LEGAL

Biometrics

Last updated: July 28, 2026

1. Why this notice exists

Vesto 3D is a virtual try-on tool. It lets you see how a garment would look on a body built from a photo you choose to upload, instead of on a stock model.

To do that, our system analyses the photo — including, if you upload a photo showing your face, the geometry of your face. Some privacy laws treat that analysis as the processing of biometric information, regardless of whether we ever use it to identify you. We don't use it to identify anyone. But because the law applies based on what is processed rather than why, we are giving you this notice and asking for your separate, explicit permission before any of it happens.

This notice sits alongside, and forms part of, the Vesto 3D Privacy Policy. Where the two conflict on biometric matters, this notice governs.

We respect your privacy and are committed to protecting it. This privacy policy (“Policy”) explains what information we may collect from you, or that you may provide to us, through the [www.vesto3d.com] website (“Website”) and any related products and services (together, the “Services”). It sets out how we collect, use, store, protect and disclose that information (“Personal Information”), the choices you have about our use of it, and how you can access and update it.

This Policy is a legally binding agreement between you (“User”, “you”, “your”) and Vesto 3D, a company registered in Romania (“Vesto 3D”, “we”, “us”, “our”). If you are entering into this agreement on behalf of a business or other legal entity, you confirm you have authority to bind that entity, and “you” refers to that entity. If you do not have that authority, or you do not agree with these terms, you must not accept this Policy and may not use the Website or Services.

By accessing and using the Website and Services, you confirm that you have read, understood and agree to be bound by this Policy. This Policy does not cover the practices of companies we do not own or control, or of individuals we do not employ or manage.

Vesto 3D provides 3D body scanning and virtual fitting products, services and technology. This Policy covers both our public marketing website and the Services we provide to our customers. Some sections apply only to the Website and others only to the Services, as indicated.

2. What we process, and what we don't

What you may choose to give us:

A photograph you upload, which may include your face.
Optional body measurements or a height/weight input.
Garment and size selections you make inside the try-on.

What we derive from an uploaded photo:

A set of facial and body geometry measurements sufficient to construct a three-dimensional model.
The resulting 3D model used to render the try-on.

What we never do:

We do not use your photo or the geometry derived from it to identify you, verify your identity, or match you against any other person, image, or database.
We do not run facial recognition, age estimation, emotion detection, demographic inference, or health inference.
We do not use your photo or derived data to train, fine-tune, or evaluate any machine learning model.
We do not sell, license, lease, trade, or otherwise profit from your biometric information, and we do not permit any third party to do so.

Vesto 3D works with businesses, researchers and other organisations (together, “Customers”) that may require us to collect and process personal information on their behalf — for example, where a Customer uses our Services in its own business, or embeds our technology into its website or mobile app.

In those cases we follow the privacy instructions given to us by the Customer, and you should consult that Customer’s own privacy policy to understand how it uses your information. In that arrangement the Customer is the “controller” of the personal information and Vesto 3D is the “processor”, unless we and the Customer have agreed otherwise. If you ask us to pass your personal information to a Customer, that Customer’s use of it is governed by their privacy policy and our use is governed by this one; in that situation both we and the Customer act as controllers.

Where we decide for ourselves why and how information is processed — for example, the information we need to give you access to the Website and Services — we act as controller and meet the controller obligations set out in the GDPR.

3. The alternative: you never have to upload a photo

Vesto 3D offers a set of pre-built model bodies you can select instead of uploading anything. Choosing one of these involves no photo, no facial geometry, and no biometric processing of any kind, and it gives you a working try-on for every garment in the store.

Photo upload is entirely optional. Declining it does not restrict your access to the store, the product pages, checkout, or any other part of the merchant's site.

When you open the Website, our servers automatically log information sent by your browser. This can include your device’s IP address, browser type and version, operating system type and version, language settings, the page you visited immediately before ours, the pages you view on the Website, how long you spend on them, what you search for, and access times and dates, along with similar statistics.

We use automatically collected information only to identify possible misuse and to build statistics about how the Website and Services are used. These statistics are not compiled in a way that identifies any individual User.

4. Consent

We will not process your photo or any biometric information derived from it unless you have first:

Been shown this notice, in writing, before collection;
Been told what is collected, why, and for how long it is kept; and
Given your explicit, affirmative consent by an unambiguous action — a deliberate tick or tap on a consent control that is not pre-selected and is separate from any other agreement.

Continuing to browse the store, accepting cookies, or agreeing to general terms is not consent for the purposes of this notice.

