Legal
Data processing agreement
The terms on which Try-On processes personal data for a merchant: instructions, confidentiality, security, other processors, assistance, deletion, audits, transfers and liability.
Published in English. English governs this document, whatever translation is provided.
Draft. This text has not been reviewed by a lawyer and is not the agreed version. It says what we intend to agree, so that it can be read and corrected before Try-On goes on sale.
Last changed: 20 September 2026
This agreement applies where Try-On processes personal data on a merchant’s behalf. It forms part of the terms of service and takes effect when a store is connected to a Try-On account.
1. Words used here
- Controller, processor, personal data, processing, data subject and personal data breach have the meanings given in the General Data Protection Regulation (“GDPR”).
- Customer, you — the business whose store is connected to Try-On.
- Data Protection Law — the GDPR, the UK GDPR, the Israeli Privacy Protection Law, and any other law about personal data that applies to either of us.
- SCCs — the standard contractual clauses approved by the European Commission on 4 June 2021.
- Words defined in the terms of service have the same meaning here.
2. Our roles
2.1 You are the controller and we are your processor for the personal data your store sends to be rendered: images, body-profile values, the opaque staff reference, and the choices sent with them (Annex 1).
2.2 We are a controller in our own right for your account details, billing details, usage records, server logs and records kept to prevent abuse. The privacy policy governs those, and this agreement does not.
2.3 Each of us will comply with the Data Protection Law that applies to it.
3. Our instructions from you
3.1 We process personal data only on your documented instructions, which are: this agreement, the terms of service, the settings you choose, and what your store sends when it asks for a result. This includes any transfer to a country outside the one the data came from.
3.2 If the law we are subject to requires us to process personal data otherwise, we will tell you before we do, unless that law forbids telling you.
3.3 We will tell you if, in our opinion, an instruction breaks Data Protection Law. We may refuse an instruction that would.
4. Confidentiality
Each person we authorise to process personal data for you is bound to keep it confidential, by contract or by a professional duty, and is told what they may do with it.
5. Security
5.1 We put in place the technical and organisational measures in Annex 2, which are appropriate to the risk, as Article 32 of the GDPR requires.
5.2 We may change those measures, but not so that the protection they give falls below what Annex 2 describes.
6. Other processors
6.1 You give us general authorisation to engage other processors.
6.2 We keep a current list of them, with each one’s name, role and country, and we will give it to you on request. The confidentiality clause of the terms of service applies to it.
6.3 We will tell you at least 30 days before a new processor starts, or one is replaced. You may object within those 30 days on reasonable grounds relating to data protection, and we will work with you to address it. If we cannot, your sole and exclusive remedy is to stop using the affected part of the service and receive a refund of the tokens that remain unused, in proportion, as the refund policy describes.
6.4 Each other processor is bound by terms no less protective than these, and we remain fully liable to you for what it does.
7. Helping you answer people
7.1 We will help you, by appropriate technical and organisational measures and so far as is reasonably possible, to answer a request from a person exercising their rights under Data Protection Law.
7.2 Where such a request reaches us directly, we will not answer it ourselves. We will pass it to you without undue delay and help you answer it.
8. Security, breaches and assessments
8.1 We will help you, taking into account what we know and what we do, to meet your obligations on security, breach notification, data protection impact assessments and consulting a supervisory authority (Articles 32 to 36 of the GDPR).
8.2 If we become aware of a confirmed personal data breach affecting personal data we process for you, we will tell you without undue delay and in any case within 72 hours. Your own duty to tell a supervisory authority runs from our notice, which is why we do not wait to finish investigating before sending it. Where Israeli law requires us to notify the Privacy Protection Authority, we do so immediately, as that law requires, whatever this clause says about telling you. We will tell you what we know: what happened, the categories and approximate number of people and records affected, the likely consequences, what we are doing about it and what we suggest you do, and whom to ask for more. Where we cannot give it all at once, we will give it in stages.
8.3 Telling you is not an admission of fault by either of us.
9. Deleting or returning the data
9.1 In the ordinary course: images are deleted once they have been used, and within 2 hours 10 minutes in any case; the finished still or video your store fetches is deleted from the storage it is fetched from 72 hours after it is ready, whether or not your store has fetched it by then.
9.2 We may keep a copy of a finished video of our own, under clause 10.5 of the terms of service, for running and checking the service. Such a copy is never made from a photograph of a real person and never includes the images sent for it, so it holds no personal data of a data subject. Where one nonetheless holds personal data, clause 9.3 applies to it as it does to anything else.
