Privacy Policy

For merchants and website visitors, Vircab acts as the data controller. For end-customer photo data uploaded through the try-on widget, Vircab acts as a data processor on behalf of the merchant who installed the app; the merchant is the data controller of their own customers.

Contact our team for any privacy matter at info@vircab.com.

• Provide, operate, and improve the Vircab service
• Render virtual try-on images for end customers
• Process payments and manage subscriptions via Shopify
• Detect, investigate, and prevent abuse, fraud, or security incidents
• Comply with legal obligations and respond to lawful requests
• Communicate service updates, security alerts, and support responses

We do not use customer photos to train AI models, sell personal data, or share with advertisers.

We process personal data on the following legal bases:

• Contract — to deliver the service to merchants and to render try-ons requested by their customers
• Legitimate interests — abuse prevention, fraud detection, infrastructure security, and product analytics
• Legal obligation — tax, accounting, and compliance with regulators
• Consent — for non-essential cookies and any marketing communications you opt into

Customer photos uploaded through the try-on widget are the most sensitive data we handle. We treat them with extra care:

• Photos are processed in-memory or on encrypted ephemeral storage and are never used to train AI models
• Photos are only retained as long as needed to deliver the try-on result and are scheduled for deletion afterward
• If a merchant uninstalls our Shopify app, all customer photo data tied to that shop is removed via Shopify's shop/redact webhook within 48 hours, per Shopify policy
• If a customer requests deletion, the merchant can trigger Shopify's customers/redact webhook and we will delete that customer's photo data
• Photos are not shared with third parties beyond the AI rendering infrastructure that produces the try-on result

We use essential cookies for session, security, and language. With your consent, we may use analytics cookies to understand how merchants use vircab.com and improve the product. You can review and change your choices at any time via the cookie banner or by clearing site data.

See our Cookie information section below for details.

We do not sell personal data. We share data only with vetted sub-processors who help us operate the service. Current sub-processors include:

• Hetzner (Germany) — primary infrastructure hosting
• Shopify (Canada) — billing, app distribution, merchant authentication
• Cloudflare (USA) — DNS and content delivery
• Google Workspace (USA) — email and document collaboration
• AI rendering infrastructure provider — confidential third party that processes photo data only for the duration of the render

All sub-processors are bound by data processing agreements with GDPR-equivalent safeguards.

Data may be transferred outside the EEA, UK, Canada, or Türkiye for processing. Where this happens, we rely on Standard Contractual Clauses (EU SCCs / UK IDTA) or other approved transfer mechanisms to ensure equivalent protection.

• Customer photos: retained only as long as necessary to render and deliver the try-on result, then deleted
• Try-on results: stored short-term so customers can revisit; subject to merchant subscription state and Shopify redact webhooks
• Merchant account data: retained while the app is installed and for up to 12 months after uninstall for legal and accounting purposes
• Website analytics: aggregated and retained for up to 14 months
• Support emails: retained for up to 24 months

To exercise any of these rights, email info@vircab.com. We respond within 30 days (or sooner where required by law). We may need to verify your identity before fulfilling requests.

We implement industry-standard safeguards: encryption in transit (TLS), encrypted storage at rest, audit logging, isolated network boundaries, and least-privilege access controls. Our infrastructure runs on production-grade Kubernetes with regular security reviews. No system is perfectly secure, but we work hard to protect your data.

Vircab is built for B2B (merchants) and adult e-commerce shoppers. We do not knowingly collect data from children under 16 (EU/UK) or under 13 (US/Canada). If you believe a child's data has been provided to us, contact us immediately and we will delete it.

When we send commercial emails to potential merchant customers, we comply with CAN-SPAM (US), CASL (Canada), and GDPR (EU). Every email includes:

• Clear identification of the sender (Vircab / arkhe)
• Our physical postal address
• A working one-click unsubscribe link
• A truthful subject line that matches the email content

Our lawful basis for B2B prospect outreach is legitimate interest (GDPR Art. 6(1)(f)). You can opt out at any time and we will stop within 10 business days (often immediately).

We may update this Privacy Policy. Material changes will be announced via the app dashboard or email at least 14 days before taking effect. The "Last updated" date at the top of this page reflects the current version.

For privacy questions, complaints, or rights requests:

• Email: info@vircab.com
• Postal address: Tekstilkent Koza Plaza A Blok Kat:1 No:1, 34235 Esenler, Istanbul, Türkiye
• Operator: arkhe