Withdrawing consent. You can withdraw consent at any time, in the try-on interface or by emailing hi@vesto3d.com. Withdrawal takes effect immediately, stops all further processing, and triggers deletion under Section 5. Withdrawal does not affect the lawfulness of processing carried out before you withdrew.

Legal basis (EEA/UK). Facial geometry is special category data under Article 9(1) GDPR. Our sole basis for processing it is your explicit consent under Article 9(2)(a). We do not rely on legitimate interests, contractual necessity, or any other basis for this category of data.

We will not process your photo or any biometric information derived from it unless you have first:

Been shown this notice, in writing, before collection;
Been told what is collected, why, and for how long it is kept; and
Given your explicit, affirmative consent by an unambiguous action — a deliberate tick or tap on a consent control that is not pre-selected and is separate from any other agreement.

Continuing to browse the store, accepting cookies, or agreeing to general terms is not consent for the purposes of this notice.

We will not process your photo or any biometric information derived from it unless you have first:

Been shown this notice, in writing, before collection;
Been told what is collected, why, and for how long it is kept; and
Given your explicit, affirmative consent by an unambiguous action — a deliberate tick or tap on a consent control that is not pre-selected and is separate from any other agreement.

Continuing to browse the store, accepting cookies, or agreeing to general terms is not consent for the purposes of this notice.

5. Retention and destruction

This is our written retention schedule and destruction guideline for the purposes of applicable biometric privacy legislation.

The uploaded photograph. Your photo is processed in memory to build the 3D model and is then destroyed. It is not written to persistent storage, not backed up, not logged, and not retained after the reconstruction completes — typically within seconds of upload, and in no case longer than the duration of the request. There is no copy for us to produce, disclose, or lose in a breach, because there is no copy.

Backstop. In all cases, all biometric information and biometric identifiers are permanently destroyed when the purpose for collecting them has been satisfied, or within three years of your last interaction with Vesto 3D, whichever occurs first.

Destruction is permanent and irreversible. We do not retain de-identified derivatives of facial geometry after destruction.

6. Disclosure

We do not disclose, redisclose, or otherwise disseminate your biometric information except where:

You have given separate consent to that specific disclosure;
It completes a transaction you requested and authorised;
It is required by a law, ordinance, or regulation that applies to us; or
It is required by a valid warrant or subpoena issued by a court of competent jurisdiction.

Merchants. The store you are shopping on does not receive your photo or your facial geometry. Merchants receive only aggregate, non-biometric analytics — for example, how many try-ons occurred, and which garments were tried.

Subprocessors. Processing might take place on third-party infrastructure. These providers act only on our documented instructions, are bound by contract to the same retention and destruction standards set out here, and have no right to use the data for their own purposes.

7. Security

We protect biometric information using a reasonable standard of care that is at least as protective as the standard we apply to other confidential and sensitive information. Measures include encryption in transit and at rest, access controls limiting access to personnel with an operational need, isolation of the reconstruction environment, and a documented incident response procedure.

The single strongest control is architectural: we do not store your photograph, so the exposure surface for it is limited to the seconds during which it is being processed.

No system is perfectly secure. If you believe your data has been accessed without authorisation, contact hi@vesto3d.com.

8. Your rights

Depending on where you live, you may have the right to:

Confirm whether we process biometric information about you, and obtain a copy;
Have it corrected or deleted;
Withdraw consent, with no penalty or degraded service;
Receive it in a portable format;
Object to processing, or restrict it;
Be free from discrimination for exercising any of these rights; and
Lodge a complaint with a supervisory authority. In the EEA, this is the authority in your country of residence; in Romania, the ANSPDCP.

To exercise any right, email hi@vesto3d.com. We respond within [30] days, extendable where the law permits and we tell you why.

Note that because uploaded photographs are not retained, an access or portability request cannot return a photo you previously uploaded — it no longer exists.

9. Children

Vesto 3D is not intended for, and must not be used by, anyone under 18. We do not knowingly process biometric information from a minor. Photo upload is gated on an age confirmation, and where local law requires parental or guardian consent for the processing of a minor's biometric data, we do not offer photo upload in that jurisdiction at all.

If you believe a minor has uploaded a photo, contact hi@vesto3d.com and we will confirm deletion of any derived data.

10. Automated decision-making

The try-on render and any size suggestion are generated automatically. They are visual and advisory. They produce no legal effect and no similarly significant effect on you: they do not determine pricing, availability, eligibility, or access to any product or service. You are free to disregard them.

11. Changes

If we change this notice in a way that materially affects what we collect, why, or how long we keep it, we will publish the updated version here and obtain fresh consent before the change applies to you. Prior versions are available on request.