We Try On · Last updated 12 August 2026
We Try On is a Shopify app that lets a shopper see themselves wearing a product, live, on a store's product page. This policy explains what the app collects, who receives it, and what it is never used for.
The short version. Your camera video is streamed straight from your browser to the AI providers listed below, used to generate the try-on you are watching, and nothing else. It never reaches our servers. We do not record it, we do not store it, and we never use it to identify you. The store you are shopping with does not receive it.
The app is operated by XISLABS Pvt Ltd, a company registered in Pakistan. You can reach us, including about anything in this policy, at privacy@xislabs.com.
For a store's own data we act as a processor on that merchant's behalf. For shopper camera video we act as a controller together with the merchant. The companies in section 4 act as our processors under a data processing agreement.
From the store, through Shopify's APIs: product and variant details and image URLs, so we can build the garment being tried on; the store's domains, recorded once at install so a try-on can only be started from that store; and whether our button is present in the published theme, so the merchant can see if it is live. We request three permissions and no more: read products, manage the app proxy, and read themes.
From the merchant: a usage budget, a maximum try-on length, and an on/off switch. We do not ask merchants for contact details.
From shoppers, only after the on-screen camera notice is accepted:
We do not collect shopper names, email addresses, phone numbers, postal addresses, payment details or order history. Our database has no field that identifies a shopper. We set no cookies on the storefront and use no tracking technologies there.
These companies, and no others:
| Company | What they do with it | Where |
|---|---|---|
| Decart AI, Inc. | Generates the try-on image from your camera video, in real time. | United States |
| Google LLC (Google Cloud) | Cloud infrastructure, content moderation, and generating the result. | United States |
| Amazon Web Services, Inc. | Cloud infrastructure. | United States |
| Castle Global, Inc. (Hive) | Content moderation. | United States |
This same list is shown to every shopper, one click from the camera notice, before their camera is switched on — and a digest of it is stored with their consent record, so we can show exactly which recipients they were told about.
The store does not receive your video. Neither does any advertiser, analytics provider or data broker. We have no such integrations.
Your explicit, opt-in consent, given before your camera is accessed. The notice tells you what is collected, who receives it and that the result is generated by AI.
We ask every time rather than remembering your answer. A remembered consent would mean a camera switching on with nothing on screen explaining why, and a biometric release is properly given per use. Declining costs nothing and starts nothing — no session is created and no provider is contacted.
| Data | Kept for |
|---|---|
| Camera video — by us | Never stored. It does not reach our systems. |
| Camera video — by our providers | Used to generate your try-on, which lasts at most 15 seconds. They may process it only to provide that service, may not sell or share it, and are contractually required to delete it and certify that deletion. We are seeking a specific maximum period from them and will state it here once we have it in writing. |
| Consent records | Three years, so we can evidence what was agreed. |
| Session records (product, seconds used) | Three years. They contain no shopper identifier. |
| Merchant settings and store domains | While the app is installed, then deleted when the store is removed or requests erasure. |
Camera video goes only to the providers in section 4, all of which are in the United States. It is never stored on our own systems, and it never reaches Pakistan.
The records we do keep — merchant settings, and session data that contains no shopper identifier — are held on servers in the United States and administered by our team in Pakistan.
For shoppers in the European Economic Area, the United Kingdom or Switzerland, transfers to our processing providers are covered by Standard Contractual Clauses in our data processing agreement with them.
Depending on where you live, you may have the right to access, correct, delete, restrict or port your personal data, and to withdraw consent. To withdraw consent for a try-on, simply close the window — nothing continues after that.
We want to be straightforward about one limit. Because we deliberately store no identifier linking a try-on to a person, we usually cannot find an individual shopper's records — which is also why we cannot hand them to anyone else by mistake. Where the law requires us to identify you before acting, and we genuinely cannot, we will tell you so rather than collect more data about you in order to look. If you can give us enough detail to locate a specific session, write to us and we will act on it.
Merchants can raise requests through Shopify's standard privacy request flow. We respond to those within 30 days.
Everything is encrypted in transit. Camera video travels over an encrypted real-time connection directly between your browser and the provider. Our database is not reachable from the public internet. The credentials that could authorise generation never reach a browser: the page receives only a 60-second token limited to one model, one store and one maximum duration.
Our processing provider holds SOC 2 Type 2, ISO 27001 and ISO 42001 certification, and owes us notice of any breach within 48 hours.
The app is not intended for children, and we do not knowingly process a child's camera video. If you believe a child has used it, contact us and we will act.
If we change this policy we will update the date at the top. If a change affects what shoppers are told before their camera is used, the on-screen notice is updated at the same time and consent is asked again.