Privacy Policy
This privacy policy ("Policy") explains how Selvette, a brand of Orionwave Private Limited, a company registered under the Companies Act 2013, processes personal data collected from you.
1. Definitions
1.1 Controller: The natural or legal person, public authority, agency, or other body that determines the purposes and means of processing personal data.
1.2 End-User: Any person or entity with whom the subscriber interacts using the Selvette service ("Service") — including shoppers who use a try-on experience on a subscriber's storefront.
1.3 Personal Data: Any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
1.4 Usage Data: Data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (e.g., the duration of a page visit).
1.5 Process: Any operation or set of operations performed on personal data, whether or not by automated means, including collection, recording, organization, structuring, storage, adaptation, or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment, combination, restriction, erasure, or destruction.
1.6 Processor: A natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller.
1.7 Service(s): Refers to the services provided by Selvette, as defined in the Terms of Service — including the Selvette Studio, the storefront try-on widget, 360° video, and Live AR try-on.
1.8 Subscriber: The natural or legal person (typically a merchant) that has subscribed to the Service(s) by agreeing to the Terms of Service.
1.9 Terms of Service: The binding contract between Us and You that governs access and use of the Service(s). The Terms of Service are available here.
1.10 Website(s): The websites operated by Selvette.
1.11 You and Your: An identified or identifiable natural person whose personal data We process as a controller.
2. Personal Data Collected by Us
2.1 Direct collection. We collect personal data directly from you, including:
- When you subscribe to any of Our Service(s) by agreeing to the Terms of Service, We collect sign-up and account information, including your name, email address, and phone number.
- When you submit web forms on Our Website(s) or use interactive features of the Website(s), such as providing feedback, making requests, participating in surveys, contests, webinars, events, promotions, requesting customer support, or communicating with Us.
- When you provide testimonials, forms, or information to Us in other contexts.
- When you authorize Us to connect with a third-party service (for example, your Shopify store), We will access and store the personal data that the third-party service makes available to Us, which may include your email address, store details, or profile information.
2.2 Indirect collection. We may also receive your personal data indirectly, including:
- From third-party sources like marketing lists, databases, and social media, where we have ensured that these third parties either have your consent or are legally permitted or required to disclose your personal data to Us.
- When you use or view Our Website(s), information collected via your browser's cookies.
- When you access the Service through a mobile device: the type of device, its unique ID, IP address, operating system, browser type, and other diagnostic data.
- From other sources, such as our business or channel partners through whom you create or access your account, publicly available sources, or through the combination of information We obtain from third parties with the personal data you provide to Us.
2.3 Integration with third-party services. If you decide to register through or grant access to a third-party or integrated service (e.g., Shopify, Google), we may collect personal data already associated with that account. If you provide such information, we will treat it as personal data and use it as described in this Policy.
2.4 Social media features. Our Website(s) may include social media features and widgets hosted by third parties. Your interaction with these features is governed by the privacy statement of the companies providing them.
3. Purposes for Processing Personal Data
3.1 We process your personal data to:
- Facilitate your access to the Website(s) and Service(s).
- Process and complete payment transactions.
- Provide customer service and support.
- Send you communications regarding your use of the Service(s), updates to our Terms of Service, or other policies.
- Send you communications about new features in the Service(s), new service offerings, news, special offers, and general information about other goods, services, and events, in compliance with applicable laws (unless you opt not to receive such information).
- Conduct analytics and improve our Service(s).
- Organize events or other marketing and promotional activities.
- Investigate and prevent fraudulent transactions, unauthorized access to the Websites and Service(s), and other illegal activities.
- Personalize the Websites and Service(s).
- For other purposes for which we obtain your consent.
4. Sharing of Personal Data
4.1 You acknowledge that we may share your personal data with:
- Our group companies and third-party service providers to offer you our Service(s) and provide information or updates on the Service(s) if you are a Subscriber.
- Credit reference agencies to process your order as a Subscriber and prevent fraudulent purchases.
