Merchant terms.
And the data agreement.

These terms are an agreement between MirraFit (“MirraFit”, “we”, “us”) and the business that installs the MirraFit app on its store (“you”, “the merchant”). They apply from the moment you install the app and for as long as it remains installed.

Part Two below is the data processing addendum. It forms part of this agreement and governs the personal data MirraFit processes on your behalf. If anything in Part One conflicts with Part Two on a data protection question, Part Two wins.

The person accepting these terms confirms they are authorised to bind the business.

• ╱A Try On button placed on your product pages through a Shopify theme app block, whose label, colour, position and per-product visibility you control from the app.
• ╱A fitting room in which a shopper uploads their own photo and receives an image of themselves wearing the product, generated by a third-party AI model, with add-to-cart and download actions on the result.
• ╱A merchant dashboard showing subscription and usage, try-on and funnel analytics, per-product breakdowns, a list of the shoppers who used the fitting room, and a CSV export of the shoppers who consented to be contacted.
• ╱A Shopify web pixel that measures whether try-ons lead to carts and purchases.

We may change how these work, and we may add or remove features. We will not materially reduce the core try-on function during a paid term without telling you.

Installation happens through Shopify OAuth. The app requests the scopes read_products, write_pixels and read_customer_events. The last two exist solely to register and run the attribution pixel. If we ever need a broader scope, Shopify will ask you to re-authorise — we cannot widen access silently.

The pixel is registered on install and declares an analytics purpose only. Shopify will not load it for a shopper who has declined analytics consent on your store. You can remove it from your Shopify admin at any time; doing so switches off purchase attribution and nothing else.

What counts as a try-on

A try-on is one request that reaches the rendering engine, whether it comes back successfully or fails there — both cost the same to run. An upload rejected before the engine (an unreadable file, an image below the minimum resolution, or no person detected in the frame) does not count and is not charged.

Limits you control

The app gives you three spend controls, which you set and are responsible for: a rolling 24-hour cap per shopper, an hourly ceiling for your whole store, and an optional pool of bonus try-ons granted to a shopper who submits the email form. Setting the bonus to zero turns the email form off entirely. Alongside these we apply our own abuse backstop keyed on a hashed IP address.

Billing

Subscription charges are created and collected by Shopify through the Shopify Billing API on the plan you select in the app, and appear on your Shopify invoice. MirraFit never handles your card details. You change plan or cancel through Shopify or by uninstalling the app. Uninstalling does not entitle you to a refund of the current period unless we agree otherwise or the law requires it.

You are the data controller for everything the fitting room collects from your shoppers. In practice that means:

• ╱Tell your shoppers. Your own privacy notice must cover the try-on: that a photo is uploaded and processed by a third-party AI service, what the device identifier is for, and what happens if they submit the email form. You may link to our privacy page as a description of the processing.
• ╱Run a working consent banner. The attribution pixel honours Shopify’s customer privacy signals, but those signals only exist if your store collects consent properly.
• ╱Use the leads lawfully. Names and email addresses captured through the form are yours, given on an explicit marketing-consent checkbox naming your brand. You are the sender of any marketing that follows, you must honour unsubscribes, and you must not sell that list on.
• ╱Own your product images. You confirm you hold the rights to the product imagery the fitting room renders from.
• ╱Do not use MirraFit on photos of people who did not choose to upload them. The service is built for a shopper putting their own photo in. It is not for processing third-party images.

You agree not to:

• ╱Reverse engineer, decompile or attempt to extract the underlying models or prompts.
• ╱Resell, sublicense or expose the MirraFit API to anyone outside your own store.
• ╱Circumvent, script around or automate past the try-on caps, or generate try-ons other than for genuine shoppers on your store.
• ╱Attempt to reach another merchant's data, or access endpoints you have not been given credentials for.
• ╱Use the service for unlawful, infringing, deceptive or sexually explicit content, or in a way that would put us in breach of Google Cloud's or Shopify's terms.

We may suspend the service on notice if we reasonably believe this section is being breached, and immediately where a breach is causing harm or exposing personal data.

Try-on images are machine-generated approximations produced for visualisation. They are not a representation of true fit, size, drape, colour accuracy or product condition, and they should not be presented to shoppers as a sizing guarantee or as a photograph of the product. We do not warrant the accuracy of any generated image, and generation can fail or produce an unsatisfactory result.

MirraFit owns the app, the widget, the dashboard and everything we build. You own your store, your product imagery and your brand. We claim no ownership of your product images, of a shopper’s photo, or of the try-on images generated from them.

