PRIVACY POLICY
of the Wizia AI platform
Last updated: 15.10.2026
This Privacy Policy is an integral part of the Terms of Service of Wizia AI. Capitalized terms not defined herein have the meanings given to them in the Terms of Service.
1. Data Controller
The Data Controller within the meaning of Art. 4(7) of Regulation (EU) 2016/679 (GDPR) is:
| Company name | Wizia AI OOD ("Визия АИ" ООД) |
| Legal form | Limited Liability Company (OOD) |
| UIC (Company ID) | 208797639 |
| Registered office | 68 Tsar Simeon St., Bansko 2770, Blagoevgrad, Bulgaria |
| hello@wizia.ai | |
| Website | https://wizia.ai |
When a Merchant uses the Wizia AI embed widget on their own website, the Controller and the Merchant act as joint controllers within the meaning of Art. 26 GDPR with respect to End Customer data collected through the widget.
2. Data Protection Officer (DPO)
The Controller has designated a contact person for data protection matters:
| hello@wizia.ai | |
| Address | 68 Tsar Simeon St., Bansko 2770, Blagoevgrad, Bulgaria |
If the appointment of a DPO is not mandatory for the Controller under Art. 37 GDPR, the above contact person handles all inquiries relating to personal data protection.
3. Categories of Personal Data We Collect
Depending on how you interact with the Platform, we may collect the following categories:
3.1. Registration and Profile Data
- Full name (or legal entity name)
- Email address
- Password (stored hashed via Supabase Auth)
- Language preferences (locale)
- Registration date and email verification
3.2. Payment and Billing Data
- Stripe customer identifier (stripe_customer_id)
- Subscription plan and Credit balance
- Transaction information (amounts, dates, status)
Wizia AI does not store card numbers. Payments are processed entirely by Stripe, Inc. in compliance with PCI DSS standards.
3.3. Photographs and Images
- Product photos: images of goods uploaded by Merchants for the AI photo studio
- Personal photos: face/body photos for Virtual Try-On
- AI-generated images: outputs from AI model processing
- Custom scenes and models: reference images for custom photo scenes
3.4. Analytics Data (collected via embed widget)
- Identifiers: visitor_id, session_id, fingerprint, shop_user_id
- Page context: URL, title, referrer
- UTM parameters: utm_source, utm_medium, utm_campaign
- Device: screen size, viewport, DPR, connection type
- Server-enriched: IP address, user agent, OS, browser, device type
- Geolocation: country, region, city (derived from IP)
- Behavioral data: event type, event data, timezone, language
- Bot marker
3.5. Usage Data
- Type and count of AI generations (photo studio, VTO, video)
- Credits used and AI model provider
- File storage metadata
- Date and time of actions
3.6. Rate Limiting Data
- Device fingerprint
- Merchant identifier
- Date and request count
3.7. Abuse Prevention Data
- Hashed IP address (HMAC) at registration
- User agent at registration
3.8. Wizia Pixel Data (cross-site tracking)
- Canvas fingerprint hash
- WebGL renderer/vendor
- AudioContext hash
- Persistent visitor_id (localStorage)
- Session_id (sessionStorage)
- Cross-site behavioral path
- Identity Stitching data
- Purchase funnel data
- Additional device data: hardware concurrency, touch points
3.9. Derived Data (generated by the Platform)
- Behavioral profiles and scores (purchase intent, style affinity, engagement)
- Features extracted from photos (body type, style preferences)
- Predictive models and market insights
- Cross-merchant behavioral models
4. Purposes and Legal Bases for Processing
We process your personal data on the following legal bases under Art. 6(1) GDPR:
| Purpose | Data categories | Legal basis |
|---|---|---|
| Account creation and management | 3.1 | Performance of contract (b) |
| AI Services (photo studio, VTO, video) | 3.3, 3.5 | Performance of contract (b) |
| Payment processing and invoicing | 3.2 | Contract (b) and Legal obligation (c) |
| Embed widget analytics | 3.4 | Legitimate interest (f) |
| Abuse prevention and security | 3.6, 3.7 | Legitimate interest (f) |
| Anonymized/aggregated data | All (anonymized) | GDPR does not apply (Recital 26) |
| Marketing communications | Email, name | Consent (a) |
| Legal obligations (accounting, tax) | 3.1, 3.2 | Legal obligation (c) |
| Product analytics (PostHog) | Behavioral data | Consent (a) — cookie banner |
| Cross-site tracking (Wizia Pixel) | 3.8 | Consent (a) — obtained by Merchant |
| Profiling and Predictive Analysis | 3.3, 3.5, 3.8 | Legitimate interest / Consent (Art. 22) |
4a. Business Contacts We Reach Out To (B2B Prospecting)
This section is for people at companies (for example, online shops) whom we contact to offer Wizia, by email or on LinkedIn, before they have signed up with us. It is our notice under Art. 14 GDPR, because we did not receive this data from you directly.
