Biometrics
Biometrics
Biometrics
Last updated: July 28, 2026
Last updated: July 28, 2026
1. Why this notice exists
Vesto 3D is a virtual try-on tool. It lets you see how a garment would look on a body built from a photo you choose to upload, instead of on a stock model.
Vesto 3D is a virtual try-on tool. It lets you see how a garment would look on a body built from a photo you choose to upload, instead of on a stock model.
To do that, our system analyses the photo — including, if you upload a photo showing your face, the geometry of your face. Some privacy laws treat that analysis as the processing of biometric information, regardless of whether we ever use it to identify you. We don’t use it to identify anyone. But because the law applies based on what is processed rather than why, we are giving you this notice and asking for your separate, explicit permission before any of it happens.
To do that, our system analyses the photo — including, if you upload a photo showing your face, the geometry of your face. Some privacy laws treat that analysis as the processing of biometric information, regardless of whether we ever use it to identify you. We don’t use it to identify anyone. But because the law applies based on what is processed rather than why, we are giving you this notice and asking for your separate, explicit permission before any of it happens.
This notice sits alongside, and forms part of, the Vesto 3D Privacy Policy. Where the two conflict on biometric matters, this notice governs.
This notice sits alongside, and forms part of, the Vesto 3D Privacy Policy. Where the two conflict on biometric matters, this notice governs.
What we process, and what we don’t
What you may choose to give us:
What you may choose to give us:
A photograph you upload, which may include your face.
Optional body measurements or a height/weight input.
Garment and size selections you make inside the try-on.
A photograph you upload, which may include your face.
Optional body measurements or a height/weight input.
Garment and size selections you make inside the try-on.
What we derive from an uploaded photo:
What we derive from an uploaded photo:
A set of facial and body geometry measurements sufficient to construct a three-dimensional model.
The resulting 3D model used to render the try-on.
A set of facial and body geometry measurements sufficient to construct a three-dimensional model.
The resulting 3D model used to render the try-on.
What we never do:
What we never do:
We do not use your photo or the geometry derived from it to identify you, verify your identity, or match you against any other person, image, or database.
We do not run facial recognition, age estimation, emotion detection, demographic inference, or health inference.
We do not use your photo or derived data to train, fine-tune, or evaluate any machine learning model.
We do not sell, license, lease, trade, or otherwise profit from your biometric information, and we do not permit any third party to do so.
We do not use your photo or the geometry derived from it to identify you, verify your identity, or match you against any other person, image, or database.
We do not run facial recognition, age estimation, emotion detection, demographic inference, or health inference.
We do not use your photo or derived data to train, fine-tune, or evaluate any machine learning model.
We do not sell, license, lease, trade, or otherwise profit from your biometric information, and we do not permit any third party to do so.
3. The alternative: you never have to upload a photo
Vesto 3D offers a set of pre-built model bodies you can select instead of uploading anything. Choosing one of these involves no photo, no facial geometry, and no biometric processing of any kind, and it gives you a working try-on for every garment in the store.
Vesto 3D offers a set of pre-built model bodies you can select instead of uploading anything. Choosing one of these involves no photo, no facial geometry, and no biometric processing of any kind, and it gives you a working try-on for every garment in the store.
Photo upload is entirely optional. Declining it does not restrict your access to the store, the product pages, checkout, or any other part of the merchant’s site.
Photo upload is entirely optional. Declining it does not restrict your access to the store, the product pages, checkout, or any other part of the merchant’s site.
4. Consent
We will not process your photo or any biometric information derived from it unless you have first:
We will not process your photo or any biometric information derived from it unless you have first:
Been shown this notice, in writing, before collection;
Been told what is collected, why, and for how long it is kept; and
Given your explicit, affirmative consent by an unambiguous action — a deliberate tick or tap on a consent control that is not pre-selected and is separate from any other agreement.
Been shown this notice, in writing, before collection;
Been told what is collected, why, and for how long it is kept; and
Given your explicit, affirmative consent by an unambiguous action — a deliberate tick or tap on a consent control that is not pre-selected and is separate from any other agreement.
Continuing to browse the store, accepting cookies, or agreeing to general terms is not consent for the purposes of this notice.
Continuing to browse the store, accepting cookies, or agreeing to general terms is not consent for the purposes of this notice.
Withdrawing consent. You can withdraw consent at any time, in the try-on interface or by emailing hi@vesto3d.com. Withdrawal takes effect immediately, stops all further processing, and triggers deletion under Section 5. Withdrawal does not affect the lawfulness of processing carried out before you withdrew.
Withdrawing consent. You can withdraw consent at any time, in the try-on interface or by emailing hi@vesto3d.com. Withdrawal takes effect immediately, stops all further processing, and triggers deletion under Section 5. Withdrawal does not affect the lawfulness of processing carried out before you withdrew.
Legal basis (EEA/UK). Facial geometry is special category data under Article 9(1) GDPR. Our sole basis for processing it is your explicit consent under Article 9(2)(a). We do not rely on legitimate interests, contractual necessity, or any other basis for this category of data.