9.3 When the services end, we will delete or return the personal data we process for you, as you choose, and delete existing copies, unless the law requires us to keep it. Tell us which you want within 30 days of the end; without an instruction we delete it.
9.4 Where the law requires us to keep personal data, we keep it only for that reason, only for as long as that reason lasts, and we go on protecting it as this agreement requires.
10. Records and audits
10.1 We will give you the information reasonably necessary to show that this agreement is being kept.
10.2 We will allow and contribute to an audit, by you or an auditor you appoint who is not a competitor of ours: once in any twelve months; on 30 days’ notice; in working hours; without unreasonable disruption; and under confidentiality. We will do so more often where a supervisory authority requires it, or after a personal data breach affecting your data.
10.3 Where a report or certification we hold, not older than thirteen months, answers your question, we will provide that first. You bear your auditor’s costs; we may charge our reasonable costs for an audit beyond the yearly one.
11. What you are responsible for
11.1 You warrant that you have a lawful basis for sending us everything you send, that you have given any notice and obtained any consent the law requires, and that your instructions comply with Data Protection Law.
11.2 In particular, you may send us an image containing an identifiable person only where you are authorised to do so and that person has agreed, as the content policy and the terms of service require. You may not send us images of children, and you may not send special category data (Article 9) unless you have told us in writing first and we have agreed in writing.
11.3 You are responsible for telling the people whose data you send what you send and why.
12. United States: we act as your service provider
12.1 This clause applies where the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”), applies to you. Words in it have the meanings the CCPA gives them.
12.2 We are your service provider. You disclose personal information to us only for the business purposes of providing the service described in the terms of service and in Annex 1.
12.3 We will not:
- sell or share personal information;
- retain, use or disclose it for any purpose other than the business purposes set out in this agreement, or as the CCPA otherwise permits, including for any commercial purpose of our own;
- retain, use or disclose it outside our direct business relationship with you;
- combine it with personal information we receive from anyone else, except as the CCPA permits a service provider to do.
12.4 We will provide the same level of privacy protection the CCPA requires of you, and we will tell you if we determine that we can no longer meet our obligations under the CCPA.
12.5 You may take reasonable and appropriate steps to ensure that we use personal information in a manner consistent with your obligations, and to stop and remediate any unauthorised use.
12.6 We certify that we understand the restrictions in clause 12.3 and will comply with them.
12.7 Where another state of the United States requires a contract between a controller and a processor, this agreement, and in particular clauses 3 to 10, serves as that contract, and the obligations in it are read as the equivalent obligations under that law. Those laws reach the processing because of our relationship with you, not because of our size, so none of this depends on how much of the service we sell.
12.8 Where a law requires you to carry out an assessment of this processing — a data protection assessment under a state law, or a data protection impact assessment under the GDPR — we will give you what we hold about how the processing works, so that you can complete it: what we do with an upload, where it is processed, how long it is kept, who else processes it, and what the generator does and does not retain. Where we have had an independent assessment of our own carried out, a summary is available to you on request under clause 10.3.
13. Sending data across borders
13.1 Our servers are in Israel. The European Commission has decided that Israel offers an adequate level of protection for personal data transferred for automated processing (Decision 2011/61/EU), and transfers from the European Economic Area reach us on that basis.
13.2 Where that decision does not cover a transfer, or ceases to apply, the SCCs are incorporated into this agreement and apply to that transfer. They are agreed now and lie dormant: if the decision is withdrawn, suspended or narrowed, they take effect on that day, with no new signature from you, and transfers continue under them. They apply with:
- module two (controller to processor) where you are a controller, and module three (processor to processor) where you are yourself a processor for someone else;
- clause 7 (docking) applying;
- clause 9, option 2 (general written authorisation), with the 30 days in clause 6.3 of this agreement;
- clause 11 without the independent dispute resolution option;
- clause 17, option 1, governed by the law of Ireland, and clause 18(b) giving the courts of Ireland jurisdiction. Option 2 would mean the law of each exporter’s own member state, and a self-serve service would then carry 27 governing laws in one agreement; Irish law allows the third-party beneficiary rights option 1 requires. This does not affect a data subject’s right to bring a claim where they live;
- Annexes 1 and 2 of this agreement serving as Annexes I and II of the SCCs, and Annex 3 as the list under clause 9.
13.3 Where the UK GDPR applies, the UK International Data Transfer Addendum applies to the SCCs, with the information in the annexes here. Where Swiss law applies, references to the GDPR and to supervisory authorities are read as references to Swiss law and the Federal Data Protection and Information Commissioner.