| Controller | Wizia AI OOD ("Визия АИ" ООД), UIC 208797639, 68 Tsar Simeon St., Bansko 2770, Bulgaria, hello@wizia.ai (see section 1) |
| Data we hold | Name, job title or role, work email, company phone, LinkedIn profile URL, and company data (name, website, address, company ID, line of business) |
| Where it comes from | The company's public website; public registers (the Commercial Register in Bulgaria; ONRC and ANAF in Romania); Common Crawl (a public web archive); AI Ark (a B2B data provider) |
| Purpose | Offering Wizia services to your company |
| Legal basis | Legitimate interest, Art. 6(1)(f) GDPR: reaching businesses for which Wizia may be useful. We use only business contact details and make it easy to say no. |
| How long we keep it | Up to 24 months from our last contact with you, or until you object, whichever comes first |
| Who sees it | Only Wizia and the service providers that process data on our instructions (Art. 28 GDPR). We do not sell this data and do not share it with anyone for their own marketing. |
| Automated decisions | None with legal or similarly significant effects on you |
4a.1. How to stop us contacting you
You can object at any time (Art. 21 GDPR): reply “stop” to any message from us, or write to hello@wizia.ai. We will stop contacting you and delete your data. We keep only your email address or profile URL on a do-not-contact list, so that we do not contact you again.
4a.2. Your other rights and complaints
You also have the rights of access, rectification, erasure and restriction (see section 9). You can complain to the supervisory authority: in Bulgaria, the Commission for Personal Data Protection (CPDP, see section 14.2); in Romania, the National Supervisory Authority for Personal Data Processing (ANSPDCP), 28-30 Gen. Gheorghe Magheru Blvd., Sector 1, Bucharest, www.dataprotection.ro.
4a.3. Romania
We do not send commercial emails to recipients in Romania without their prior consent.
5. Processing of Photographs
5.1. What photographs we collect
- Product photos — images of goods uploaded by Merchants (typically do not contain personal data)
- Personal photos for Virtual Try-On — face and/or body photos for visualization
5.2. How we process photographs
- Technical preprocessing: resize, format conversion (HEIC → JPEG), compression via Sharp
- AI processing: sent (base64) to Google Gemini and/or OpenAI — processors under Art. 28 GDPR
- Shopper photos: photos uploaded by End Customers for Virtual Try-On are processed only to generate the try-on and are not stored
- Storage: Merchant product photos and generated images are kept in secured cloud storage (Supabase Storage) with RLS, in the Merchant's account, until the Merchant deletes them or asks us to delete them
- Demo mode: photos are not stored — result returned as data URI
5.3. GDPR classification
Per Recital 51, processing of photographs is not automatically considered processing of biometric data under Art. 9. The Controller applies the precautionary principle and treats photos with facial features as potentially falling within Art. 9 scope.
