A virtual try-on asks a shopper to upload a photograph of themselves. That is a meaningful thing to ask, and the answer to what happens next should be short, specific and checkable. It is below, including the parts that are limits rather than features.
A shopper's photo is used only to generate the try-on that was requested. It is permanently deleted within 24 hours. It is never used to train AI models. These three statements are the whole policy, and they match the commitments in the customer agreement rather than sitting alongside them.
Viewrobe is fully GDPR and CCPA compliant. The privacy policy sets out the legal detail, including the rights available to a shopper and how to exercise them.
| Control | Detail |
|---|---|
| In transit | TLS 1.3 |
| At rest | AES-256 |
| Hosting | Google Cloud |
| Infrastructure certification | SOC 2 Type II and ISO 27001, held by Google for its infrastructure |
| Shopper photo retention | Permanently deleted within 24 hours |
| Model training on shopper photos | Never |
Plenty of vendors blur this line, so to be explicit: Viewrobe does not hold SOC 2 Type II or ISO 27001 certification. Google holds those for the infrastructure Viewrobe runs on. If a security questionnaire asks whether the vendor is certified, the honest answer is no, and the relevant answer is that the hosting is.
We do not publish an uptime figure or a public SLA, because there is no public status page behind one. Availability commitments belong in a contract where they can be held to.
If your review process needs something not covered here, ask. A short, specific answer is always better than a page of reassurance.
No. A shopper photo is used only to generate the try-on that was requested, and is never used to train AI models.
They are permanently deleted within 24 hours.
No, and we will not imply otherwise. Viewrobe runs on Google Cloud, and it is Google's infrastructure that holds SOC 2 Type II and ISO 27001 certification. Those are Google's certifications, not ours.
Yes, Viewrobe is fully GDPR and CCPA compliant.
TLS 1.3 in transit and AES-256 at rest.
Not at present. There is no public status page, so rather than quote a number we do not measure publicly, availability commitments are agreed contractually.
