Privacy notice

Controller and contact

Kevin Friedl, trading as Focus Labs, is responsible for personal data processed through the free Virtual Try On consumer service, virtualtryon.store. For privacy requests and business inquiries:

questions.focus@gmail.com

Website and hosting

Firebase Hosting and Google Cloud deliver the website and process connection data such as IP address, request time, resource, browser, device and response status. We use these data for availability, troubleshooting and security, based on our legitimate interests under Article 6(1)(f) GDPR. Hosting IP records may remain with Google for a few months. See Firebase privacy information.

Product images from an integrated shop

The public tool uses a product photo you upload. An integrated shop can instead supply an image address, product name, category and purchase link. Our Firebase server in Frankfurt retrieves an external product image over HTTPS; it does not extract the shop page. The image host receives the requested image URL and our server connection details. We do not use your shop account, cookies or credentials.

This processing supplies the service you request under Article 6(1)(b) GDPR. Opening the shop yourself creates a separate connection governed by its privacy notice.

Photos and image generation

When you start generation, your selected product image, prepared personal or room photo, category and optional instructions travel over HTTPS to a Firebase function in Frankfurt, then to OpenAI's image-editing API. The generated image returns to your browser. We process these inputs to provide your requested preview under Article 6(1)(b) GDPR. Providing them is voluntary, but generation cannot work without the required images.

Use photos you are entitled to use, with permission from other people shown. Avoid sensitive details. We do not use photos for identity verification or biometric identification. Generating a preview does not make a decision with legal or similarly significant effects about you.

Image storage and OpenAI

We do not save input or result images in our own image database or storage bucket. The app keeps them in page-session memory, not localStorage; removing them, reloading or closing the page ends that availability. This does not delete provider records or copies you save or share.

OpenAI does not train on API data by default. Standard abuse logs can retain content for up to 30 days, with legal and safety exceptions. We do not promise zero retention.

Security, limits and browser storage

Firebase App Check with Google reCAPTCHA Enterprise checks technical signals, including IP address, browser/device information and interaction signals, to prevent automated abuse. Security cookies and locally cached verification tokens may be used; this is distinct from image storage. See reCAPTCHA data processing.

Firestore stores daily counters keyed by IP hashes and separate hashed request-token identifiers to prevent reuse. These pseudonymous records contain no raw IPs or tokens, images or prompts. Counters expire 72 hours after their last update; token markers expire 72 hours after creation. Automatic deletion may occur later. Infrastructure providers still process connection IPs.

Our basis is Article 6(1)(f) GDPR: protecting service availability and preventing misuse. We use no advertising or audience-analytics tools and offer no newsletter.

Operational records

Application logs record request identifiers, category, timings, file sizes, usage counters and error information for operation and abuse prevention under Article 6(1)(f) GDPR. We do not deliberately log image contents or full prompts on our servers. The browser's developer console currently displays the generation prompt locally. Operational records follow the configured log retention and are kept only as needed for these purposes or a specific legal obligation.

After a successful free preview, a private Telegram bot message informs us about the category, interface language, model, duration, token usage, estimated cost, broad location if supplied by Google infrastructure, device class, browser family and a daily rotating pseudonymous visitor identifier. It contains no raw IP address, photo or prompt. We use this operational notification under Article 6(1)(f) GDPR to monitor free-tool use and costs. Telegram stores the message in its cloud; see its privacy policy.

Contact and business inquiries

The inquiry form sends your email, shop URL, selected inquiry options and optional message through Firebase to our private Telegram bot chat. It sends no product or personal photos automatically. Telegram stores these as cloud messages; they are not end-to-end encrypted. See Telegram's privacy policy. You can also email us.

We use correspondence to answer you: Article 6(1)(b) GDPR for contractual inquiries, otherwise Article 6(1)(f) for handling communications. We retain it while resolving the inquiry and any necessary follow-up, then delete it unless legal retention or specific claims require longer storage. Copies in Telegram and email follow those services' retention and deletion processes.

Downloading and sharing

Downloading saves a copy on your device. Web Share sends the image, text or link through your browser or operating system only to a destination you select. That recipient's rules apply to its copy. We do not publish a public image gallery. These actions fulfil your request under Article 6(1)(b) GDPR.

Recipients and international processing

Recipients include Google/Firebase, OpenAI, Telegram, email providers, requested shop hosts and recipients you choose. Frankfurt is our function location, not a guarantee that all processing stays in the EU. Providers may process data outside the EEA, including the US. The Google and OpenAI processing terms describe transfer safeguards, including standard contractual clauses where applicable; Telegram's policy describes its group transfers. Contact us for details or copies of applicable safeguards.

Your rights

Subject to GDPR conditions, you may request access, correction, deletion, restriction and portability. You may object to legitimate-interest processing for reasons relating to your situation. Where consent is the basis, you may withdraw it without affecting earlier lawful processing. Contact the address above. You may complain to a supervisory authority, including the Bavarian Data Protection Authority (BayLDA), or the authority where you live or work.