Vestry privacy policy
Draft 2026-10-26, US edition · Issued by FortyTwo Venture GmbH · Public at /privacy/, linked in the App Store listing and in Studio. Version
{{VERSION}}, effective{{EFFECTIVE_DATE}}.
The short version
- We are FortyTwo Venture GmbH in Rotkreuz, Switzerland, and we run Vestry, a virtual try-on app for Shopify stores.
- Vestry is offered only to stores located in the United States, and only shoppers there see the try-on.
- This policy covers merchants, their staff and visitors to our website. For shoppers we work for the store; see How we use your photo.
- Studio photos are deleted within 24 hours. If you send feedback "with images", only our team sees them, to improve our instructions to the AI. They are never used to train AI models.
- We don't sell data. Vestry is hosted in the United States (Google Cloud, Iowa). Our AI partners are OpenRouter and fal, which pass the photo to the AI model that makes the image (Google, OpenAI, xAI and Bria), in the United States, and for some models in other countries. All our partners are listed at /subprocessors/.
1. Who we are
FortyTwo Venture GmbH, Suurstoffi 20, 6343 Rotkreuz, Switzerland, UID CHE-207.871.215. Privacy contact: {{PRIVACY_EMAIL}}.
Our managing director is responsible for privacy, reachable at {{PRIVACY_EMAIL}}. Our privacy team handles all privacy questions, requests and complaints.
We follow the Swiss Federal Act on Data Protection (FADP), as a Swiss company, and the US federal and state laws that apply to us.
2. Where Vestry is offered
Vestry is offered only to stores located in the United States. Only shoppers in the United States see the try-on. Shoppers whose country can't be determined may still see it. Merchants must not offer Vestry to shoppers elsewhere.
3. Merchants and their staff (we are the controller)
We collect this data from Shopify when you install Vestry, from you when you use the app or write to us, and automatically when you use the app or visit our website.
| Data | Why | Kept |
|---|---|---|
| Shop domain, access token, staff name and email (from Shopify) | To run the app in your admin | Until uninstall, then deleted within 30 days |
| Settings, product choices, design | To show the fitting room the way you set it up | Until uninstall, then deleted within 30 days |
| Plan, usage and billing events (Shopify bills you; we never see card details) | Billing | 10 years (Swiss accounting law) |
| Install date and the Terms version in force on that date | Proof of the contract, kept with the billing records | 10 years, with the billing records |
| Studio photos you upload, and their results | To show you the try-on | Deleted within 24 hours |
| Studio feedback: rating, reasons, comment | To find what went wrong and improve Vestry | Until uninstall, then deleted within 30 days |
| Feedback images, only if you choose "Send with images" | So our team can find the problem and improve our instructions to the AI. Never used to train AI models. Choosing "Send with images" is your consent | Deleted within 24 hours, or at once if you uninstall |
| Free Studio try-on count, kept as a one-way code of your shop domain | So free try-ons don't reset if you reinstall | Kept after uninstall; the domain can't be read back from it |
| Support conversations (Intercom) | To help you | {{SUPPORT_RETENTION}} |
| Website visits (Google Analytics, only if you accept cookies) | To improve our website | {{WEBSITE_ANALYTICS_RETENTION}} |
| Security logs (no images, no emails) | Security | {{LOG_RETENTION}} |
If the law requires us to keep something longer, for example for a court or the authorities, we keep only that item, only as long as the law requires.
Studio rules. Upload only photos of yourself, or of people who gave their written consent. Never upload a shopper's photo.
Feedback notifications. When you send feedback, our team gets a short message on Discord with your store, the rating and your comment, plus a link to Studio. No images and no image links.
4. Shoppers (we are the processor)
The store is responsible for shopper data. We process it only on the store's instructions, under the data processing agreement in our Terms. See How we use your photo and our Biometric policy.
5. What we never do
We never sell data, use photos, images or Shopify data to train AI, use a photo to recognize anyone, show shopper images to merchants, or build profiles of people across stores.
6. Who receives data, and where
Our subprocessors (/subprocessors/): hosting with Google Cloud in Iowa, United States; our AI partners OpenRouter and fal, and the AI models they run (Google, OpenAI, xAI and Bria), in the United States, and for some models in other countries; Resend for sending email, in the United States; Discord; Intercom for support; and Google Analytics on our website. Shopify receives what the app writes back to your store.
Your data is stored in the United States. A Studio photo goes to the AI model that makes the image, which can be outside the United States. Our team works from Switzerland. As a Swiss company, we send data to US partners under the Swiss-US Data Privacy Framework or standard contractual clauses recognized by Switzerland's data protection authority (FDPIC). What goes where, to whom, for how long and on what basis is listed at /subprocessors/.
Google Cloud, our AI partners and email sending are needed to run Vestry; if you don't want them, uninstall the app. Discord, Intercom and Google Analytics aren't needed to run it: they help us with feedback, support and our website.
7. Your rights
Write to {{PRIVACY_EMAIL}} to access, correct or delete your data, object to its use, take a copy with you, or withdraw your consent. We give you a copy of your data or correct it within 72 hours, and answer anything else within 7 days, or sooner if your law requires it. Withdrawing consent doesn't affect what we did before. We don't treat you differently for using these rights.
To complain, write to the same address with "Complaint" in the subject: we confirm within 72 hours and answer within 7 days. If you're not satisfied, you can complain to the Federal Trade Commission or your state attorney general (in California, also the California Privacy Protection Agency), or to Switzerland's Federal Data Protection and Information Commissioner (FDPIC).
8. Security and breaches
Encryption in transit and at rest, multi-factor login for staff, least-privilege access, access logs, and an incident plan.
If a breach affects data we control, we tell Shopify within 24 hours. Where the law requires it, we also tell the people affected and the authorities: the US state authorities that state breach laws name, and the FDPIC. We keep a record of every breach, with its facts, effects and the steps we took, for at least 24 months.
9. Children
Vestry is for adults. We don't knowingly collect data from anyone under 18. If you think we have, write to {{PRIVACY_EMAIL}} and we delete it within 24 hours.
10. Changes
We announce material changes in the app 30 days ahead.