We will not use your name or logo as a reference customer without your permission.

The service is provided on an as-is and as-available basis. We do not commit to a service level, a guaranteed uptime or a guaranteed rendering latency except where one is separately agreed with you in writing. The service depends on third parties — Shopify, Google Cloud, Amazon Web Services — and an outage at any of them will affect it.

Support is provided at the level described for your plan, by email.

This agreement runs for as long as the app is installed. You may end it at any time by uninstalling from your Shopify admin. We may end it on reasonable notice, or immediately for non-payment or for a breach of section 06.

On uninstall, Shopify notifies us and we mark your store inactive. When Shopify sends the shop redaction request that follows, we hard-delete every record we hold for your store — settings, usage, shopper device records, try-on events, attribution records and the aggregate statistics. That deletion is not reversible, so export your consented leads from the dashboard before you uninstall. Deletion is set out in full in the addendum below.

We may update these terms. When a change is material we will update the date at the top of this page and notify the contact address on your Shopify account. Continuing to use the service after a change means you accept it; if you do not, uninstall the app.

For all personal data processed through the MirraFit app on your store, you are the controller and MirraFit is the processor. You decide that the fitting room runs, on which products, with which limits, and whether the email form is offered. We process that data only to provide the service to you and for no purpose of our own.

Where we process your own merchant account and contact data — for billing, support and account administration — we act as controller, and our privacy notice applies to that.

Where Shopify, Google Cloud or Amazon Web Services process data under their own terms with you or with us, those terms also apply.

Subject matter. The provision of the MirraFit virtual try-on service, its usage limits, its analytics, and the optional email capture, as described in Part One.

Duration. For as long as the app is installed on your store, plus the retention periods set out in D11. The obligations in D7, D10 and D11 survive termination for as long as we hold any relevant data.

We carry out the following operations, and only these:

• ╱Receiving a shopper's uploaded photo, validating it, converting it to JPEG, stripping its embedded metadata and resizing it.
• ╱Transmitting that photo to Google Cloud for an automated check that a person is visible, and to the Vertex AI try-on model to render the garment.
• ╱Storing the resulting image as a private object with automatic expiry, and serving it back to the shopper over a short-lived signed link.
• ╱Recording an event per try-on so that per-shopper and per-store limits can be enforced, abuse prevented, and your analytics produced.
• ╱Recording add-to-cart and checkout events so that try-ons can be attributed to sales.
• ╱Collecting a name and email address where a shopper submits the optional form with explicit consent, and making them available to you.
• ╱Producing identifier-free daily aggregate statistics.
• ╱Deleting data on the schedule in D11, and on request under D9.

Data subjects. Visitors and shoppers on your storefront who use the fitting room; and your own staff who use the merchant app.

MirraFit does not intentionally process special categories of personal data, and does not process payment card data, government identifiers, health data or precise location. Shoppers may upload any image they choose; a shopper photo is not used to identify anyone.

• ╱You warrant that you have a lawful basis for the processing you instruct, and that you have given your shoppers the information the law requires.
• ╱You are responsible for collecting and honouring consent on your store, including the analytics consent that governs whether the attribution pixel loads at all.
• ╱You set the try-on caps and the email bonus, and you are responsible for the spend and the data collection they permit.
• ╱Your instructions to us are given through the app's settings, through this addendum and through the merchant terms. Instructions outside those channels must be in writing and may be chargeable if they require work beyond the service.
• ╱You are responsible for how you use the consented contact data you export.

• ╱We process personal data only on your documented instructions, including on international transfers, unless the law requires otherwise — in which case we will tell you before processing, unless that law forbids it.
• ╱We will tell you if, in our opinion, an instruction infringes data protection law.
• ╱Everyone we authorise to process the data is bound by a duty of confidentiality.
• ╱We implement and maintain the technical and organisational measures in D7.
• ╱We engage sub-processors only under D8, and remain fully liable to you for their performance.
• ╱We assist you with data subject requests (D9), and with security, breach notification and impact assessments (D7, D10), taking into account the nature of the processing and the information available to us.
• ╱We delete data as set out in D11 and make available the information needed to demonstrate compliance under D12.