Legal basis (EEA/UK). Facial geometry is special category data under Article 9(1) GDPR. Our sole basis for processing it is your explicit consent under Article 9(2)(a). We do not rely on legitimate interests, contractual necessity, or any other basis for this category of data.
5. Retention and destruction
This is our written retention schedule and destruction guideline for the purposes of applicable biometric privacy legislation.
The uploaded photograph. Your photo is processed in memory to build the 3D model and is then destroyed. It is not written to persistent storage, not backed up, not logged, and not retained after the reconstruction completes — typically within seconds of upload, and in no case longer than the duration of the request. There is no copy for us to produce, disclose, or lose in a breach, because there is no copy.
Backstop. In all cases, all biometric information and biometric identifiers are permanently destroyed when the purpose for collecting them has been satisfied, or within three years of your last interaction with Vesto 3D, whichever occurs first.
Destruction is permanent and irreversible. We do not retain de-identified derivatives of facial geometry after destruction.
Disclosure
We do not disclose, redisclose, or otherwise disseminate your biometric information except where:
You have given separate consent to that specific disclosure;
It completes a transaction you requested and authorised;
It is required by a law, ordinance, or regulation that applies to us; or
It is required by a valid warrant or subpoena issued by a court of competent jurisdiction.
Merchants. The store you are shopping on does not receive your photo or your facial geometry. Merchants receive only aggregate, non-biometric analytics — for example, how many try-ons occurred, and which garments were tried.
Subprocessors. Processing might take place on third-party infrastructure. These providers act only on our documented instructions, are bound by contract to the same retention and destruction standards set out here, and have no right to use the data for their own purposes.
Subprocessors. Processing might take place on third-party infrastructure. These providers act only on our documented instructions, are bound by contract to the same retention and destruction standards set out here, and have no right to use the data for their own purposes.
7. Security
We protect biometric information using a reasonable standard of care that is at least as protective as the standard we apply to other confidential and sensitive information. Measures include encryption in transit and at rest, access controls limiting access to personnel with an operational need, isolation of the reconstruction environment, and a documented incident response procedure.
The single strongest control is architectural: we do not store your photograph, so the exposure surface for it is limited to the seconds during which it is being processed.
No system is perfectly secure. If you believe your data has been accessed without authorisation, contact hi@vesto3d.com.
Your rights
Depending on where you live, you may have the right to:
Confirm whether we process biometric information about you, and obtain a copy;
Have it corrected or deleted;
Withdraw consent, with no penalty or degraded service;
Receive it in a portable format;
Object to processing, or restrict it;
Be free from discrimination for exercising any of these rights; and
Lodge a complaint with a supervisory authority. In the EEA, this is the authority in your country of residence; in Romania, the ANSPDCP.
To exercise any right, email hi@vesto3d.com. We respond within [30] days, extendable where the law permits and we tell you why.
Note that because uploaded photographs are not retained, an access or portability request cannot return a photo you previously uploaded — it no longer exists.
9. Children
Vesto 3D is not intended for, and must not be used by, anyone under 18. We do not knowingly process biometric information from a minor. Photo upload is gated on an age confirmation, and where local law requires parental or guardian consent for the processing of a minor’s biometric data, we do not offer photo upload in that jurisdiction at all.
If you believe a minor has uploaded a photo, contact hi@vesto3d.com and we will confirm deletion of any derived data.
Automated decision-making
The try-on render and any size suggestion are generated automatically. They are visual and advisory. They produce no legal effect and no similarly significant effect on you: they do not determine pricing, availability, eligibility, or access to any product or service. You are free to disregard them.
11. Changes
If we change this notice in a way that materially affects what we collect, why, or how long we keep it, we will publish the updated version here and obtain fresh consent before the change applies to you. Prior versions are available on request.
1. Why this notice exists
Vesto 3D is a virtual try-on tool. It lets you see how a garment would look on a body built from a photo you choose to upload, instead of on a stock model.
To do that, our system analyses the photo — including, if you upload a photo showing your face, the geometry of your face. Some privacy laws treat that analysis as the processing of biometric information, regardless of whether we ever use it to identify you. We don’t use it to identify anyone. But because the law applies based on what is processed rather than why, we are giving you this notice and asking for your separate, explicit permission before any of it happens.
This notice sits alongside, and forms part of, the Vesto 3D Privacy Policy. Where the two conflict on biometric matters, this notice governs.
What we process, and what we don’t
What you may choose to give us:
A photograph you upload, which may include your face.
Optional body measurements or a height/weight input.
Garment and size selections you make inside the try-on.
What we derive from an uploaded photo:
A set of facial and body geometry measurements sufficient to construct a three-dimensional model.
The resulting 3D model used to render the try-on.
What we never do:
We do not use your photo or the geometry derived from it to identify you, verify your identity, or match you against any other person, image, or database.
We do not run facial recognition, age estimation, emotion detection, demographic inference, or health inference.
