Legal
Privacy Policy — VCenter Live
Effective date: 7 October 2026
1. Who we are
VCenter Live ("VCenter Live", "the App", "we", "us") is a fashion styling and virtual try-on application for online stores, operated from Portugal. VCenter Live is the controller described in section 3.
Contact for anything in this policy, including exercising your rights: [email protected].
2. What this policy covers
This policy covers:
- the website vcenterlive.com;
- the VCenter Live app for Shopify, including its merchant back office (backoffice.vcenterlive.com, also shown inside Shopify Admin);
- the VCenter Live storefront (app.vcenterlive.com, also shown on a merchant's own store domain), where shoppers build outfits, try them on virtually and talk to a styling assistant;
- VCenter Live's connections to TikTok, Facebook and Instagram, used by merchants to publish their looks.
3. Our role
- For merchants (the stores that install VCenter Live) and for visitors of vcenterlive.com, we are the data controller.
- For shoppers using VCenter Live on a merchant's store, the merchant is the controller and we process their data on the merchant's behalf, as a processor. Shoppers may contact either the merchant or us; we will pass requests on to the merchant where required.
4. What data we process
4.1 Merchants
- Back-office account: name, email address, role, login history (time, browser).
- Store data received from Shopify: store domain and name, Shopify plan, contact email of the store, product catalogue (titles, descriptions, prices, images, variants, stock), and orders (order number, status, totals, items, and the customer's email and Shopify customer id) — used to attribute a sale to a look and to show sales reports.
- Content created in VCenter Live: looks, AI-generated images and videos, discount rules, share captions and store settings.
- Usage of paid features (number of AI generations and their cost), for plan limits and billing.
4.2 Shoppers (on a merchant's store)
- Account: email address and name, or the identifier of your customer account at that store when you sign in with it.
- Style profile, if you fill it in: profile names, segment (women, men, kids…), preferred styles, height, weight, clothing and shoe sizes, notes.
- Photos you upload for virtual try-on. Only when you choose to upload one.
- Looks, cart and wishlist you create in the storefront.
- Messages you send to the styling assistant.
- Stock alerts: your email, if you ask to be told when an item is back.
- Shares: when you share a look, the network you shared it to; if you record a contact to share with, the contact's name and handle.
- Technical data: a device identifier and a visitor identifier stored in your browser, IP address, browser type, pages visited, referring page and campaign parameters.
4.3 TikTok, Facebook and Instagram
When a merchant connects an account to VCenter Live we collect and store:
- TikTok (scopes
user.info.basic,video.publish): the account's open identifier, display name and avatar, the access and refresh tokens TikTok issues, and the identifiers and status of the videos VCenter Live publishes on the merchant's instruction. - Facebook and Instagram: the identifier and name of the Page or account, the access tokens issued, and the identifiers of the posts we publish. When the merchant enables automatic replies on Instagram, we also receive the comments and messages sent to those posts — author, identifier and text — and use them solely to send the reply the merchant configured.
We do not read or store anything else from these accounts. Access tokens are encrypted at rest and are never sent to a browser. This data is not used for advertising, sold, or shared with third parties other than the network it came from.
4.4 Website visitors
- The email address you enter in the demo request form.
- Anonymous visit statistics.
5. Why we use it, and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing VCenter Live to merchants: accounts, catalogue sync, look generation, publishing, reports | Performance of a contract — Art. 6(1)(b) |
| Providing the storefront to shoppers on the merchant's behalf | Determined by the merchant as controller; for our own processing, Art. 6(1)(b) |
| Virtual try-on with a photo you uploaded | Your consent, given by uploading it — Art. 6(1)(a). You can delete it at any time (section 10) |
| Sending account and service emails (verification, password reset, notices about your store) | Performance of a contract — Art. 6(1)(b) |
| Security, fraud prevention, login history, access logs | Legitimate interest — Art. 6(1)(f) |
| Campaign and share statistics for merchants | Legitimate interest — Art. 6(1)(f) |
| Demo requests and marketing emails from the website | Consent — Art. 6(1)(a) |
| Keeping records required by law, answering authorities | Legal obligation — Art. 6(1)(c) |
We do not sell personal data, and we do not use it for advertising. We do not use merchant or shopper data to train machine-learning models.
6. Artificial intelligence
VCenter Live uses AI services to classify products, generate looks, images and videos, suggest share captions, and answer shoppers in the styling assistant. To do so, it sends to those providers (section 7):
- product images and descriptions;
- photos a shopper uploaded for virtual try-on, only when the shopper asks for a try-on;
- messages sent to the styling assistant, with the context needed to answer (the store's products, the shopper's current outfit and profile).
