Acest document este disponibil momentan doar în limba engleză. Versiunea în limba română va fi publicată în curând.
PRIVACY POLICY
of the Wizia AI platform
Last updated: 18.05.2026
This Privacy Policy is an integral part of the Terms of Service of Wizia AI. Capitalized terms not defined herein have the meanings given to them in the Terms of Service.
1. Data Controller
The Data Controller within the meaning of Art. 4(7) of Regulation (EU) 2016/679 (GDPR) is:
| Company name | Wizia AI OOD ("Визия АИ" ООД) |
| Legal form | Limited Liability Company (OOD) |
| UIC (Company ID) | 208797639 |
| Registered office | 68 Tsar Simeon St., Bansko 2770, Blagoevgrad, Bulgaria |
| hello@wizia.ai | |
| Website | https://wizia.ai |
When a Merchant uses the Wizia AI embed widget on their own website, the Controller and the Merchant act as joint controllerswithin the meaning of Art. 26 GDPR with respect to End Customer data collected through the widget.
2. Data Protection Officer (DPO)
The Controller has designated a contact person for data protection matters:
| hello@wizia.ai | |
| Address | 68 Tsar Simeon St., Bansko 2770, Blagoevgrad, Bulgaria |
If the appointment of a DPO is not mandatory for the Controller under Art. 37 GDPR, the above contact person handles all inquiries relating to personal data protection.
3. Categories of Personal Data We Collect
Depending on how you interact with the Platform, we may collect the following categories:
3.1. Registration and Profile Data
- Full name (or legal entity name)
- Email address
- Password (stored hashed via Supabase Auth)
- Language preferences (locale)
- Registration date and email verification
3.2. Payment and Billing Data
- Stripe customer identifier (stripe_customer_id)
- Subscription plan and Credit balance
- Transaction information (amounts, dates, status)
Wizia AI does not store card numbers. Payments are processed entirely by Stripe, Inc. in compliance with PCI DSS standards.
3.3. Photographs and Images
- Product photos: images of goods uploaded by Merchants for the AI photo studio
- Personal photos: face/body photos for Virtual Try-On
- AI-generated images: outputs from AI model processing
- Custom scenes and models: reference images for custom photo scenes
3.4. Analytics Data (collected via embed widget)
- Identifiers: visitor_id, session_id, fingerprint, shop_user_id
- Page context: URL, title, referrer
- UTM parameters: utm_source, utm_medium, utm_campaign
- Device: screen size, viewport, DPR, connection type
- Server-enriched: IP address, user agent, OS, browser, device type
- Geolocation: country, region, city (derived from IP)
- Behavioral data: event type, event data, timezone, language
- Bot marker
3.5. Usage Data
- Type and count of AI generations (photo studio, VTO, video)
- Credits used and AI model provider
- File storage metadata
- Date and time of actions
3.6. Rate Limiting Data
- Device fingerprint
- Merchant identifier
- Date and request count
3.7. Abuse Prevention Data
- Hashed IP address (HMAC) at registration
- User agent at registration
3.8. Wizia Pixel Data (cross-site tracking)
- Canvas fingerprint hash
- WebGL renderer/vendor
- AudioContext hash
- Persistent visitor_id (localStorage)
- Session_id (sessionStorage)
- Cross-site behavioral path
- Identity Stitching data
- Purchase funnel data
- Additional device data: hardware concurrency, touch points
3.9. Derived Data (generated by the Platform)
- Behavioral profiles and scores (purchase intent, style affinity, engagement)
- Features extracted from photos (body type, style preferences)
- Predictive models and market insights
- Cross-merchant behavioral models
4. Purposes and Legal Bases for Processing
We process your personal data on the following legal bases under Art. 6(1) GDPR:
| Purpose | Data categories | Legal basis |
|---|---|---|
| Account creation and management | 3.1 | Performance of contract (b) |
| AI Services (photo studio, VTO, video) | 3.3, 3.5 | Performance of contract (b) |
| Payment processing and invoicing | 3.2 | Contract (b) and Legal obligation (c) |
| Embed widget analytics | 3.4 | Legitimate interest (f) |
| Abuse prevention and security | 3.6, 3.7 | Legitimate interest (f) |
| AI model training | 3.3, 3.5 | Consent (a) — separate, explicit |
| Sharing with third parties for commercial purposes | 3.3, 3.4 | Consent (a) — granular |
| Anonymized/aggregated data | All (anonymized) | GDPR does not apply (Recital 26) |
| Marketing communications | Email, name | Consent (a) |
| Legal obligations (accounting, tax) | 3.1, 3.2 | Legal obligation (c) |
| Product analytics (PostHog) | Behavioral data | Consent (a) — cookie banner |
| Cross-site tracking (Wizia Pixel) | 3.8 | Consent (a) — obtained by Merchant |
| Profiling and Predictive Analysis | 3.3, 3.5, 3.8 | Legitimate interest / Consent (Art. 22) |
| Sale of Derived Data | 3.9 | Legitimate interest (anonymized) / Consent (identifiable) |
5. Processing of Photographs
5.1. What photographs we collect
- Product photos — images of goods uploaded by Merchants (typically do not contain personal data)
- Personal photos for Virtual Try-On — face and/or body photos for visualization
5.2. How we process photographs
- Technical preprocessing: resize, format conversion (HEIC → JPEG), compression via Sharp
- AI processing: sent (base64) to Google Gemini and/or OpenAI — processors under Art. 28 GDPR
- Storage: generated images in secured cloud storage (Supabase Storage) with RLS
- Demo mode: photos are not stored — result returned as data URI
5.2a. Predictive analysis of photographs
Photos may be processed to extract: body type and proportions, approximate demographics, style and color preferences, product compatibility predictions.
