Reflektit privacy · Zid
Who is responsible
Reflektit, Hamza Chtioui, Huttenstraße 38, 10553 Berlin, Germany. Contact: contact@reflektit.com.
What we read from Zid
Product names, descriptions, SKUs, prices, categories and product images, of which we keep a copy so product pages load quickly. We store encrypted access tokens, the store's name and address, the merchant's category choices and any 3D models the merchant attached. We do not request customer or order access, and the storefront script does not read shopper details.
Shoppers
A shopper deliberately uploads a still photo, a portrait for glasses or a portrait or full-length photo for clothing, and agrees before each generation. The photo and the selected product image go to Reflektit and the AI provider named in the consent notice. Reflektit does not store the shopper photo or the generated result.
Where a store has the stylist turned on, a shopper may type messages to it and read its replies, and may tick a separate box to let it see their uploaded photo when choosing products. The messages, the store's product list and, only with that box ticked, the photo go to the provider for that answer. The stylist is instructed not to describe or guess anything about the shopper. Body details are not collected on Zid.
No saved profiles, embeddings or identity matching are used on Zid.
The live 3D try-on runs entirely in the shopper's browser. No camera frame, face landmark or measurement leaves the device.
Who receives data
Photos and product images are sent through Aigen, our own image gateway on our server, to Google's Gemini models on Google Cloud Vertex AI. The gateway does not keep Reflektit's photos, results, prompts or messages, only the time, model and cost of each request; Google may keep inputs and results under its own terms. Where we have configured Runware (Runware Ltd, England) instead, photos and product images go to Runware, which runs Google's Nano Banana image models and processes them under its own terms; Runware does not publish how long it keeps them, and may process them in the European Union or the United States. Stylist messages and products go the same way, or to OpenAI where the gateway is not configured. The consent notice names the provider before anything is sent. Where Google or OpenAI processes data outside the European Economic Area, the transfer is covered by their data processing terms, which incorporate the European Commission's Standard Contractual Clauses, and, for the United States, by the EU-US Data Privacy Framework. Our server is in Frankfurt am Main, Germany.
Legal bases
The shopper's consent (Art. 6(1)(a) GDPR) for each photo sent, and their explicit consent (Art. 9(2)(a) GDPR) where a photo may reveal special categories of data. The consent box asks the shopper to confirm they are 18 or older. Performance of the contract with the merchant (Art. 6(1)(b)) for the store's data, and our legitimate interest in a secure, affordable service (Art. 6(1)(f)) for server logs and request counters.
How long we keep it
Shopper photos, generated previews and stylist messages: not stored, held in memory only while the request runs. Generation records (status, timing, provider charges, without the photo): kept for accounting. Request counters by IP address: at most 24 hours. Server logs: at most 30 days. Uninstalling the app deletes the store's record, tokens, product copy and 3D model links.
Your rights
You may ask for access to your data, its correction or deletion, restriction, a portable copy, and object to processing based on legitimate interests. You can withdraw consent at any time by not generating further previews. Because we store no shopper photo or identity, there is usually nothing we can find about a shopper. Write to contact@reflektit.com; we answer within one month. You may complain to a supervisory authority; ours is the Berliner Beauftragte für Datenschutz und Informationsfreiheit.
The full privacy policy and imprint: https://reflektit.com/privacy.