Privacy policy
Who we are
ORA W¹ ("ORA", "we") is a Shopify app that adds live camera try-on to a store's product pages. It is operated by SF Dyes, Hague Building, 1st Floor, 9 Sprott Road, Ballard Estate, Mumbai 400001, India. Contact us at karamvir@oralabs.in.
ORA W¹ is currently offered only to stores based in India.
A store that installs ORA (the "merchant") chooses to offer try-on to its shoppers. For shopper data, the merchant decides why and how try-on is offered, and ORA processes that data on the merchant's behalf. For the merchant's own account data, ORA decides how it is used.
1. What we process
Shoppers using try-on on a store
| Data | What happens to it | Stored by ORA? |
|---|---|---|
| Live camera video | Sent from the shopper's browser to our video processing provider while the try-on window is open, and turned into a live video of the shopper wearing the garment, which streams back to the browser. ORA's own servers issue a short-lived session key and never receive the camera video or the result. | No |
| Anonymous session and event records | A random per-visit session id, the event (for example "button shown", "try-on started"), the product variant, a test flag, a timing figure, and an experiment group label when the merchant runs a comparison. | Yes, linked to the store, never to a person |
| Settings on the shopper's device | Browser storage keeps the consent choice, the preferred camera, the menswear or womenswear choice and the experiment group. Only the experiment group label leaves the device. | On the device only |
| Cart attribute | When the merchant runs a comparison, the experiment group and date are added to the shopper's cart so they appear on the merchant's order. | Held by the merchant in Shopify |
| IP address | Used in memory only, to limit how often one visitor can start sessions. Never written to disk. | No |
ORA does not collect shoppers' names, email addresses, phone numbers, payment details or order history. The app does not request Shopify's customer or order scopes.
Merchants
| Data | Why |
|---|---|
| Store domain and Shopify access token | Running the app for the store |
| Product data read from Shopify, and the try-on settings ORA writes to products | Choosing which products offer try-on and which photo each uses |
| Settings (button, window, placement, warnings), including an optional email address for usage warnings | Running the app as configured, and sending the warnings asked for |
| Usage records (session start, seconds used, status) and our provider's usage figures | Allowance, billing and reconciliation |
| Support requests | Answering them |
| Error and audit logs | Fixing faults, and recording what ORA staff changed and why |
2. Who processes it
| Party | Role | Location |
|---|---|---|
| Our video processing provider, a specialist real-time video company incorporated in Singapore | Turns live camera video into the try-on video during the session | Outside India. The provider runs servers in the United States and China, and does not yet let us choose which one handles a session. |
| Railway | Hosts ORA's app server and database | United States |
| Resend | Delivers emails: usage warnings to merchants who ask for them, and support messages to ORA | United States |
| Shopify | The platform the app runs on: installation, app proxy, webhooks, billing | Per Shopify's own privacy policy |
We are finalising a data processing agreement with our video processing provider that sets how long it may keep session video and what it may do with it. Until it is signed, the provider's own terms apply to its copy. We will update this page, with a new date, when the agreement is in place.
3. Where data goes
- ORA's servers and database are in the United States.
- Camera video goes from the shopper's device to our video processing provider, outside India, for the length of the session. The provider runs servers in the United States and China, and we have asked it to commit to one region in our agreement.
- Store data travels between Shopify and ORA.
4. How long we keep it
| Data | Retention |
|---|---|
| Camera video and the generated try-on video, at ORA | Not stored. Streamed during the session only. |
| Camera video and the generated try-on video, at our provider | The provider has told us in writing that it keeps session input and output for 48 hours, and its service logs for up to 90 days (180 days in its China region). Our data processing agreement will make these limits binding (see section 2). |
| Shopify access token and app sessions | Deleted when the merchant uninstalls |
| Merchant settings, usage records, anonymous events, support requests, error and audit logs | Kept while the app is installed. On uninstall, try-on stops at once and records are kept so a final bill can be settled and a quick reinstall keeps its settings. Everything is erased when Shopify sends its erasure request, 48 hours after uninstall. |
| Database backups | Daily snapshots, the newest seven kept, plus our host's volume backups. Erased data leaves the backups as they rotate out. |
| Temporary provider session key | Kept only until the provider has reported usage for that session |
| Shopper device settings | In the shopper's browser until they clear it |
5. Deletion and requests
- Merchants. Uninstalling ORA starts deletion, and Shopify's erasure request removes every record ORA holds for the store. You can also write to karamvir@oralabs.in.
- Shoppers. ORA holds nothing that identifies a shopper, so a Shopify customer data request or erasure request finds no data and is answered as complete. Device settings are removed by clearing the site's data in the browser. Questions about the provider's copy of a session can be sent to us and we will pass them on.
- Verification. Every request from Shopify is checked against Shopify's signature, and an unsigned request is refused.
6. Children
ORA W¹ is meant for adults. ORA does not knowingly process a child's camera video. The merchant decides whether its store is aimed at children, and should not offer try-on on products made for children.
7. Security
- All traffic is over HTTPS.
- Requests from Shopify are signature checked.
- Provider keys are short-lived and capped to one session.
- The database sits on a private volume, and staff access to ORA's console is per person and logged.
8. Changes
We post changes here with a new date. If a change affects what shoppers agree to, the try-on notice asks again.
9. Contact and grievances
Privacy questions and grievances: Karamvir Sachdev, karamvir@oralabs.in, SF Dyes, Hague Building, 1st Floor, 9 Sprott Road, Ballard Estate, Mumbai 400001, India. We reply within 7 working days.