These features may be:
- used internally for improvement and personalization
- sold to third parties in anonymized form without additional consent
- sold in identifiable form only with explicit consent
5.3. GDPR classification
Per Recital 51, processing of photographs is not automatically considered processing of biometric data under Art. 9. The Controller applies the precautionary principle and treats photos with facial features as potentially falling within Art. 9 scope.
5.4. Legal bases for photo processing
| Action | Legal basis | Consent required? |
|---|---|---|
| AI generation for VTO | Performance of contract (b) | No |
| Storage up to 90 days | Contract / Legitimate interest | No |
| Long-term storage (over 90 days) | Consent (a) | Yes |
| AI model training | Consent (a / Art. 9) | Yes |
| Sharing with third parties | Consent (a / Art. 9) | Yes |
| Marketing materials | Consent (a) | Yes |
5.5. Photo deletion
You may request deletion via account settings or hello@wizia.ai. Deletion from active systems — within 30 days. Backup archives — within 90 days.
6. Data Sharing with Third Parties
6.1. Processors (data processors under Art. 28 GDPR)
| Processor | Purpose | Data | Location |
|---|---|---|---|
| Supabase, Inc. | DB, auth, storage | 3.1–3.7 | EU / US |
| Vercel, Inc. | Hosting, CDN, Edge Functions | IP, user agent, geo | Global |
| Google LLC (Gemini) | AI generation | Photos (3.3), prompts | EU / US |
| OpenAI, Inc. | AI generation (alt.) | Photos (3.3), prompts | US |
| Stripe, Inc. | Payments, subscriptions | 3.2, email | EU / US |
| PostHog, Inc. | Product analytics | Behavioral data | EU |
6.2. Commercial partners (with explicit consent)
With consent per Art. 11 of the Terms, data may be shared with: fashion brands and retailers, analytics and marketing companies, AI and technology partners, advertising networks, market research companies, insurance and financial institutions.
6.2a. Derived Data and predictive models
- Anonymized: may be sold without consent (Recital 26)
- Identifiable profiles: only with explicit consent
- Buyers: must sign a Data Use Agreement prohibiting re-identification
6.3. Anonymized and aggregated data
Data that does not allow identification does not constitute personal data (Recital 26) and may be used without restriction.
6.4. Disclosure by law
Disclosure without consent when required by: law, court order, or protection of rights/safety.
6.5. Corporate transactions
In mergers/acquisitions, data may be transferred with prior notice to users.
7. International Data Transfers
- Some processors handle data in the US and outside the EEA.
- For every transfer outside the EEA, we ensure adequacy through: Adequacy decisions (EU-U.S. Data Privacy Framework), Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs), or other safeguards under Art. 46 GDPR.
- A copy of applicable safeguards — available upon request at hello@wizia.ai.
8. Retention Periods
| Data category | Retention period |
|---|---|
| Registration and profile (3.1) | Account duration + 30 days |
| Payment and billing (3.2) | 10 years (Accounting Act) |
| Photos — standard (3.3) | Up to 90 days after last use |
| Photos — with consent | Until withdrawal or up to 3 years |
| Analytics data (3.4) | 24 months |
| Usage data (3.5) | 24 months |
| Rate limiting (3.6) | 90 days |
| Abuse prevention (3.7) | 12 months |
| Wizia Pixel data (3.8) | Indefinite — until user opt-out or account deletion |
| Marketing consent | Account duration + 3 years |
After expiration, data is deleted or irreversibly anonymized.
9. Data Subject Rights
Under Chapter III of the GDPR:
| Right | Description | GDPR |
|---|---|---|
| Access | Confirmation and copy of your data | Art. 15 |
| Rectification | Correction of inaccurate data | Art. 16 |
| Erasure | "Right to be forgotten" | Art. 17 |
| Restriction | Temporary halt of processing | Art. 18 |
| Portability | Receive data in JSON or CSV format and transfer | Art. 20 |
| Objection | Against legitimate interest or direct marketing | Art. 21 |
| Withdraw consent | At any time, without affecting prior processing | Art. 7(3) |
| Complaint | To a supervisory authority | Art. 77 |
| Against automated decisions | Including profiling — see section 9a | Art. 22 |
Requests: hello@wizia.ai, account settings, or by mail (68 Tsar Simeon St., Bansko 2770, Bulgaria). Response — within 1 month (extendable by 2 months for complex requests).