13.4 We may move the processing to the European Union without a new signature, and will tell you before we do.
14. Liability
14.1 Each party’s liability under this agreement is subject to the exclusions and limits in the terms of service.
14.2 That does not limit either party’s liability to a data subject or to a supervisory authority, and neither of us is liable for the other’s administrative fines.
15. Term, precedence and general
15.1 This agreement lasts as long as we process personal data for you, and the clauses that by their nature should survive do so.
15.2 On personal data, this agreement prevails over the terms of service and over anything else agreed between us. Where the SCCs apply and conflict with this agreement, the SCCs prevail.
15.3 We may update this agreement where the law or the service changes, on 30 days’ notice, so long as the update does not reduce the protection it gives.
15.4 This agreement is governed by the law named in the terms of service, except where clause 13.2 says otherwise.
Annex 1: the processing (SCC Annex I)
A. The parties. You, the merchant whose store is connected, as controller and data exporter, identified by the account details you gave us. Us, ORCA-AD LTD, as processor and data importer, contactable at [email protected].
B. The processing.
- Subject matter: generating try-on stills and videos for your store.
- Duration: while your account is open, and for the retention periods in clause 9.
- Nature and purpose: receiving, storing, transmitting and generating from what your store sends, and returning the result to it.
- Categories of data subject: people appearing in an image you send, and the members of your staff who use the plugin.
- Types of personal data: images you choose, which may show a person where you say you have their agreement; body-profile values (measurements and appearance); an opaque reference to the member of staff who started a render. Where a result is generated from an image of an identifiable person, the result is personal data about that person too.
- Special category data: none is asked for or sought. Body measurements are not biometric data, because they are not processed for the purpose of uniquely identifying anyone; a photograph becomes biometric data only when processed for that purpose, which we do not do. If you send special category data anyway, clause 11.2 applies.
- Frequency: continuous, each time your store asks for a result.
- Retention: as clause 9.
- Sub-processors: as Annex 3, for the duration of the services.
C. Competent supervisory authority. The authority of the member state in which the data exporter is established, or, where the exporter is not established in the European Economic Area, the authority of the member state where its Article 27 representative is established.
Annex 2: how we keep it safe (SCC Annex II)
- Encryption in transit: everything travels over HTTPS. Calls from a store are signed with that store’s own secret, which can be revoked at any time and which is never written to logs.
- Encryption and secrets at rest: stored secrets are encrypted; the key lives outside the database.
- Access control: access to production systems is limited to the people who need it, each with a named account and a second factor. Access is reviewed when someone’s role changes.
- Confidentiality: each person authorised to process personal data is bound to confidence.
- Deletion: images are deleted once used and within 2 hours 10 minutes; the file a store fetches is deleted 72 hours after they are ready. Both run on a schedule that does not depend on a render succeeding.
- Limiting what the service will fetch: a URL we are asked to fetch may reach only the public internet, is checked before and after redirects, and is read only up to a size limit.
- Integrity and availability: requests are checked for what they are permitted to do before anything is generated; the service is monitored for errors and unusual use.
- Restoring availability: databases are backed up daily and kept for seven days; backups are encrypted, and a restore is tested at least every three months and after any change to how backups are made.
- Logging: access and administrative actions are logged, and logs are kept as the privacy policy says.
- Incidents: every security incident is written down, whatever its size, and the record is kept for 24 months. A written procedure says who is told, in what order, and what is done first. This is what the Israeli data security regulations require of a database at our level, and it is also how we are able to tell you anything useful within the 72 hours clause 8.2 promises.
- Who may reach production data: a named list, reviewed with the rest of these measures, kept deliberately short. Access ends when a role does.
- Change control: changes are reviewed, tested automatically and released from version control.
- Testing: dependencies and images are scanned for known vulnerabilities on every build and daily thereafter, and a penetration test is carried out at least once a year by an independent third party, and again after any material change to how the service is built or hosted. A summary of the most recent test is available to you on request, under confidence; the full report is not shared. Article 32(1)(d) asks for a process for testing the effectiveness of these measures rather than for a particular test at a particular interval, and this is the process we run at our size.
- People: staff are told what they may do with personal data, and access ends when their role does.
- Onward transfers: every other processor is bound by terms no less protective than these, including these measures.
- Certifications: none held today. We hold no ISO/IEC 27001 certificate and no SOC 2 report, and we do not claim either. If that changes, this annex says so before we say it anywhere else.
Annex 3: other processors (SCC clause 9 list)
The current list, with each processor’s name, role and country, is available on request under clause 6.2. The privacy policy describes them by kind.