Privacy Policy

1. Data we collect

Merchant accounts (dashboard users):

• Name, email address and password (passwords are stored hashed), or the name and email address of your Google account when you sign in with Google.
• When you install Prova through ikas: your ikas store ID, store name, email address and the access tokens issued by ikas.
• The domains you add, setup progress, plan, credit balance, credit history and notification preferences.
• Payments are taken by Stripe. Your card details never reach us; your email address and account ID are shared with Stripe.

Store visitors (widget users):

• The photo uploaded for a try-on and the try-on image generated from it.
• An anonymous session ID created as a one-way hash of browser information and the store ID. We do not store your IP address in interaction records.
• Widget interactions: page view, widget open, photo upload, completed try-on, like or dislike, add to cart, checkout step and purchase events, and the page address where they happened.
• We do not collect order contents, order values or payment details.

Website visitors: on prova.so we keep anonymous visit statistics (page visited, referring site, device and browser type) with Umami, an analytics tool that does not use cookies.

2. How we use data

• To generate virtual try-on images and scene changes.
• To create and manage merchant accounts and run the ikas integration.
• To manage plans, credits and payments.
• To give merchants try-on, like and post-try-on sales analytics and “People who tried this also tried” suggestions.
• To keep the service secure and prevent abuse.
• To answer support requests and meet our legal obligations.

3. Legal bases

Under the UK GDPR and the EU GDPR we process data on these bases:

• Performance of a contract: merchant account data and payments.
• Consent: the photo a visitor uploads after ticking the consent box in the widget. You can withdraw consent at any time.
• Legitimate interests: anonymous widget and website analytics, service security.
• Legal obligation: accounting and tax records.

4. Photos

An uploaded photo is used only to generate the requested try-on image. It is passed to our AI service provider through an access link for processing.

Photos are automatically and permanently deleted from our servers within 24 hours of upload.

The generated try-on image is created and served from our AI service provider's servers; Prova does not store it on its own servers.

We do not use photos to train AI models, for advertising or for profiling, and we never sell them.

5. Who we share data with

We do not sell data. We share it only with the following service providers, and only as far as needed to run the service:

• Appwrite: database, file storage and authentication infrastructure.
• Wiro: AI image generation (using OpenAI's image models).
• Stripe: subscription and credit payments.
• Google: sign-in with a Google account.
• ikas: store integration and app installation.
• Server and hosting providers.

We may also share data with competent authorities where the law requires it.

6. International transfers

Our company is based in the United Kingdom, and our service providers' servers may be located in the United Kingdom, the European Union, the United States and other countries. We make these transfers on the basis of the safeguards required by applicable data protection law.

7. How long we keep data

• Visitor photos: no longer than 24 hours.
• Account data: for as long as your account is open.
• Widget interaction data: for as long as the related merchant account is open, to provide analytics.
• Invoices and payment records: for the statutory retention periods.

You can delete your account under Settings in the dashboard. You can ask us to delete any remaining data by writing to info@prova.so.

8. Your rights

You have the right to access your data, ask for it to be corrected or erased, restrict or object to processing, receive your data in a portable format and withdraw consent you have given.

Send your requests to info@prova.so. You can complain to the Information Commissioner's Office (ICO) in the UK, your local data protection authority in the EU, or the Personal Data Protection Board (KVKK) in Türkiye.

Because widget session IDs are anonymous, for visitor requests we may need you to tell us the store and the date of your try-on so we can find the record.

9. Cookies and browser storage

• prova.so: we use no advertising or tracking cookies; Umami analytics does not use cookies.
• app.prova.so (dashboard): an essential cookie that keeps you signed in (30 days), a temporary security cookie used during ikas installation (10 minutes), and language, theme and sidebar preferences.
• The widget on stores: uses no cookies. The session ID and consent flag are kept only in the browser's session storage (sessionStorage) and are removed when the tab is closed.

10. Security

Data in transit is encrypted with HTTPS. Only the systems and authorised people needed to run the service can access data. No system is entirely risk-free; if a data breach occurs, we will notify the people and authorities concerned as the law requires.

11. Children

Prova is not intended for anyone under 18. If you are under 18, do not upload photos to the widget.

12. Changes and contact

We may update this policy; the current version is always published on this page. Questions: info@prova.so