Privacy policy

Last changed: 15 October 2026

1. Who we are

Try-On is operated by ORCA-AD LTD, registered in Israel under number [company number: to be filled in], at [registered address: to be filled in] (“we”, “us”).

Write to us about anything here: [email protected].
Our representative in the European Union, appointed under Article 27 of the General Data Protection Regulation: [EU representative: to be appointed before publishing].
Our representative in the United Kingdom, under Article 27 of the UK GDPR: [UK representative: to be appointed before publishing]. An EU representative does not serve for the United Kingdom, and the Data (Use and Access) Act 2025 did not remove that requirement.
Data protection officer: we have not appointed one. Article 37 of the General Data Protection Regulation requires one for a public authority, for processing that monitors people systematically on a large scale, or for processing special categories of data on a large scale, and we do none of those; the Israeli Privacy Protection Law, as amended in 2025, sets similar conditions, including large-scale processing of sensitive data. Write to the address above with anything a data protection officer would handle, and we will answer it. If what we do changes, this is one of the first lines here that changes with it.

2. What this policy covers

It covers try-on.co, the Try-On service at connect.try-on.co, and the Try-On WordPress plugin. It is written to meet the General Data Protection Regulation, the UK GDPR and the Israeli Privacy Protection Law.

3. The two roles we have

We are the controller of the details of an account and its use of Try-On: the store address and name, the name, business name and email given at sign-up, billing details, sign-in records, and the record of what was generated and what it cost.

We are a processor for what a merchant’s store sends to be rendered: the images, the body-profile values and the choices made with them. The merchant decides what is sent and why; we act on their instructions under the data processing agreement.

4. What we process, why, on what basis, and for how long

Giving us the items marked needed is part of using Try-On: without them we cannot open an account or generate anything. The rest is optional, and refusing it costs you nothing but the feature it belongs to.

What	Why	Legal basis	Kept for	Needed?
Store address and name	To connect a store and answer its requests	Performing our contract (Art 6(1)(b))	While the account is open	Needed
Garment and product images sent for a render	To generate the still or video asked for	The merchant’s instructions, as processor	Deleted once used, and within 2 hours 10 minutes in any case	Needed
Body-profile values (measurements, appearance)	To generate a body for the size a video is for	The merchant’s instructions, as processor	While the profile exists in the store	Needed
A photograph of a real person, sent under a written release the merchant holds	To generate that person wearing the garment	The merchant’s instructions, on the release they hold	As above	Optional
An opaque reference to the member of staff who started a render	So the merchant’s spending record shows who started what, without us learning who they are	The merchant’s instructions, as processor	With the usage record	Needed
Sign-up details: a name, a business name, an email	To open and run the account, and to write to you about it	Performing our contract (Art 6(1)(b))	While the account is open	Needed
Billing details	To sell tokens and to meet tax and accounting law	Contract, and legal obligation (Art 6(1)(b), (c))	7 years from the end of the tax year, which is what Israeli tax and VAT law require of us	Needed
Usage records: what was generated, what it cost, what failed, and how many of the month’s free videos are used	To run the account, bill it correctly and answer questions about it	Performing our contract (Art 6(1)(b))	While the account is open, then as accounting law requires	Needed
Server logs, including IP address, time and what was requested	To keep the service available, to find and fix faults, and to count how many people read which pages of try-on.co	Our legitimate interests (Art 6(1)(f))	90 days, or longer for a particular log while an incident is being investigated	Automatic
Records of a security incident: what happened, when, and what we did	To put it right, to tell whoever must be told, and to keep the law’s record	Legal obligation, and our legitimate interests (Art 6(1)(c), (f))	24 months, as the Israeli data security regulations require	Automatic
Records kept to prevent abuse and fraud	To stop misuse of the service and protect others	Our legitimate interests (Art 6(1)(f))	30 days as a matter of course; 12 months where something was actually flagged, and longer only while a specific investigation or claim is live	Automatic
What you write to us, and what we write back	To answer a question, act on a report, or deal with a request about someone’s rights	Performing our contract, our legitimate interests, and a legal obligation where the law makes us answer (Art 6(1)(b), (f), (c))	12 months after the matter is closed, and longer only while a claim or an investigation is live	Optional

