Data processing agreement

This agreement applies between a store that installs the Adornu app ("the store", the controller) and Adornu ("we", the processor), whenever we process personal data for the store through the app. It forms part of our terms of service and needs no separate signature. It is written to meet Article 28 of the EU General Data Protection Regulation (GDPR) and the UK GDPR, and similar laws elsewhere.

1. What we process, and why

• Purpose: to show the store's shoppers its products on their own photo (the virtual try-on), and, if the store turns it on, to add shoppers who give their email to the store's own Shopify customers.
• Shoppers' data: the photo a shopper chooses (processed in memory to make their picture, never stored), the finished try-on picture (held encrypted until it is shown, at most about 10 minutes), an anonymous device number (kept only as a salted hash, to count free and daily try-ons), a salted hash of the shopper's network address (for the same counts, deleted after 2 days), and — only when the shopper gives it — their email address and marketing choice, which we pass straight into the store's Shopify and do not keep.
• The store's data: the store's domain and Shopify access, its app settings, counts of try-ons and their results, and the support messages and feedback the store sends us (stored encrypted).
• Duration: while the store has the app installed. Store data is deleted when Shopify asks us to, 48 hours after uninstall.

2. Our commitments

• We process personal data only on the store's documented instructions — the app's settings and these terms — unless the law requires otherwise, in which case we tell the store first where we may.
• Everyone at Adornu with access to personal data is bound to confidentiality.
• We protect personal data with the measures described on our security page, including encryption in transit and at rest, limited and logged staff access, and backups.
• We help the store answer requests from shoppers exercising their rights. Because we keep no photos and no shopper emails, there is usually nothing on our side to hand over or delete; the store's Shopify holds the emails.
• We tell the store without undue delay — and in any case within 48 hours — after becoming aware of a personal data breach affecting its data, with what we know and what we are doing about it, so the store can meet its own duties (for example the 72-hour notice to authorities under GDPR).
• We help the store with data protection impact assessments and consultations with authorities where they concern our processing.
• At the end of the service we delete the store's personal data (Shopify's shop deletion request, 48 hours after uninstall), unless the law requires us to keep it.
• We give the store the information needed to show we meet this agreement, and answer reasonable audit questions by email.

3. Sub-processors

The store authorises us to use these sub-processors, each bound by data protection terms at least as protective as these:

• Our hosting providers, which run our servers and database.
• OpenAI, L.L.C., Microsoft (Azure OpenAI) and FASHN AI, any of which may draw the try-on picture from the shopper's photo.
• Our email delivery service, for messages to stores and replies to enquiries.
• Shopify, which hosts the store and receives shoppers' emails into the store's own customers.

We will announce a new sub-processor in the Adornu app at least 14 days before it starts processing the store's data. The store may object by writing to hello@adornu.io; if we cannot address the objection, the store may uninstall the app.

4. International transfers

Some sub-processors process data outside the store's country, including in the United States. Where data leaves the EU, the UK or Switzerland, the transfer relies on an adequacy decision (such as the EU–US Data Privacy Framework, where the recipient is certified) or on the European Commission's standard contractual clauses.

5. The store's responsibilities

The store decides to offer the try-on and the email ask, tells its shoppers about them in its own privacy policy (linking to our privacy notice), and has a lawful basis for collecting shoppers' emails.

6. Contact

Questions about this agreement, or a request for a signed copy: hello@adornu.io.