9a. Profiling and Automated Decision-Making
9a.1. What profiling we perform
- Behavioral scoring: purchase probability, engagement, customer value
- Purchase prediction: when and what the user is likely to buy
- Style affinity: preferred styles, colors, brands, sizes
- Photo analysis: body type, proportions, demographics
- Cross-merchant profiling: behavioral profile across multiple Merchants
9a.2. Logic
Combination of computer vision AI models, machine learning models, and statistical models. Input data: 3.3, 3.4, 3.5, 3.8. Results → Derived Data (3.9).
9a.3. Consequences
- Content and recommendation personalization
- Price differentiation (by Merchants/third parties — outside Controller's control)
- Third-party decisions based on sold Derived Data
9a.4. Legal basis
| Type | Basis |
|---|---|
| Without significant effects (personalization) | Legitimate interest (Art. 6(1)(f)) |
| With significant effects (automated decisions) | Explicit consent (Art. 22(2)(c)) |
| Based on photos (special category) | Explicit consent (Art. 9(2)(a)) |
9a.5. Your rights
Right not to be subject to automated decisions; to request human intervention; to express your point of view; to contest the decision. Contact: hello@wizia.ai. Response: within 30 days.
9a.6. Safeguards against discrimination
AI models undergo periodic bias audits. Profiling may not lead to discrimination based on protected characteristics.
10. Cookies and Tracking Technologies
10.1. What we use
| Type | Technology | Purpose | Duration |
|---|---|---|---|
| Essential | Supabase Auth session | Authentication | Until logout |
| Essential | cookie-consent (localStorage) | Remember choice | Permanent |
| Analytics (optional) | PostHog | Product analytics | Per PostHog policy |
| Embed tracking | Wizia embed widget (JS) | Widget analytics | Session |
10.2. Management
Cookie banner on first visit. Essential cookies cannot be disabled. Also manageable through browser settings.
10.3. Embed widget cookies
The widget stores visitor_id, session_id, fingerprint in localStorage/sessionStorage. The Merchant is responsible for including this in their own policy.
10.4. Wizia Pixel
JavaScript-based technology: Canvas Fingerprinting, WebGL Fingerprinting, AudioContext Fingerprinting, additional parameters (hardware concurrency, touch points). Persistent identifiers (visitor_id, session_id). Identity Stitching on login. Server-side enrichment (IP, user agent, geolocation, bot marker).
10.5. Cross-site tracking
Wizia Pixel links behavior across multiple Merchant websites. Opt-out: cookie banner, clearing localStorage, Private/Incognito mode, or request to hello@wizia.ai.
11. Data Security
- Encryption in transit: HTTPS/TLS 1.2+
- Encryption at rest: Supabase encrypted databases
- Access control: private buckets with RLS policies
- Role separation: service role key ≠ client key
- Hashing: IP addresses (HMAC), passwords (bcrypt)
- Minimization: demo mode without storage
- Monitoring: detection of unauthorized access attempts
Breach notification:In the event of a personal data breach likely to result in a high risk to the rights of data subjects, the Controller shall notify affected individuals without undue delay in accordance with Art. 34 GDPR.
Limitation of liability:The Controller shall not be liable for damages arising from unauthorized third-party access, hacking, cyberattacks, or other security breaches caused by circumstances beyond the Controller's reasonable control, including acts of malicious third parties.
Users are responsible for maintaining the confidentiality of their access credentials and must notify the Controller immediately upon suspicion of a security breach.
12. Children
The Platform is intended for persons aged 18 and above. We do not knowingly collect data from children under 18. If discovered — immediate deletion. Contact: hello@wizia.ai.
13. Changes to this Privacy Policy
- The Controller may update this Policy periodically.
- For material changes — notification via email and/or in the Platform no later than 30 days before taking effect.
- Changes affecting consent-based processing — new consent requested.
- Continued use after changes take effect constitutes acceptance.
14. Contact and Complaints
14.1. Contact
| hello@wizia.ai | |
| Address | 68 Tsar Simeon St., Bansko 2770, Blagoevgrad, Bulgaria |
14.2. Complaint to a supervisory authority
| Authority | Commission for Personal Data Protection (CPDP) |
| Address | 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria |
| Phone | +359 2 915 3518 |
| kzld@cpdp.bg | |
| Website | https://www.cpdp.bg |
Residents of other EU/EEA states may file a complaint with their local supervisory authority.
14.3. Online dispute resolution
European Commission ODR platform: https://ec.europa.eu/consumers/odr