These are the measures actually implemented today, not a wish list:

• ╱Encryption in transit. All traffic to the MirraFit API and merchant app runs over HTTPS with TLS certificates that renew automatically. The storefront widget and the pixel call the API over HTTPS only, and product images may only be fetched over HTTPS.
• ╱Shopper photos are never persisted. They are held in process memory for the duration of the request and are never written to disk on our servers or into our database.
• ╱Result images are private and expiring. They are stored as private objects, are never publicly readable, are retrievable only through a signed URL valid for one hour, and are removed by an automatic storage lifecycle rule set to expire objects within three days.
• ╱IP addresses are hashed before storage. Each address is hashed with SHA-256 and a secret salt at the edge of the request. The raw address is never written to the database and never written to the logs.
• ╱Merchant analytics endpoints are authenticated. The endpoints that return captured shopper emails require a shared secret sent server-to-server and are not reachable from a browser.
• ╱Webhooks are verified. Every Shopify webhook is checked against a timing-safe HMAC signature before any action is taken on it.
• ╱Rate limiting and abuse controls. A rolling 24-hour cap per shopper device, a hashed-IP backstop above it, an hourly ceiling per store, and a per-IP throttle on the public beacon endpoints.
• ╱Data minimisation in logs. Request logs record method, path, status code, timing and internal job IDs. They do not record IP addresses, photos, names or email addresses, and the record assembled for a data request is deliberately never logged.
• ╱Network exposure. The application server binds to the loopback interface and is reachable only through a reverse proxy that terminates TLS. It is never addressed directly from the internet.

We may change these measures, but not in a way that materially reduces the overall level of security. The current version is always the one on this page.

You give general authorisation for the sub-processors below. This is the complete list.

Changes. Before we add or replace a sub-processor we will give you at least 30 days’ notice, by email to the contact address on your Shopify account and by updating this page. You may object on reasonable data protection grounds within that period. If we cannot resolve the objection, you may end this agreement by uninstalling the app, and we will refund any prepaid fees for the unused remainder of the current period.

We impose data protection obligations on each sub-processor no less protective than those in this addendum, and we remain fully liable to you for their performance.

We implement Shopify’s mandatory customer data-request and customer-redaction webhooks and act on them. A redaction hard-deletes the matching shopper device record, its try-on event history and its attribution records. Identifier-free daily aggregates are deliberately left intact, because they carry nothing that identifies the shopper and erasing them would silently rewrite your historical reporting.

If a shopper contacts MirraFit directly, we will not answer on your behalf. We will forward the request to you promptly and assist you in responding, unless you instruct us otherwise. We will also provide reasonable assistance with data protection impact assessments and prior consultations, taking into account the nature of the processing and the information available to us.

On becoming aware of a personal data breach affecting personal data we process for you, we will notify you without undue delay and in any event within 48 hours, at the contact address on your Shopify account.

That notification will include, so far as we know it at the time:

• ╱The nature of the breach, including the categories and approximate number of data subjects and records concerned.
• ╱The likely consequences.
• ╱The measures taken or proposed to address it and to mitigate its effects.
• ╱A contact point for further information.

We will provide further information as the investigation progresses. We will not notify a supervisory authority or a data subject on your behalf unless the law requires it of us or you instruct us to.

On termination.When you uninstall, Shopify notifies us and your store is marked inactive so that a reinstall within Shopify’s grace window does not lose your configuration. When Shopify sends the shop redaction request, we hard-delete every record for your store across all tables — store settings and usage, shopper device records, try-on events, attribution records and the aggregate statistics. Result images expire on their storage lifecycle rule independently of this.

Return of data. Export your consented leads from the dashboard before uninstalling. If you need an export afterwards, ask us within the grace window before the redaction request is processed; once deletion has run, the data cannot be recovered.

We will make available to you the information necessary to demonstrate compliance with this addendum, and will allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate. Audits are on at least 30 days’ written notice, during business hours, subject to confidentiality, and no more than once in any twelve months — unless a supervisory authority requires otherwise or an audit follows a personal data breach.

Rendering a try-on involves a transfer of the shopper’s photo to Google Cloud in the United States. Our servers, database and result-image storage are in the European Union (Stockholm). You instruct and authorise these transfers by using the service.

Our use of Google Cloud and Amazon Web Services is governed by each provider’s standard data processing terms, which incorporate the European Commission’s Standard Contractual Clauses for transfers out of the EEA and the UK. Where you require the Clauses to be entered into directly between us for onward transfers, contact us and we will put them in place.

Notices to you are sent to the contact address on your Shopify account. Notices to us, and anything arising from this addendum — data subject requests, sub-processor objections, breach queries, audit requests — go to privacy@mirrafit.co.

The shopper-facing description of all of this lives on our privacy page.