Virtual try-on asks a shopper for something no other part of a storefront asks for: a photograph of their body. Everything downstream of that request is a privacy decision, whether or not anyone writes it down.
Deletion is a default, not a setting
Shopper photos are deleted automatically. Retention is 1, 3 or 7 days, chosen per account, and there is no option meaning *keep indefinitely*. The ceiling is a week because we could not describe a legitimate reason to hold a stranger's photograph for longer.
Storage paths are bucketed by expiry rather than by user, so deletion is a sweep over a prefix, not a per-record hunt that can silently miss rows. Access is through signed URLs that expire — a leaked link stops working on its own.
The distinction we care about: a policy that says photos are deleted depends on somebody remembering to delete them. A system bucketed by TTL deletes them because that is what it does.
Not training data
Shopper photos are never used to train models. That is not a stance we can take credit for so much as a constraint we designed around — it is why the pipeline has no path that copies an input into a corpus, and why the erasure endpoint takes an opaque externalUserId you supply rather than anything that identifies a person to us.
Disclosure is not optional
Every generated image is labelled. The visible AI MODIFIED badge can be configured, because different jurisdictions and different storefronts need different placements.
The machine-readable provenance metadata cannot. It is written on every generation, and there is no flag to turn it off. An image that leaves this system can always be identified as generated, by a tool, without relying on the badge surviving a screenshot or a re-crop.
Making that configurable would have been a small feature and a large mistake. The whole value of provenance is that it is not negotiable per customer.