ENABLED) and is not enabled on production until QA.

Public storefront metafields (Shopify publisher surface — for display / SEO, not the Agent fit product):

aiframe.tryon_image — product garment reference photo for try-on (not a shopper body photo).
aiframe.allowed_categories — which product categories may show try-on.
aiframe.size_chart — published chart facts for the product (measurements + fit intent). Readable by the storefront and crawlers. Prefer the Agent fit verdict API for agent integrations so answers stay live and are not a bulk chart export.

No body measurements, selfies, or Fit Profile fields are written to public metafields. Body PII stays off the publisher surface. Catalog metafields are for display and SEO; Agent fit is the agent integration (verdicts only).

Control vs exposed cohorts

Impact stats compare shoppers who interacted with AI Frame ("exposed") with shoppers who did not ("control"), using Web Pixel events and order data when available.

Exposed includes clients with events such as try-on opened, render completed, size chart opened, recommendation shown, or add-to-cart from the widget — plus orders attributed to those journeys.
Control is built from page / checkout traffic that is not in the exposed set for the same window.
We require minimum sample sizes before showing conversion or return comparisons, and we wait for return maturity before comparing refund / size-return rates.

This is correlational, not a randomized controlled experiment. Shoppers who try on may already differ from those who do not (selection effects). We report lift as an observed difference between cohorts — not as proven causation.

Policies & contact

Marketing site

hello@aiframe.app

AI Frame — Virtual Try-On & Size Chart. This page summarizes product behaviour for merchants and shoppers; the privacy policy is the legal source of truth where they differ.