Security

Keeping as little as possible

• Shoppers' photos are processed in memory and never stored.
• The finished try-on picture is held only until it is shown — at most about 10 minutes — and then deleted.
• Shoppers' emails go straight into the store's own Shopify; we don't keep them.
• A store's data is deleted 48 hours after it uninstalls the app, when Shopify asks us to.

Encryption

• In transit: every connection — browsers, Shopify, our servers and the AI services — uses HTTPS (TLS).
• At rest: try-on pictures waiting to be shown, support messages, feedback, provider keys and Shopify refresh tokens are encrypted in our database with AES-256-GCM. Backups are encrypted.

Access

• Only Adornu's operators can reach store data, through an internal control panel behind a strong password.
• Every view and change in that panel is logged — who, what, when — and the log is kept for a year. Every settings change is also kept in an audit log.
• Staff accounts on our hosting, Shopify, code and AI providers use strong, unique passwords and two-factor sign-in.
• Test stores and test data are kept apart from live stores: development stores get test charges only, and our tests run on a separate database.

Backups and recovery

The database is backed up daily, encrypted, and kept away from the server it runs on, so it can be restored after a failure. Shoppers' photos are never part of a backup, because they are never stored.

If something goes wrong

Our incident response, in short:

1. Contain — stop the problem: revoke keys, pause the service, block access.
2. Assess — what happened, which data and which stores are affected.
3. Notify — affected stores within 48 hours of becoming aware of a breach of their data (so they can meet the 72-hour notice to authorities under GDPR), and the authorities where we must.
4. Fix and learn — remove the cause, restore from backup if needed, and record what changed.

Report a problem

Found a security issue? Write to hello@adornu.io. We answer within two working days. For how we process data on stores' behalf, see our data processing agreement and privacy notice.