1. Who we are and how to reach us
Experimenta is an AI-powered virtual try-on that online stores add to their websites. It is operated by:
| Item | Details |
|---|---|
| Data controller | 58.025.078 Vinicius dos Santos Felix |
| CNPJ (Brazilian company ID) | 58.025.078/0001-40 |
| City | Jacareí, São Paulo, Brazil |
| Data Protection Officer (LGPD) | Vinicius dos Santos Félix |
| Privacy contact | privacidade@experimenta.store |
| General contact | contato@experimenta.store |
In the try-on, we decide how your photo is used and how long it is kept, so we are the controller of that data. The store where you use the try-on is responsible for the sale and for your purchase data, under its own privacy policy.
2. Who this policy applies to
- Shoppers who use the virtual try-on in partner stores (sections 3 to 9).
- Visitors to experimenta.store who join the waitlist (section 10).
- Merchants and operators who use the Experimenta dashboard (section 10).
The try-on is intended for people 18 years of age or older.
3. Data used in the virtual try-on
We collect only what is needed to create the preview. We do not ask for your name, email, phone number, tax ID or location.
| Data | What it is |
|---|---|
| Your photo | The image you upload, resized on your own device and stripped of metadata (EXIF and location are removed) |
| Result | The generated image with the product, placed over your photo |
| Consent | Version of the consent text you accepted, version of these documents, date and time, and your statement that you are 18 or older |
| Technical identifiers | An anonymous device code and a code derived from your IP address, stored in hashed form, without the original IP |
| Try-on code | A short code shown with the result (e.g. 7K3M-9QZD) that lets you request deletion by email |
| Usage data | Store, chosen product, photo type (for example, full body or legs and feet) and how many times the result was shared or downloaded |
| Technical performance data | File size, time taken by each step and connection type (e.g. 4G) |
| Your feedback | Vote (liked or didn’t like), reason, optional comment and any complaints you send |
Please do not include personal data (name, phone number, email) in comment and complaint fields.
4. How your photo is handled
Your photo is used only to create the preview of the product on you, and it is deleted automatically within 30 days.
- On your device: the photo is resized before it is uploaded.
- On our servers (in France, European Union): we remove metadata (such as location) and find the part of the body where the chosen products will appear (for example, the feet, for footwear).
- Sent to the AI provider: only a crop of the photo with the part of the body where the products will appear (for example, from the feet to the waist for footwear, trousers and shorts; the torso for shirts; the body from the neck down for dresses) is sent to an artificial intelligence provider we contract (processor), in the United States, together with the product photos. We avoid sending your face: it is only included when the product is worn on or near the face (such as glasses, earrings and necklaces) or when it cannot be separated from the part of the body where the product goes. The provider generates the image with the products and may fill in parts of the body that are not in the photo, such as the legs; the result is a simulation and may contain errors. Under our contract, this content is not used to train models or for any other purpose and may be kept for up to 30 days for abuse prevention.
- Result: we place the generated image over your photo and show it to you. Your full photo never leaves our servers.
- Deletion: the photo and the result are deleted automatically within 30 days (cleanup runs once a day, so it may take up to 24 extra hours). You can delete them sooner, at any time (section 9).
The store has no access to your photo or the result. The Experimenta team may view them only for support, security and quality control, until they are deleted. The photo is not used for any other purpose, including facial recognition or identifying you.
5. Why we use data and on what legal basis
| Purpose | Data | Legal basis (LGPD) |
|---|---|---|
| Create the preview of the product on you | Photo, result, product | Consent (art. 7, I) |
| Send the crop to the AI provider (US) and store data on servers in France | Photo crop, result | Specific consent to international transfer (art. 33, VIII) |
| Security, abuse prevention and per-person usage limits | Hashed technical identifiers | Legitimate interest (art. 7, IX) |
| Measure and improve performance and quality | Usage data, performance data and your feedback | Legitimate interest (art. 7, IX) |
| Handle deletion requests, complaints and legal obligations | Consent record, try-on code, complaints | Compliance with legal obligations and the regular exercise of rights (art. 7, II and VI) |
You can withdraw your consent at any time by deleting the photo (section 9). Without consent, the preview cannot be created. We do not make decisions about you based on this data and we do not build behavioral profiles.
7. How long we keep data
The photo and the result are kept for at most 30 days. What remains after that cannot identify you.
| Data | Retention |
|---|---|
| Photo and result | Up to 30 days, deleted automatically (may take up to 24 extra hours), or sooner at your request |
| Crop sent to the AI provider | We do not keep it. The provider may keep it for up to 30 days for abuse prevention |
| Hashed technical identifiers | Deleted together with the photo, within 30 days |
| Comments and complaint text | Up to 12 months, or sooner at your request |
| Non-identifying records (product, timings, vote, consent version) | Kept for statistics, with no way to link them to you once the identifiers are deleted |
| System logs | Up to 14 days. They do not record your IP address |
Backups: they do not include photos or results. Database backups are kept for up to 30 days and are encrypted in the copy stored outside the server.
9. Your rights and how to exercise them
Under the LGPD (art. 18), you can request: confirmation that we process your data, access, correction, anonymization, blocking or deletion, portability, information about who we share it with, and withdrawal of consent. You can also object to processing based on legitimate interest.
How to make a request:
- In the try-on, right away: use the “Excluir minha foto agora” (Delete my photo now) button on the same device and browser. It deletes the photo, the result, the technical identifiers and your comments and complaints for that store. If an image is still being generated, wait for it to finish and try again.
- By email: write to privacidade@experimenta.store with the try-on code shown with the result (e.g. 7K3M-9QZD). Because we do not collect your name or email in the try-on, the code is what lets us find your data. We reply within 15 days.
- Complaint to the ANPD: if you are not satisfied, you can file a complaint with Brazil’s National Data Protection Authority (ANPD) at gov.br/anpd.
Without the try-on code and without access to the device you used, we may not be able to find your data. Even so, it is deleted automatically within the periods in section 7.
10. Other information
Security
We use encrypted connections (HTTPS) on every page, restricted dashboard access with per-store controls, hashed identifiers instead of IP addresses, encrypted off-server backups and minimal data collection. If a security incident may cause significant risk, we will notify the ANPD and the people affected, as required by law.
Minors
The try-on is only for people aged 18 or older, and we ask for this statement before each use. If we learn that we have received data from a minor, we will delete it. Let us know at privacidade@experimenta.store.
Waitlist (experimenta.store website)
If you sign up, we receive your name, email, store address, platform, business segment and any message you write, so we can contact you about Experimenta. The legal basis is your consent. The details reach our team by email and are kept for up to 12 months or until you ask for deletion at privacidade@experimenta.store. To prevent abusive submissions, the website keeps a code derived from your IP address (hash) for up to 1 hour, without the original IP.
Merchants and operators (dashboard)
We process name, email, password (stored in hashed form) and store details to provide the contracted service (LGPD, art. 7, V). Service terms for merchants are set out in a separate agreement. To correct or delete this data, write to privacidade@experimenta.store.
Changes
We may update this policy. The version and date are shown at the top of the page, and significant changes will be announced in the try-on before your next use, with a new consent request when the law requires it.