Privacy Policy
This Privacy Policy explains what personal data FitWear processes, why, for how long and what rights you have. It covers our website, business accounts and shopper accounts. What happens with the photo you upload in a shop's try-on is explained in detail in the Try-on Privacy & Biometric Notice.
1. Who is responsible
FitWear, Kosovo. Contact for all privacy questions: [email protected].
- For our website, business accounts and shopper accounts we are the controller.
- For try-ons inside a shop, the shop decides to offer the try-on on its website and is the controller of its website; FitWear processes the try-on data on the shop's behalf (processor) under the Data Processing Addendum. When a signed-in FitWear shopper uses the try-on with their membership, we are controller for the data linked to their account.
2. What data we process
| Who | Data | Purpose | Legal basis (GDPR / Kosovo Law No. 06/L-082) |
|---|---|---|---|
| Business customers | Name, e-mail, phone, company name, password (stored only as a secure hash), shops, plans, payments, messages | Provide the account and the Service, billing, support, service e-mails (e.g. weekly report, alerts) | Contract; legal obligations (accounting); legitimate interest (security, service messages) |
| Shoppers | Name, e-mail, password hash, plan and payment status, list of own try-ons | Provide the shopper account and membership | Contract; legal obligations |
| Shoppers using the browser extension | Extension sign-in; which partner shop the try-on runs on (no browsing history) | Use the membership on partner shops - see the Browser Extension Privacy Notice | Contract |
| Try-on visitors | Uploaded photo; generated images; the product page and product photos; time; a one-way fingerprint (SHA-256 hash) of the photo; consent version | Create the try-on, show it, count usage, prevent abuse | Consent (Art. 6(1)(a) and, where the photo counts as biometric data, explicit consent Art. 9(2)(a)) |
| Shop visitors | Add-to-cart clicks on product pages with the widget (page, time, linked try-on if any) - no name or contact data | Statistics for the shop (does the try-on help sales) | Legitimate interest of the shop and of FitWear |
| Everyone | IP address, browser type, requested page and time in server logs | Security, abuse prevention, troubleshooting | Legitimate interest |
We do not use advertising or analytics trackers, we do not build advertising profiles and we do not sell personal data.
3. Who receives data
- AI providers that generate the try-on image (photo and product photo only; no name or e-mail). See Subprocessors.
- Hosting and e-mail providers that run our servers and deliver our e-mails.
- The shop sees statistics and the generated try-on images of its own visitors in its dashboard, but not the original photo.
- Authorities, where we are legally required.
4. International transfers
Some providers are located in the United States. Where data leaves Kosovo or the EU/EEA we rely on safeguards such as the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework where the provider is certified, and we send only the data the task needs.
5. How long we keep data
- The visitor's photo (portrait) is deleted as soon as the try-on finishes - also when it fails - and any copy left behind by an interruption is removed automatically within 2 hours. Generated try-on images are deleted automatically after 30 days.
- Try-on records without the photo (time, shop, product page, status, fingerprint): as long as the shop's account exists, for statistics.
- Accounts: while the account exists; afterwards only what the law requires us to keep (e.g. invoices, for as long as tax and accounting law requires).
- Server logs: size-limited and overwritten automatically, usually within a few weeks.
6. Security
Encrypted connections (HTTPS) everywhere; passwords are stored only as hashes; API keys and secrets are stored encrypted; uploaded photos are kept in private storage that is never published; access to the admin area is limited to authorised staff.
7. Your rights
You can ask for access to your data, correction, deletion, restriction, a copy in a portable format, and you can object to processing based on legitimate interest. You can withdraw consent at any time with effect for the future. Write to [email protected]; we answer within one month. You also have the right to complain to the Information and Privacy Agency of the Republic of Kosovo (Agjencia për Informim dhe Privatësi) or, in the EU/EEA, to the data protection authority where you live.
Because the try-on photo is deleted right after use, we usually no longer hold it when you ask; generated images can be deleted earlier on request - please send us the link to the image.
8. Age
The Service is only for people aged 18 or older. We do not knowingly process data of minors; if you believe a minor used it, contact us and we will delete the data.
9. Changes
We update this policy when our processing changes. The date at the top shows the current version.