Vestry biometric policy: retention and destruction
Draft 2026-10-26, US edition · Issued by FortyTwo Venture GmbH · Public at /biometric-policy/, linked as "Biometric policy" in the fitting room. Version us-2026-10-26, effective 26 October 2026.
The short version
No one uses a photo to recognize anyone. As a precaution, every photo and try-on image is permanently destroyed within 24 hours.
| What we hold | Shopper photos, Studio photos and the try-on images made from them, only to make the try-on |
| Face scans, templates, matching | None |
| Kept | Up to 24 hours, or less if the person deletes them |
| Shared with | Only our AI partners, OpenRouter and fal, and the AI model they pass it to (Google, OpenAI, xAI and Bria), with the person's consent, to make the image |
| Sold, leased or traded | Never |
| Contact | {{PRIVACY_EMAIL}} |
1. Scope
This policy covers photos uploaded to the Vestry fitting room on Shopify stores, photos uploaded by merchants in Studio, and the images made from them. Vestry is operated by FortyTwo Venture GmbH, Suurstoffi 20, 6343 Rotkreuz, Switzerland, hosted in the United States, and offered only in the United States.
It is written for the US laws that may treat a face photo as biometric, among them the Illinois Biometric Information Privacy Act, the Texas Capture or Use of Biometric Identifier Act and the Washington My Health My Data Act.
2. What we do, and what we don't
We do send the photo and a product image to an AI partner on our subprocessor list to make one try-on image. We don't measure face geometry, create face templates, identify anyone, compare photos with each other or with databases, or estimate age, skin, body or ethnicity.
If a law treats a photo as a biometric identifier anyway, this policy applies, and:
- this is our written notice that the photo is collected and stored, for the purpose in section 3 and for the time in section 4;
- the person's written release is their tap on "Agree and choose photo" or "Agree and take a photo" in the fitting room, given before the photo is collected;
- for a Studio photo of someone other than the merchant, the merchant must have that person's written consent before uploading (Terms, section 6.1).
3. Purpose
The only purpose is to show the person the product on them. One exception: if a merchant sends Studio feedback "with images", our team sees that Studio photo and its result to find the problem and improve our instructions to the AI. Photos are never used to train AI, for advertising or to identify anyone.
4. Retention and destruction
| Item | Destroyed |
|---|---|
| Uploaded photo | Within 24 hours of upload, or at once when the person deletes it |
| Try-on image | Within 24 hours, or at once when the person deletes it |
| Copies at AI partners | Within 24 hours, under contract, unless the law requires them to keep it |
| Studio feedback images, sent "with images" | Within 24 hours, or at once if the store uninstalls |
| Everything for a store that uninstalls | Photos and images at once, including feedback images |
| Legal limit | Never later than the earliest of: the purpose is met, 24 hours, or 3 years after the person's last interaction |
Legal hold. If the law requires a photo or image to be kept, for example a suspected child-abuse image reported to the authorities or an order from a court, only that copy is kept, only as long as the law requires, and then destroyed.
Destruction is permanent: our own sweep deletes from storage before 24 hours, with a storage rule as backup, and backups contain no photos or images.
5. Disclosure
We never sell, lease, trade or otherwise profit from photos or images. We disclose them only:
- to the AI partners that make the image, with the person's consent (the "Agree" tap) and under a contract that bans training and requires deletion within 24 hours;
- to our own team, for Studio feedback a merchant sent "with images";
- when the law, a warrant or a subpoena requires it.
The store never sees shopper photos or images, and our team never looks at them.
6. Security
Photos get at least the protection we give other confidential data: private storage, encryption, short-lived links, and access limited to the systems that make the image and, for Studio feedback sent "with images", to our team.
7. Questions
{{PRIVACY_EMAIL}}