Where we rely on our legitimate interests, we have weighed them against the rights of the people concerned. For logs and abuse records, the interest is a service that stays available and is not misused. For what you write to us, it is being able to answer you and to show later what was asked and what we did. In each case the data is the least we can work with, it is not used to build a picture of anyone, and it is kept for a short and stated time. Ask us for that assessment, or object to the processing, at any time.

If we ever want to use any of this for a new purpose, we will tell you before we do.

5. Where the data comes from

Most of it comes from you. Two kinds do not:

The opaque staff reference and anything in an image reaches us from the merchant whose store sent it, not from the person concerned.
People appearing in an image are known to the merchant, not to us: we hold no name, no contact detail and no way of reaching them.

Telling those people directly would take a disproportionate effort, since we hold nothing with which to reach them (Article 14(5)(b)). This page is how we tell them instead, and the merchant is responsible for telling them what it sends and why. Ask the merchant, or write to us and we will pass it on.

6. What we never do

We do not sell personal data, and we do not share it for anyone else’s marketing.
We do not use images, profiles or results to train models, ours or anyone else’s, and the providers who run the service for us are bound not to either.
We run no advertising and build no profiles of people.
We make no decisions about people by automated means that have legal or similarly significant effects.

7. Who else sees it

We use other companies to run Try-On. By kind:

the provider that runs the models which generate the images and videos;
hosting, network and storage providers, including the storage a finished file sits in until a store fetches it;
the provider that sends the service’s email — the confirmation of a sign-up, an invitation, a password reset;
the provider that receives email sent to the addresses on this site, including [email protected], and passes it on to us;
Freemius, Inc., the payment provider, which sells tokens as merchant of record and holds the billing details for that sale.

No error reporting or monitoring service sees any of this. Nothing in Try-On — not the site, not the plugin, not the service — hands your data to one. If we add one, this list says so before it starts, and merchants get the 30 days’ notice the data processing agreement promises in its clause 6.3.

Each is bound to use the data only to provide its service to us. Merchants can have the current list, with each provider’s name, role and country, by asking us; the data processing agreement carries that right.

We also disclose data where the law requires it, and to advisers under a duty of confidence.

8. Where it is held, and transfers

Our servers are in Israel. The European Commission has decided that Israel offers an adequate level of protection for personal data transferred for automated processing (Decision 2011/61/EU), and transfers from the European Economic Area reach us on that basis.

Where that decision does not cover a transfer, or stops applying, we rely instead on the European Commission’s standard contractual clauses of 4 June 2021, together with the UK Addendum where the UK GDPR applies. The data processing agreement sets out which modules and options apply. Ask us and we will give you a copy of the safeguards in place.

Buying tokens sends billing data to the United States. Freemius, Inc. is established in Delaware, and it processes what you give its checkout. That transfer rests on the same standard contractual clauses, with the UK Addendum where the UK GDPR applies, under the data processing agreement it publishes. We never see your card details: they go to its checkout and its payment providers, not to us.

We intend to move the service to the European Union before we sell tokens. The processing itself will not change, and neither will the protections described here.

9. Keeping it no longer than we need

The table in clause 4 gives the period, or the criteria, for each kind of data. Two of them matter most:

Images are deleted once they have been used, and within 2 hours 10 minutes in any case.
Finished stills and videos are available for 72 hours so that a store can fetch them, and are then deleted from the storage they are fetched from. Anything a store has fetched lives in that store’s own media library, under the merchant’s control and outside this policy.
A copy of a finished video may stay with us after that, to run and check the service. We keep no copy of a video generated from a photograph of a real person, and no copy of the images a video was made from, so nobody’s personal data is held this way.

