Privacy Policy

Last updated: 24 October 2026 · Applies to Appcroft: AI Try-On & Chat

1. 1. Who we are
2. 2. Merchants and shoppers
3. 3. Data from the merchant's store
4. 4. Data from shoppers
5. 5. How AI models are used
6. 6. How long we keep data
7. 7. Who processes data for us
8. 8. Security
9. 9. Your rights
10. 10. Shopify's privacy requests
11. 11. Children
12. 12. Changes
13. 13. Contact

1. Who we are

Appcroft: AI Try-On & Chat (“the app”, “Appcroft AI”) is developed and operated by AppCroft, a project of Veltical (veltical.com). In this policy “we”, “us” and “our” refer to AppCroft. We are the data controller for the data described in section 3 and, as explained in section 2, a data processor acting for the merchant for the data described in section 4.

2. Merchants and shoppers

The app touches two kinds of people:

• Merchants — the Shopify store owners and staff who install the app and use its admin pages.
• Shoppers — visitors and customers of a merchant's store who use the try-on button or the assistant on the storefront.

For shoppers, the merchant is the data controller: they decide to offer the try-on and the assistant in their store, they choose how long photos are kept, and they are responsible for informing their customers under their own privacy policy. We process shoppers' data on the merchant's behalf and on their instructions, as set out in this policy and in our Terms of Service. The app gives merchants a setting to ask shoppers for explicit agreement before a photo is used, with a link to the merchant's own policy.

3. Data from the merchant's store

When a merchant installs the app, we receive and store:

• Store identity — the store's domain, name, contact email, country, currency and primary language, as provided by Shopify.
• An access token that lets the app read the catalogue and receive webhooks. It is stored encrypted and is never displayed or exported.
• The catalogue — products, variants, images, prices, categories and inventory availability. This is what the try-on renders and what the assistant answers from. It is refreshed through Shopify webhooks whenever a product changes.
• Shipping rules — the store's own free-shipping threshold, so the assistant can tell a shopper how far their cart is from it.
• Theme information — whether the app's blocks are present on the store's product page, reported by the blocks themselves when the page loads, so the setup checklist can tell the truth. The app does not read or change the theme's files.
• Order events — from orders/paid, orders/updated, orders/cancelled and refunds/create webhooks. We read only the order id, the line items (product, variant, quantity, price) and the customer's Shopify id. We do not read or store the customer's name, email address, phone number or postal address. Order events are used to attribute sales to a try-on or an assistant conversation in the merchant's Insights, and to deliver credits when a merchant sells credit packs to their own customers.
• Billing — the plan the merchant chose, subscription and one-time purchase status as reported by Shopify Billing, and the credit ledger. Payment is handled entirely by Shopify; we never see card or bank details.
• Settings and usage — everything the merchant configures in the app, the try-ons generated, the assistant's message counts, and per-shop AI cost, so the merchant's Insights and our billing are accurate.
• An optional AI key — merchants on some plans may connect their own fal.ai API key. It is stored encrypted and used only for that merchant's requests.

We use the merchant's contact email to send the emails they keep on in the app (a weekly report, low-credit alerts — the latter on by default), to deliver the customer data exports described in section 10, and for messages that are necessary to operate the service, such as a billing problem or a security notice.

4. Data from shoppers

When a page with the app's blocks loads, the blocks store a random device token in the browser and tell us which blocks are on the page and whether the assistant offered help. This carries no name or contact detail; if the shopper is signed in to the store, Shopify adds their customer id, which we keep only as a per-store hash (below). Nothing else is collected until the shopper chooses to use the try-on or the assistant. When they do, we process:

• Photos the shopper uploads to try a product on. Photos are stored so the shopper can reuse them without uploading again, and are deleted after the retention period the merchant set (section 6). Before a try-on, a photo is checked (it must show one person, in full, with nothing that could not be rendered safely); a photo that fails the check is refused with a reason and is deleted like any other upload, at the end of the retention period or earlier if the shopper removes it. The shopper can remove a saved photo at any time from the try-on window.
• Generated images — the try-on results, kept for the same period from when they were made, so the shopper can download, share or return to them. A record of each try-on (when, which products, what it cost, whether it worked) stays with the merchant's usage history; the shopper's own words, photo addresses and error details are removed from it when the image expires (91 days after a try-on that produced none), and the link to the shopper after 13 months.
• Photos of their own items, where the merchant's plan allows a shopper to add a garment they already own to the look. Same treatment as photos.
• Assistant conversations — the questions a shopper types and the answers given, kept for 7 days so the conversation can continue and a support question can be looked into. A copy is also kept in the shopper's own browser for 7 days, so the conversation survives a page change.
• Usage events — that a try-on happened, that a product was added to the cart from a try-on or a conversation, that an assistant prompt was shown, opened or dismissed. These feed the merchant's Insights and are deleted after 13 months (400 days).
• A photo agreement — where the merchant asks for explicit agreement before a photo is used, the date and version of the shopper's agreement.
• A device identifier — a random token stored in the shopper's browser (localStorage, not a cookie) that lets a guest find their saved photos and results again, and lets us apply the merchant's per-visitor limits. It contains no personal information and is not shared with anyone. If the shopper later signs in, what they did as a guest moves to their account, and is deleted with it.
• A per-store customer reference — when a shopper is signed in to the store, Shopify tells us their customer id. We store it only as a one-way hash that is different for every store, so a shopper's saved photos follow their account in that store, and so nobody — including us — can tell that the same person shops in two different stores.
• Network address — used to enforce rate limits and to detect abuse. The rate-limit counters hold only a keyed hash of it and expire with their window (at most a month). Our server access logs keep only its network part (the last part of the address is removed), strip identifiers such as customer ids and device tokens, and are rotated by size. It is never stored with photos or conversations.