None of this produces decisions with legal or similarly significant effects on anyone. AI-generated images may be inaccurate; they illustrate how products could look and are not a representation of fit.
7. Who we share it with
We use the following service providers. Each processes data only to provide its service to us.
| Provider | Purpose | Location | Safeguard for transfers |
|---|---|---|---|
| Amazon Web Services | Hosting, database, backups | EU (Paris) | Not a transfer |
| Jina AI (Elastic) | Product search (text embeddings) | EU (Germany) | Not a transfer |
| Shopify International Ltd | The merchant's store platform, sign-in, checkout | EU (Ireland) | Standard Contractual Clauses for onward transfers |
| TikTok Technology Ltd | Publishing at the merchant's request | EU (Ireland) | TikTok's own safeguards |
| Meta Platforms Ireland Ltd (Facebook, Instagram) | Publishing and automatic replies at the merchant's request | EU (Ireland) | Meta's own safeguards |
| Cloudflare | Network delivery and protection | Global network | EU-US Data Privacy Framework and Standard Contractual Clauses |
| FASHN | Virtual try-on | United Kingdom | Adequacy decision for the UK; Standard Contractual Clauses |
| OpenRouter | Access to AI language and vision models | United States | Standard Contractual Clauses |
| Groq | AI language models | United States | Data Privacy Framework or Standard Contractual Clauses |
| fal | Image and video generation | United States | Contractual clauses in its Data Processing Addendum |
| Lark | Transactional email | Singapore | Contractual clauses |
| Formspree | Website demo form | United States | Standard Contractual Clauses |
TikTok, Meta and Shopify also act as independent controllers of the data on their own platforms, under their own privacy policies.
Purchases are made in the merchant's Shopify checkout; payment data is handled by Shopify and the merchant, never by VCenter Live.
8. International transfers
Our main hosting is in the European Union. Where a provider in section 7 processes data outside the European Economic Area, the transfer relies on the safeguard shown for it there — an adequacy decision of the European Commission (including the EU-US Data Privacy Framework, for providers certified under it) or the Commission's Standard Contractual Clauses, under Chapter V of the GDPR. You can ask us for a copy of the safeguards that apply to a given provider.
9. How long we keep it
| Data | Kept for |
|---|---|
| Accounts (merchant and shopper) | While the account exists |
| Visit and campaign statistics | 6 months |
| Login history | 12 months |
| Contacts recorded for sharing | 12 months |
| Stock alerts | Until the alert is sent, or 6 months |
| Photos uploaded for virtual try-on | Until you ask us to delete them, or until the store's data is erased |
| Social network connection data | Until the merchant disconnects the network, uninstalls the app, or asks us to delete it |
| Copies of orders | Until the customer's data is erased at the merchant's request or by Shopify (then anonymised), or until the store's data is erased |
| A store that removes VCenter Live | Suspended immediately; all its data — catalogue, looks, orders, shopper accounts, social connections, back-office logins — is erased 30 days later. The store is notified when it leaves, reminded 7 days before, and told when it is done |
| Server access logs | 30 days |
| Backups | Up to 365 days, read only to recover from a disaster. If a backup is ever restored, completed deletions are applied again |
10. Your rights
You have the right to access, correct, erase, restrict and port your data, to object to processing based on legitimate interest, and to withdraw consent at any time without affecting what was done before.
- Merchants: disconnect a social network in the back office (Social Media → Disconnect) to delete its data immediately; remove the app from Shopify to have the store's data erased after 30 days; or write to us.
- Shoppers: write to the store, or to us at [email protected].
- Anyone: see vcenterlive.com/data_deletion.
We answer within 30 days. Deleted data leaves our active systems immediately and our backups as they expire (section 9).
You may also complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (www.cnpd.pt), or to the authority of your country of residence.
11. Security
Data is encrypted in transit; access tokens and provider secrets are encrypted at rest; access to the back office is role-based and limited to each store's own data; production access is restricted and logged.
12. Cookies and browser storage
VCenter Live does not use advertising or third-party tracking cookies. It uses:
vcl_session— a cookie that keeps a shopper signed in. Strictly necessary.- Browser storage for a device identifier (so a sign-in is shared across your tabs), a visitor identifier (to count visits and attribute a sale to a campaign), and your preferences (segment, outfit in progress).
13. Children
VCenter Live is not directed at children under 16. The storefront lets adults shop for children; please do not upload photos of anyone other than yourself.
14. Changes
We will publish changes on this page with a new effective date. If a change affects how merchants' data is used, we will tell merchants by email or in the back office before it takes effect.
15. Contact
VCenter Live, Portugal — [email protected]