We do not use your photo or derived data to train, fine-tune, or evaluate any machine learning model.
We do not sell, license, lease, trade, or otherwise profit from your biometric information, and we do not permit any third party to do so.
3. The alternative: you never have to upload a photo
Vesto 3D offers a set of pre-built model bodies you can select instead of uploading anything. Choosing one of these involves no photo, no facial geometry, and no biometric processing of any kind, and it gives you a working try-on for every garment in the store.
Photo upload is entirely optional. Declining it does not restrict your access to the store, the product pages, checkout, or any other part of the merchant’s site.
4. Consent
We will not process your photo or any biometric information derived from it unless you have first:
Been shown this notice, in writing, before collection;
Been told what is collected, why, and for how long it is kept; and
Given your explicit, affirmative consent by an unambiguous action — a deliberate tick or tap on a consent control that is not pre-selected and is separate from any other agreement.
Continuing to browse the store, accepting cookies, or agreeing to general terms is not consent for the purposes of this notice.
Withdrawing consent. You can withdraw consent at any time, in the try-on interface or by emailing hi@vesto3d.com. Withdrawal takes effect immediately, stops all further processing, and triggers deletion under Section 5. Withdrawal does not affect the lawfulness of processing carried out before you withdrew.
Legal basis (EEA/UK). Facial geometry is special category data under Article 9(1) GDPR. Our sole basis for processing it is your explicit consent under Article 9(2)(a). We do not rely on legitimate interests, contractual necessity, or any other basis for this category of data.
5. Retention and destruction
This is our written retention schedule and destruction guideline for the purposes of applicable biometric privacy legislation.
The uploaded photograph. Your photo is processed in memory to build the 3D model and is then destroyed. It is not written to persistent storage, not backed up, not logged, and not retained after the reconstruction completes — typically within seconds of upload, and in no case longer than the duration of the request. There is no copy for us to produce, disclose, or lose in a breach, because there is no copy.
Backstop. In all cases, all biometric information and biometric identifiers are permanently destroyed when the purpose for collecting them has been satisfied, or within three years of your last interaction with Vesto 3D, whichever occurs first.
Destruction is permanent and irreversible. We do not retain de-identified derivatives of facial geometry after destruction.
Disclosure
We do not disclose, redisclose, or otherwise disseminate your biometric information except where:
You have given separate consent to that specific disclosure;
It completes a transaction you requested and authorised;
It is required by a law, ordinance, or regulation that applies to us; or
It is required by a valid warrant or subpoena issued by a court of competent jurisdiction.
Merchants. The store you are shopping on does not receive your photo or your facial geometry. Merchants receive only aggregate, non-biometric analytics — for example, how many try-ons occurred, and which garments were tried.
Subprocessors. Processing might take place on third-party infrastructure. These providers act only on our documented instructions, are bound by contract to the same retention and destruction standards set out here, and have no right to use the data for their own purposes.
Subprocessors. Processing might take place on third-party infrastructure. These providers act only on our documented instructions, are bound by contract to the same retention and destruction standards set out here, and have no right to use the data for their own purposes.
7. Security
We protect biometric information using a reasonable standard of care that is at least as protective as the standard we apply to other confidential and sensitive information. Measures include encryption in transit and at rest, access controls limiting access to personnel with an operational need, isolation of the reconstruction environment, and a documented incident response procedure.
The single strongest control is architectural: we do not store your photograph, so the exposure surface for it is limited to the seconds during which it is being processed.
No system is perfectly secure. If you believe your data has been accessed without authorisation, contact hi@vesto3d.com.
Your rights
Depending on where you live, you may have the right to:
Confirm whether we process biometric information about you, and obtain a copy;
Have it corrected or deleted;
Withdraw consent, with no penalty or degraded service;
Receive it in a portable format;
Object to processing, or restrict it;
Be free from discrimination for exercising any of these rights; and
Lodge a complaint with a supervisory authority. In the EEA, this is the authority in your country of residence; in Romania, the ANSPDCP.
To exercise any right, email hi@vesto3d.com. We respond within [30] days, extendable where the law permits and we tell you why.
Note that because uploaded photographs are not retained, an access or portability request cannot return a photo you previously uploaded — it no longer exists.
9. Children
Vesto 3D is not intended for, and must not be used by, anyone under 18. We do not knowingly process biometric information from a minor. Photo upload is gated on an age confirmation, and where local law requires parental or guardian consent for the processing of a minor’s biometric data, we do not offer photo upload in that jurisdiction at all.
If you believe a minor has uploaded a photo, contact hi@vesto3d.com and we will confirm deletion of any derived data.
Automated decision-making
The try-on render and any size suggestion are generated automatically. They are visual and advisory. They produce no legal effect and no similarly significant effect on you: they do not determine pricing, availability, eligibility, or access to any product or service. You are free to disregard them.
11. Changes
If we change this notice in a way that materially affects what we collect, why, or how long we keep it, we will publish the updated version here and obtain fresh consent before the change applies to you. Prior versions are available on request.