- Third-party service providers who host and maintain our Website(s), applications, backup, storage, payment processing, analytics, and other services. These providers may access or process your personal data to provide these services.
- Third-party providers assisting us in marketing and promotions in compliance with applicable laws.
- In connection with mergers, sales of company assets, financing, or acquisitions, we may share or transfer your personal data to another company.
- With your consent, we may share your personal data for other purposes.
- In response to lawful requests by public authorities, including national security or law enforcement requirements, subpoenas, court orders, or legal processes, or to establish or exercise our legal rights or defend against legal claims.
- To assist in the investigation and prevention of illegal activities, suspected fraud, potential threats to physical safety, violations of our Terms of Service, or as otherwise required by law.
5. International Transfer
5.1 We primarily process personal data in India. We will ensure that any recipient of your personal data offers an adequate level of protection, at least comparable to that provided under applicable data protection laws.
6. Shopper Photographs and AI-Generated Results
6.1 When a shopper uses a try-on experience on a Subscriber's storefront, the photograph they upload is used only to create that shopper's try-on result. It is not used to train AI models, and it is not shared with other shoppers or other Subscribers.
6.2 By default, an uploaded shopper photograph and its generated results auto-delete after 24 hours. A Subscriber may configure a retention window between 1 hour and 7 days for their storefront; expired media is removed by Selvette's retention process.
6.3 The shopper's browser may temporarily remember an asset identifier so a recent photo can be reused without re-uploading. The photograph itself is never stored in browser local storage.
6.4 AI-generated imagery is synthetic. Results are provided to visualize how a product might look and are not a factual representation of the shopper or the product.
7. Live AR Camera
7.1 Live AR try-on and the merchant camera tuner process the camera feed on the device. Camera frames are not uploaded to Selvette, and face-tracking data is not uploaded or stored.
7.2 The browser asks for camera permission before anything is rendered, and shoppers can deny or revoke camera permission at any time through their browser or device settings.
7.3 A Live AR session still opens a Selvette session record for entitlement and usage accounting, but that record does not contain the camera feed or any face data.
8. Leads and Email Capture
8.1 Where a Subscriber enables email capture in their storefront experience, the shopper's email is stored as a separate lead record with its own consent flag. Only leads with recorded consent can be exported by the Subscriber. Deleting or expiring a photograph does not change the consent status of a lead.
9. Merchant and Store Data
9.1 For Subscribers, we process account data (name, email, password credentials stored in hashed form), billing and subscription state, and configuration for connected storefronts.
9.2 Where a Subscriber connects a Shopify store, we process store data made available by Shopify's APIs (such as product catalog and order attribution events) to provide the Service. We honor Shopify's mandatory privacy webhooks — customers/data_request, customers/redact, and shop/redact — so shopper and store data is disclosed or erased when Shopify forwards such a request.
10. Sub-Processors
10.1 We use a small set of third-party processors to run the Service: cloud hosting and storage providers (e.g., Amazon Web Services), payment processors (e.g., Stripe, and Shopify billing for Shopify-billed subscriptions), transactional email delivery providers, and the AI image-generation provider that processes submitted images and prompts solely to produce the requested result. Each processes personal data only to provide its service to Us.
11. Your Rights
11.1 Subject to applicable law (including the GDPR and equivalent regimes), you may request access to, rectification of, or erasure of your personal data, object to or restrict its processing, and request portability. Shoppers can also simply let the retention window delete their photographs automatically.
11.2 To exercise any of these rights, contact us at hello@selvette.com. If you believe your rights have been infringed, you also have the right to lodge a complaint with a supervisory authority.
12. Children
12.1 The Service is not intended for children under 13 years of age, and we do not knowingly collect personal data from children under 13.
13. Changes to This Policy
13.1 We may update this Policy from time to time. Updates will be posted on this page with a revised "Last updated" date. Your continued use of the Service after such posting constitutes your acceptance of the updated Policy.
14. Contact
14.1 For any questions about this Policy or our data practices, reach out to hello@selvette.com.