Backups are overwritten on their own cycle, and anything we must keep for a legal reason is kept only for that reason and only for as long as it lasts.

10. Keeping it safe

We encrypt data in transit, sign every call a store makes with a secret that can be revoked, keep secrets out of logs, limit access to production systems to the people who need it with a second factor, and delete images and finished files on a schedule that runs whether or not a render succeeded. Annex 2 of the data processing agreement lists the measures in full.

11. The rights people have

Anyone whose personal data we hold as controller may ask us to give them a copy, correct it, delete it, restrict what we do with it, object to it, or provide it in a portable form. Where we rely on consent, it may be withdrawn at any time, which does not affect what was done before.

Where we hold data as a processor for a merchant, ask that merchant. If such a request reaches us, we pass it to them and help them answer it.

Write to [email protected]. We may need to check who you are first, and we answer within the time the law allows, normally one month.

If you are unhappy with our answer, you can complain to the Israeli Privacy Protection Authority, or, in the European Economic Area or the United Kingdom, to the supervisory authority where you live, work, or where you think the problem happened.

12. Cookies, tracking and logs

try-on.co sets two cookies, lang and lang_picked. lang holds the language of the pages you last read on try-on.co, such as en or de; lang_picked holds the language you last chose from the language menu, and is set only when you choose one. They hold nothing else: no identifier, nothing about you. When you come back to the address try-on.co on its own, lang takes you to that language rather than the one your browser asks for, so a language you picked stays picked. When you choose a language from the menu and then sign in, the sign-in link tells our service, connect.try-on.co, which language you chose, so it opens in that language too and remembers it there (see below). Both last one year, are sent only to try-on.co, and are read by nobody else. They are needed to give you the language you asked for, so they need no consent; deleting them only means the site goes by your browser’s language again.

Apart from those cookies, try-on.co loads no analytics, no fonts and no scripts from anyone else, and stores nothing in your browser. There is no tracking to consent to.

Our servers do keep access logs, as clause 4 says: the address a request came from, when it arrived, what it asked for, the page that linked to it and what browser it said it was. They are used to keep the service working and to investigate faults and abuse, and they are deleted on the schedule in that table.

We count visits from those logs, on our own servers. The count says how many people read which pages, in which language, from which kind of device and from which site they followed a link. Before anything is counted, the address is cut short (to its first two parts for IPv4, a larger network for IPv6), so the count cannot tell one person from their neighbours, and anything typed into a link after a ? is dropped. Search engines and other robots are left out. Nothing is sent to an analytics company, no cookie or script is involved, and the count itself holds no address. It is kept as long as it is useful, because there is no one in it.

The Try-On service at connect.try-on.co uses a cookie to keep a merchant signed in, and one, lang, that remembers the language a merchant chose there or from try-on.co’s menu, for a year. Both are necessary for the service and need no consent.

Do Not Track and Global Privacy Control. Because we track nobody across websites, there is nothing for these signals to switch off, and we do not respond to them differently. We allow no third party to collect personal information about your activity across websites through our sites.

We do not sell or share personal information, and we have not done so in the last twelve months. We give no personal information to anyone for money, and none for cross-context behavioural advertising.

13. Children

Try-On is for businesses. It is not meant for children, we do not knowingly collect their data, and images of children may not be sent to it.

14. For people and businesses in Israel

Under the Privacy Protection Law: you are not obliged by law to give us any of this, but without the items marked needed in clause 4 we cannot provide the service; the purposes are those in that table; the data is held by us and disclosed to the providers described in clause 7; and you have the right to inspect the data we hold about you, to ask for it to be corrected, and to complain to the Privacy Protection Authority.

15. Changes

We will publish a changed version here with a new date, and tell account holders where a change matters to them. Earlier versions are available on request.

16. Reaching us

[email protected], or the postal address in clause 1.