Last updated: 5 August 2026
This policy explains how JELLYBYTE LTD, a company registered in Cyprus (Reg. No. HE 495017), with its registered office at Spyrou Kyprianou & Agias Fylaxeos 182, Kofteros Business Centre, 2nd floor, Office 201, 3083 Limassol, Cyprus, (“we”, “us”) processes personal data when you use the virtual try-on service at try.anydress.ai. For this service we act as the data controller. Contact: privacy@anydress.ai.
1. The short version
- Your camera stream is processed in real time and is never stored by us or written to disk — it exists only for the seconds of your session.
- Your microphone audio never leaves your device (if enabled, it is mixed into your video locally in your browser).
- Your try-on video is created in your browser and stays on your device — unless you explicitly tap “Share”, in which case we host it for up to 24 hours.
- Garment reference images are stored for a maximum of 24 hours, and are screened by automated content moderation before use.
2. What we collect and why
Account data — email address, password (hashed), email-verification status, 18+ confirmation and its timestamp. Purpose: providing the Service, preventing free-trial abuse. Legal basis: contract performance (Art. 6(1)(b) GDPR); the 18+ record is kept under legal obligation/legitimate interest.
Live camera stream — video frames from your camera during a session. These are transmitted, with your action-based consent (starting the session), to our AI infrastructure provider for real-time transformation and returned to your browser. Frames are not stored. Legal basis: consent (Art. 6(1)(a)), given each time you press start; the camera activates only when you do.
Microphone audio — if audio is enabled, your mic is captured locally in your browser only, to be included in your downloadable video. It is not transmitted to us or to any third party.
Garment reference images — uploaded photos or images fetched from URLs you paste. Stored on our server for up to 24 hours, then automatically deleted. Before use, images are checked by automated moderation (see Section 4). Legal basis: contract performance; moderation under legitimate interest (safety, legal compliance).
Shared try-on videos — only if you tap “Share”: your video is uploaded to our server and made available at a random, unguessable link for up to 24 hours, after which it is automatically deleted. Anyone with the link can view it. Legal basis: consent, expressed by your explicit action.
Usage and security logs — session records (start/end time, session type, duration cap, credits used, IP address), credit ledger entries (including payment references), download/share events, and error reports (including browser type). Purpose: billing integrity, fraud and abuse prevention, dispute resolution, and support. Legal basis: legitimate interest and legal obligation. Retention: up to 24 months, or longer where required for tax/legal purposes.
Payment data — handled by Stripe as merchant of record. We never receive your card details. We receive confirmation of purchase and a transaction reference. See Stripe’s privacy policy at stripe.com/privacy.
Analytics data (only with your consent) — if you accept analytics cookies in our consent banner, Google Analytics collects pseudonymous usage data: pages visited, referral source, device and browser type, approximate location derived from IP, and interaction events. We use it in aggregate to improve the Service; we do not use it to identify you. Legal basis: consent (Art. 6(1)(a)), given via the cookie banner and withdrawable at any time through the cookie settings link on every page. If you decline, no analytics data is collected and the Service works identically. Consent choices themselves are recorded via our consent-management provider (CookieYes) as proof of compliance.
3. What we do NOT do
- We do not store or archive your camera stream.
- We do not use your images, camera stream, or videos to train AI models.
- We do not sell personal data or use it for third-party advertising.
- We do not perform facial recognition or biometric identification; the AI transformation is applied to video frames without creating a biometric template or identifying you.
4. Recipients and processors
We share data only with the processors needed to run the Service: a specialist real-time AI video infrastructure provider (transforms your camera stream transiently; no storage), an automated content-moderation provider (receives garment reference images only, for safety screening), an EU-based web hosting provider (website, database, and 24-hour image/video storage), a transactional email provider (verification and password-reset emails), Stripe (payments, as merchant of record), Google Analytics (pseudonymous usage statistics — only if you consent via the cookie banner), and CookieYes (records your cookie-consent choices). The specific identities of our providers are confidential for commercial reasons and are available on legitimate written request — for example, in connection with exercising your GDPR rights — under reasonable confidentiality. Where processors are outside the EEA, transfers rely on adequacy decisions, the EU–US Data Privacy Framework where applicable, or EU Standard Contractual Clauses. See also our Data Processing Disclosure page.
5. Retention summary
| Data | Retention |
|---|---|
| Camera stream | Not stored — real-time only |
| Microphone audio | Never leaves your device |
| Garment reference images | Max 24 hours |
| Shared try-on videos | Max 24 hours |
| Account data | Life of the account + legal retention |
| Session/credit/event logs | Up to 24 months (longer if legally required) |
| Analytics data (Google Analytics) | 14 months, then automatically deleted |
| Cookie-consent records | Up to 12 months |
6. Your rights
Under the GDPR you may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest; where processing is based on consent you may withdraw it at any time (without affecting prior processing). To exercise any right, or to delete your account, email privacy@anydress.ai. You may also lodge a complaint with your supervisory authority; ours is the Office of the Commissioner for Personal Data Protection, Cyprus (dataprotection.gov.cy).
7. Children
The Service is strictly for adults (18+). We do not knowingly process children’s data; reference images containing minors are automatically rejected. If you believe a minor has used the Service, contact us and we will delete the account and associated data.
8. Changes
We will post any changes on this page and update the date above; material changes will be highlighted in the Service.