Privacy Policy

The data controller for our website and Merchant accounts is Obidowski Company Sp. z o.o., registered at Pasieczna 8/12/139, 91-362 Łódź, Poland (VAT: PL9471986146). Correspondence address: Szafranowa 17, 05-500 Zamienie, Poland.

For privacy questions or to exercise any of the rights described below, contact us at hello@viztunr.com.

One important distinction: when a Shopper uploads a photo or submits an inquiry on a Merchant's try-on page, we process that data on the Merchant's behalf as a processor, and the Merchant is the controller of the lead information they receive. For everything else — accounts, billing, analytics, the technical operation of the Services — we are the controller.

Information you provide directly:

• Merchant account data — name, email address, password (stored as a secure hash), and shop details such as shop name, website URL, and logo.
• Uploaded content — the photos, images, and product selections that Merchants and Shoppers submit to generate try-on renders, and the renders produced from them.
• Lead and inquiry data — when a Shopper requests a quote or booking through a try-on page, the contact details and message they choose to share with the Merchant.
• Payment information — processed by our payment provider Stripe. We never store full card numbers; we keep only billing metadata such as plan, invoices, and payment status.
• Communications — messages and attachments you send to our support.

Information collected automatically:

• Internet protocol (IP) address, browser type and version, device and operating system information, referring pages, and timestamps.
• Usage data such as pages viewed, features used, and render activity, used to operate, secure, and improve the Services.

• Providing the Services (contract performance) — creating and managing accounts, generating try-on renders from uploaded photos, delivering leads to Merchants, processing payments, and providing support.
• Security and abuse prevention (legitimate interest) — spam filtering, fraud detection, rate limiting, and protecting the Services and their users.
• Improving the Services (legitimate interest / consent for analytics cookies) — understanding aggregate usage so we can fix problems and prioritise features.
• Marketing communications (consent) — product news and announcements you opt in to. Every email includes an unsubscribe link and you can opt out at any time.
• Legal compliance (legal obligation) — tax, accounting, and responding to lawful requests from authorities.

Photos uploaded by Shoppers and Merchants are used solely to generate the requested try-on renders. To produce a render, images are transmitted to our AI infrastructure providers (currently fal.ai and Google) for processing.

We do not use your uploaded photos or generated renders to train or fine-tune our own or any third party's AI models. Our agreements with AI providers prohibit them from using your content for model training.

Uploaded photos and renders are not reused for our marketing without explicit opt-in consent.

We do not sell personal data. We share it only with service providers who help us run the Services, under data processing agreements:

• Supabase — application hosting, database, authentication, and file storage.
• Stripe — payment processing and billing.
• fal.ai — AI image rendering infrastructure.
• Google — AI image processing (Gemini), optional sign-in with Google, and website analytics (Google Analytics).
• MailerSend — transactional email delivery (e.g. account and render notifications).
• Ahrefs — cookieless, aggregate website analytics (Ahrefs Analytics).

We also share lead data with the Merchant whose try-on page the Shopper used — that is the purpose of submitting an inquiry. Merchants are responsible for how they handle leads afterwards. Finally, we may disclose data where required by law or to protect our legal rights.

Our Services are operated from the European Union, and some providers process data in the United States. Where personal data is transferred outside the EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

• Account data — kept for as long as your account is active.
• Uploaded photos and renders — deleted from our active systems within 30 days of account closure and purged from backups within 90 days.
• Lead data— retained while the Merchant's shop is active or until the Merchant deletes it; removed on the same schedule as uploaded content when a shop account closes.
• Payment and invoicing records — retained as required by tax and accounting law (up to 5 years).
• Analytics data — retained in pseudonymised or aggregated form for up to 24 months.

We use strictly necessary cookies to keep you signed in and to secure the Services. Non-essential cookies — including Google Analytics cookies — are only set after you provide consent, and you can withdraw that consent at any time via your browser settings or the "Cookie settings" link in the site footer. Without consent, analytics run in cookieless mode only: Google Analytics receives anonymous, cookieless pings (Consent Mode), and we use Ahrefs Analytics, a privacy-friendly tool that never uses cookies or tracks individuals.

We protect personal data with encryption in transit (TLS) and at rest, access controls and authentication on all systems, and the principle of least privilege for internal access. Payment data is handled entirely by Stripe, a PCI-DSS certified provider. No system is 100% secure; if we become aware of a breach affecting your personal data, we will notify you and the relevant authorities as required by law.

If you are in the EEA or the UK, you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data rectified;
• have your data erased ("right to be forgotten");
• restrict or object to processing based on legitimate interests;
• receive your data in a portable, machine-readable format;
• withdraw consent at any time, without affecting prior processing.

To exercise these rights, email hello@viztunr.com. We respond within one month. You may also lodge a complaint with your local supervisory authority; ours is the Polish President of the Personal Data Protection Office (UODO).

If you are a Shopper and your request concerns lead data held by a Merchant, we may refer you to that Merchant or coordinate with them, since they control that data.

If you are a California resident, you have the right to know what personal information we collect, to request its deletion or correction, and to opt out of its sale or sharing. We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We will not discriminate against you for exercising these rights. We respond to verified requests within 45 days (extendable by a further 45 days).

The Services are not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact us and we will delete it.

Try-on pages link back to Merchants' own websites, and our site may link to other external sites. Their privacy practices are their own; this policy does not cover them.

We may update this policy as the Services evolve. Material changes will be announced by email to account holders and by notice on this page at least 14 days before they take effect. The "Last updated" date above always reflects the current version.

Obidowski Company Sp. z o.o.
Pasieczna 8/12/139, 91-362 Łódź, Poland
Correspondence: Szafranowa 17, 05-500 Zamienie, Poland
Email: hello@viztunr.com