5.4. Legal bases for photo processing
| Action | Legal basis | Consent required? |
|---|---|---|
| AI generation for VTO | Performance of contract (b) | No |
| Storing Merchant product photos and generated images | Performance of contract (b) | No |
5.5. Photo deletion
Shopper photos are not stored, so there is nothing to delete after the try-on. Merchants can delete product photos and generated images by deleting the product in their account, or request deletion at hello@wizia.ai. We handle deletion requests within 30 days.
6. Data Sharing with Third Parties
6.1. Processors (data processors under Art. 28 GDPR)
| Processor | Purpose | Data | Location |
|---|---|---|---|
| Supabase, Inc. | DB, auth, storage | 3.1–3.7 | EU / US |
| Vercel, Inc. | Hosting, CDN, Edge Functions | IP, user agent, geo | Global |
| Google LLC (Gemini) | AI generation | Photos (3.3), prompts | EU / US |
| OpenAI, Inc. | AI generation (alt.) | Photos (3.3), prompts | US |
| Stripe, Inc. | Payments, subscriptions | 3.2, email | EU / US |
| PostHog, Inc. | Product analytics | Behavioral data | EU |
6.2. Commercial partners (with explicit consent)
With consent per Art. 11 of the Terms, data may be shared with: fashion brands and retailers, analytics and marketing companies, AI and technology partners, advertising networks, market research companies, insurance and financial institutions.
6.3. Anonymized and aggregated data
Data that does not allow identification does not constitute personal data (Recital 26) and may be used without restriction.
6.4. Disclosure by law
Disclosure without consent when required by: law, court order, or protection of rights/safety.
6.5. Corporate transactions
In mergers/acquisitions, data may be transferred with prior notice to users.
7. International Data Transfers
- Some processors handle data in the US and outside the EEA.
- For every transfer outside the EEA, we ensure adequacy through: Adequacy decisions (EU-U.S. Data Privacy Framework), Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs), or other safeguards under Art. 46 GDPR.
- A copy of applicable safeguards — available upon request at hello@wizia.ai.
8. Retention Periods
| Data category | Retention period |
|---|---|
| Registration and profile (3.1) | Account duration + 30 days |
| Payment and billing (3.2) | 10 years (Accounting Act) |
| Shopper photos for Virtual Try-On (3.3) | Not stored — processed only to generate the try-on |
| Merchant product photos and generated images (3.3) | Until the Merchant deletes them or requests deletion at hello@wizia.ai (handled within 30 days) |
| Analytics data (3.4) | 24 months |
| Usage data (3.5) | 24 months |
| Rate limiting (3.6) | 90 days |
| Abuse prevention (3.7) | 12 months |
| Wizia Pixel data (3.8) | Indefinite — until user opt-out or account deletion |
After expiration, data is deleted or irreversibly anonymized.
9. Data Subject Rights
Under Chapter III of the GDPR:
| Right | Description | GDPR |
|---|---|---|
| Access | Confirmation and copy of your data | Art. 15 |
| Rectification | Correction of inaccurate data | Art. 16 |
| Erasure | "Right to be forgotten" | Art. 17 |
| Restriction | Temporary halt of processing | Art. 18 |
| Portability | Receive data in JSON or CSV format and transfer | Art. 20 |
| Objection | Against legitimate interest or direct marketing | Art. 21 |
| Withdraw consent | At any time, without affecting prior processing | Art. 7(3) |
| Complaint | To a supervisory authority | Art. 77 |
| Against automated decisions | Including profiling — see section 9a | Art. 22 |
Requests: hello@wizia.ai, account settings, or by mail (68 Tsar Simeon St., Bansko 2770, Bulgaria). Response — within 1 month (extendable by 2 months for complex requests).
9a. Profiling and Automated Decision-Making
9a.1. What profiling we perform
- Behavioral scoring: purchase probability, engagement, customer value
- Purchase prediction: when and what the user is likely to buy
- Style affinity: preferred styles, colors, brands, sizes
- Photo analysis: body type, proportions, demographics
- Cross-merchant profiling: behavioral profile across multiple Merchants
9a.2. Logic
Combination of computer vision AI models, machine learning models, and statistical models. Input data: 3.3, 3.4, 3.5, 3.8. Results → Derived Data (3.9).
