Privacy Policy

Auraist ("Auraist," "we," "us," or "our") operates the Auraist Fashion stylist app for Shopify and other supported eCommerce platforms. This Privacy Policy explains what information we collect when a merchant installs Auraist on their store, and when a shopper uses the styling widget on that store, how we use it, who we share it with, and the choices and rights available to you.

Auraist is offered to merchants under a separate Terms of Service. Where a merchant is the "data controller" of their shoppers' information under applicable law, Auraist generally acts as a "data processor" or "service provider" on the merchant's behalf for shopper data, as described further below.

Auraist is developed and operated by NexPro AI LLP, the parent company of Auraist ("Auraist," "we," "us"). If you have questions about this Policy or our data practices, you can reach us using the contact details below.

2.1 Shopper Data

When a shopper uses the Auraist widget on a merchant's store, we may process:

• The photograph a shopper voluntarily uploads to generate a styled preview.
• Basic device and session information, such as browser type, approximate location derived from IP address, and interaction events (for example, which vibe or outfit was selected).
• Optional feedback a shopper provides about fit accuracy, used to improve size recommendations.

By default, uploaded photographs are processed transiently to generate a styling session and are not retained beyond what is described in "Data Retention" below, unless the shopper opts in to save a look for later, or the merchant has enabled an extended-retention feature and disclosed this to shoppers.

2.2 Merchant Data

When a merchant installs Auraist, we may collect:

• Account and billing information, such as store name, contact name, email address, and billing details processed via Shopify or our payment processor.
• Store and catalog information needed to power styling, including product images, descriptions, categories, and inventory metadata.
• Usage and performance data, including sessions, try-on rate, conversion, and return metrics shown on the merchant dashboard.
• Support communications, including messages sent to our support team and account managers.

3.1 Shopper Data

We use shopper data to:

• Generate the try-on or styled outfit preview requested by the shopper.
• Deliver real-time size and fit recommendations, where enabled by the merchant.
• Improve the accuracy of our AI styling and sizing models, using de-identified or aggregated data where feasible.
• Detect, investigate, and prevent fraud, abuse, or misuse of the Service.

3.2 Merchant Data

We use merchant data to:

• Provide, maintain, and support the Auraist app and dashboard.
• Process subscription billing and communicate about the account.
• Analyze aggregated, de-identified usage trends to improve the product and inform new features.
• Comply with legal, tax, and regulatory obligations.

We do not sell shopper or merchant personal information, and we do not use shopper photographs to build advertising profiles or target ads to shoppers.

4.1 How Photographs Are Processed

When a shopper uploads a photo, it is transmitted securely over an encrypted connection to our styling engine, which generates a composite preview of selected garments overlaid on, or fitted to, the shopper's image or body measurements. Processing occurs on our infrastructure and, where applicable, that of our sub-processors described in "Data Sharing & Third Parties."

4.2 What Our AI Does — and Does Not — Do

• Auraist does not identify shoppers by name from a photo, and does not perform facial recognition to match a shopper to an identity database.
• Auraist does not sell photographs, or use them to build cross-site advertising profiles.
• Body measurements or fit estimates derived from a photo are used only to generate styling and sizing output for that session, unless the shopper opts in to save results to a personal profile.

4.3 Biometric and Sensitive Data Considerations

Depending on jurisdiction, a photograph or body-measurement estimate derived from it may be treated as biometric or sensitive data under laws including the EU/UK GDPR, and U.S. state biometric privacy laws (for example, Illinois, Texas, and Washington). Where required by law, we:

• Obtain shopper consent before processing a photo for styling.
• Do not retain biometric identifiers longer than necessary for the stated purpose.
• Provide a mechanism for shoppers to request deletion of their photo and any derived data.

4.4 AI Model Training

Auraist may use de-identified, aggregated data derived from styling sessions to improve our models. Where a shopper's raw photograph would be used in a way that is not de-identified, we require opt-in consent from the shopper before doing so.

7.1 Service Providers (Sub-Processors)

We share data with vetted service providers who help us operate Auraist, including cloud hosting and storage, AI inference infrastructure, analytics, customer support tooling, and payment processing. These providers are contractually bound to use data only to provide services to us and to apply appropriate security safeguards.

7.2 Shopify

As Auraist is distributed through the Shopify App Store, Shopify may process certain information as described in Shopify's own privacy policy and our app's requested access scopes.

7.3 Legal Requirements

We may disclose data where required to comply with a legal obligation, protect the rights and safety of Auraist, our merchants, or shoppers, or investigate fraud or security incidents.

7.4 Business Transfers

If Auraist is involved in a merger, acquisition, or sale of assets, data may be transferred as part of that transaction, subject to the commitments made in this Policy.

Auraist's infrastructure may process data in countries other than the shopper's or merchant's home country, including the United States. Where we transfer personal data out of the European Economic Area, United Kingdom, or Switzerland, we rely on appropriate safeguards such as Standard Contractual Clauses or equivalent lawful transfer mechanisms recognized by the relevant regulator.

9.1 Rights under GDPR (EEA & UK residents)

If you are located in the EEA or UK, subject to applicable conditions, you have the right to:

• Access — request a copy of personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion of your data in certain circumstances.
• Restriction — request that we limit how we use your data.
• Portability — receive your data in a portable format.
• Objection — object to certain processing, including for direct marketing.

9.2 Rights under CCPA/CPRA (California residents)

• Know what personal information is collected, used, shared, or sold.
• Delete personal information, subject to certain exceptions.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of personal information — Auraist does not sell personal information.
• Non-discrimination for exercising your privacy rights.

9.3 Biometric privacy rights (US — state-specific)

Residents of Illinois, Texas, and Washington may have additional rights regarding biometric identifiers, including the right to a retention schedule and the right to object to collection. Contact us using the details in "Contact Us" to exercise any of the rights above; we may need to verify your identity before completing a request.

Auraist and the merchant's storefront may use cookies and similar technologies to remember widget preferences (such as a selected vibe), measure usage, and secure sessions. See our Cookie Policy for full details on the categories of cookies we use and how to manage your preferences.

Auraist is not directed to children under 16, and we do not knowingly collect personal information, including photographs, from children under 16. If you believe a child has provided us with personal information, please contact us so we can delete it.

We use administrative, technical, and physical safeguards designed to protect personal data, including encryption in transit, access controls, and regular security reviews. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Merchants that require a Data Processing Agreement (DPA) to satisfy their own compliance obligations — including under GDPR — can request one by contacting us. Our Growth and Pro plans include a pre-negotiated DPA template as part of onboarding.

The Auraist widget appears within a merchant's own storefront, which may contain links to third-party sites and services Auraist does not control. This Policy does not apply to those third parties, and we encourage you to review their privacy practices separately.

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date above and, where appropriate, notify merchants by email or through the dashboard.

If you have questions about this Privacy Policy or wish to exercise your privacy rights, contact us at: