Indoxalo privacy policy

Shop data

Shop domain, the access token issued by Shopify, app settings, plan and usage counts. We only read product titles and images (read_products scope) to generate try-ons.

Shop customers' data

Indoxalo does not receive or store identifying data about Shopify customers (name, email, orders). Photos uploaded to the virtual try-on are processed on the shop's behalf as described in the shopper notice and deleted within hours.

Providers (sub-processors)

Hetzner Online GmbH (Germany/Finland, EU): application hosting, database and private image storage.

Google LLC – Gemini API (paid tier): automated preview quality checks and generation when configured. Google does not use paid API data to train models.

kie.ai: try-on image generation using the application's configured model.

Cloudflare, Inc.: secure transport (tunnel/TLS) to our servers.

Shopify Inc.: platform, app billing and storefront request proxy.

Retention

Shopper photos: 6 hours by default (configurable 1–24). Results: up to 7 days. Shop data: for as long as the app is installed; after uninstall Shopify sends the shop/redact request and we delete all of the shop's data and images.

GDPR requests

We support Shopify's mandatory webhooks (customers/data_request, customers/redact, shop/redact). For a data processing agreement (DPA) or other requests, write to [email protected].

Security

Private storage with expiring signed links, encrypted transport (TLS), Shopify signature verification on every storefront request, rate limits and restricted administrative access.