We do not use shoppers' photos or conversations to train any model, ours or anyone else's. We do not build profiles of shoppers, do not combine data across stores and do not advertise.

5. How AI models are used

The app's two features run on AI models:

• Photo checks and try-on images — the provider fetches the uploaded photo and the product image from our storage for the request and returns the generated result, which we copy into our storage. Before that, a vision model checks that the photo is usable, and a segmentation model separates the person from the background. The providers' own retention of what they receive and produce is set by their terms (section 7).
• The assistant — the shopper's question, the recent conversation and matching products from the merchant's catalogue are sent to a language model, which writes the answer. The assistant is instructed to recommend only products that exist in the catalogue.
• Catalogue search — product texts are converted into embeddings by a model that runs on our own servers; nothing leaves them for this step.

Generated images are approximations. A result our checks consider unreliable is labelled as such to the shopper and is not charged to the merchant.

6. How long we keep data

When a merchant uninstalls the app, Shopify sends us a shop/redact request 48 hours later and we delete the store's data — catalogue, settings, shoppers' photos, results, conversations and try-on records — as described in section 10. Usage events, unlinked from shoppers, expire on their normal schedule; the audit log and our correspondence are kept as described above.

7. Who processes data for us

We use a small number of service providers. Each receives only what its job needs, under a contract that limits it to that job.

Where data leaves the European Economic Area, we rely on the provider's Standard Contractual Clauses or its participation in the EU–US Data Privacy Framework. Merchants who prefer their AI requests to be made under their own contract can connect their own fal.ai key in the app.

8. Security

• All traffic is encrypted in transit (TLS); connections to the app require HTTPS.
• The database, the photo storage and the backups sit on an encrypted volume; the off-site backup copy is encrypted before it leaves the server.
• Shopify access tokens and merchants' AI keys are additionally encrypted with a key that is never stored in the database.
• Stored photos and results have unguessable names, are never listed publicly and expire by policy. Anyone holding a photo's exact address can open it until it expires, which is how the shopper's browser and the AI provider reach it.
• Every request from a storefront is signed by Shopify and verified; requests from outside a store, or with an old signature, are refused.
• Administrative access is limited to named operators, protected by passkeys with a one-time email link as fallback, and every administrative action is recorded in an audit log.
• Servers are firewalled to the ports the service needs, kept updated, and backed up daily with restore drills.

If we become aware of a breach affecting personal data, we will notify the affected merchants without undue delay so they can meet their own obligations to their customers.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to restrict or object to its processing, and to complain to a supervisory authority.

Shoppers: please contact the store you used the app in. The merchant is the controller for your data and can act on your request through Shopify (section 10); we will carry out their instructions. You can also delete a saved photo yourself from the try-on window at any time.

Merchants: you can change or delete most data directly in the app. Uninstalling the app deletes the rest 48 hours later, except the records described in section 6. For anything else, contact us (section 13).

10. Shopify's privacy requests

The app implements Shopify's three mandatory privacy webhooks, and they do real work:

• customers/data_request — we assemble everything we hold about the customer in that store, including what they did as a guest before signing in (saved photo and result records, try-on records, conversations, usage events, credit balance and history) and email it to the store's address. If it cannot be delivered, we record that and send it by hand.
• customers/redact — we delete the customer's photos, results, try-on records, conversations and photo agreement, including those from before they signed in, from storage first and from the database second, so a failure can never leave a photo behind. Their credit account and its ledger entries are kept as financial records, with the link to the customer replaced by a random value.
• shop/redact — we delete the store's photos, results, conversations, catalogue and settings, and replace the store row with a pseudonymous record that the financial records hang from.

11. Children

The app is not directed at children and we do not knowingly process their data. Merchants are responsible for the audience of their own stores.

12. Changes

We will update this policy when the app changes in a way that affects it, and note the date at the top. Material changes are announced to merchants inside the app or by email.

13. Contact

Questions about this policy or about your data: contact@appcroft.com.