9a.3. Consequences
- Content and recommendation personalization
- Price differentiation (by Merchants/third parties — outside Controller's control)
9a.4. Legal basis
| Type | Basis |
|---|---|
| Without significant effects (personalization) | Legitimate interest (Art. 6(1)(f)) |
| With significant effects (automated decisions) | Explicit consent (Art. 22(2)(c)) |
| Based on photos (special category) | Explicit consent (Art. 9(2)(a)) |
9a.5. Your rights
Right not to be subject to automated decisions; to request human intervention; to express your point of view; to contest the decision. Contact: hello@wizia.ai. Response: within 30 days.
9a.6. Safeguards against discrimination
AI models undergo periodic bias audits. Profiling may not lead to discrimination based on protected characteristics.
10. Cookies and Tracking Technologies
10.1. What we use
| Type | Technology | Purpose | Duration |
|---|---|---|---|
| Essential | Supabase Auth session | Authentication | Until logout |
| Essential | cookie-consent (localStorage) | Remember choice | Permanent |
| Analytics (optional) | PostHog | Product analytics | Per PostHog policy |
| Embed tracking | Wizia embed widget (JS) | Widget analytics | Session |
10.2. Management
Cookie banner on first visit. Essential cookies cannot be disabled. Also manageable through browser settings.
10.3. Embed widget cookies
The widget stores visitor_id, session_id, fingerprint in localStorage/sessionStorage. The Merchant is responsible for including this in their own policy.
10.4. Wizia Pixel
JavaScript-based technology: Canvas Fingerprinting, WebGL Fingerprinting, AudioContext Fingerprinting, additional parameters (hardware concurrency, touch points). Persistent identifiers (visitor_id, session_id). Identity Stitching on login. Server-side enrichment (IP, user agent, geolocation, bot marker).
10.5. Cross-site tracking
Wizia Pixel links behavior across multiple Merchant websites. Opt-out: cookie banner, clearing localStorage, Private/Incognito mode, or request to hello@wizia.ai.
11. Data Security
- Encryption in transit: HTTPS/TLS 1.2+
- Encryption at rest: Supabase encrypted databases
- Access control: private buckets with RLS policies
- Role separation: service role key ≠ client key
- Hashing: IP addresses (HMAC), passwords (bcrypt)
- Minimization: demo mode without storage
- Monitoring: detection of unauthorized access attempts
Breach notification: In the event of a personal data breach likely to result in a high risk to the rights of data subjects, the Controller shall notify affected individuals without undue delay in accordance with Art. 34 GDPR.
Limitation of liability: The Controller shall not be liable for damages arising from unauthorized third-party access, hacking, cyberattacks, or other security breaches caused by circumstances beyond the Controller's reasonable control, including acts of malicious third parties.
Users are responsible for maintaining the confidentiality of their access credentials and must notify the Controller immediately upon suspicion of a security breach.
12. Children
The Platform is intended for persons aged 18 and above. We do not knowingly collect data from children under 18. If discovered — immediate deletion. Contact: hello@wizia.ai.
13. Changes to this Privacy Policy
- The Controller may update this Policy periodically.
- For material changes — notification via email and/or in the Platform no later than 30 days before taking effect.
- Changes affecting consent-based processing — new consent requested.
- Continued use after changes take effect constitutes acceptance.
14. Contact and Complaints
14.1. Contact
| hello@wizia.ai | |
| Address | 68 Tsar Simeon St., Bansko 2770, Blagoevgrad, Bulgaria |
14.2. Complaint to a supervisory authority
| Authority | Commission for Personal Data Protection (CPDP) |
| Address | 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria |
| Phone | +359 2 915 3518 |
| kzld@cpdp.bg | |
| Website | https://www.cpdp.bg |
Residents of other EU/EEA states may file a complaint with their local supervisory authority.
14.3. Online dispute resolution
European Commission ODR platform: https://ec.europa.eu/consumers/odr