WooCommerce · independent cloud integration
Privacy Notice
This notice explains how TryHair for WooCommerce processes merchant information and images used for virtual wig previews. It covers the WooCommerce connector, its cloud service, these WC documentation pages and related support. Our consumer hairstyle website and Shopify app have separate notices.
Effective date: November 1, 2026. Privacy contact: contact@tryhair.ai.
1. Who is responsible
TryHair.ai (“TryHair,” “we,” “us,” or “our”) operates the TryHair WooCommerce service. Questions, privacy requests and legal notices may be sent to contact@tryhair.ai.
Merchants control their storefronts, product content and the decision to offer the widget to shoppers. TryHair processes submitted images to provide the requested service on the merchant's behalf and handles service administration, security, usage records and support for its own operational purposes. The applicable legal roles depend on the processing and the parties' arrangements. Merchants needing a data-processing agreement should contact us to discuss the required terms before sending shopper data.
2. Information we process
- Connection information: store and WordPress addresses, installation identifiers, connection-verification material, credential versions and server-held credentials. Registration-domain and installation records help prevent repeated Free-allowance claims.
- Images: a shopper-selected portrait, the selected wig product image and the generated preview. Image validation can temporarily analyze facial features to determine whether an input is suitable; this service is not intended to identify people or build a face-recognition database.
- Request and usage records: store and request identifiers, image/request binding and result hashes, request status, timestamps, reservations, successful usage, Free-cycle information and the first valid browser display receipt. Hashes and identifiers may be linkable to a store or request and are not described as anonymous.
- Support and infrastructure information: information sent to support and technical/security logs. Hosting providers may process IP addresses, timestamps and request metadata. Application logs are designed to exclude image bodies, raw image data and service secrets.
- Future billing information: if paid WC service is enabled, contract/payment/refund references, plan/cycle dates, credit grants, consumption and adjustment audit records. WC purchases are currently disabled; we do not collect payment-card details through this connector.
The connector does not retrieve WooCommerce customer-account or order records for try-on. Store administrators and hosting providers may separately retain information under their own policies.
3. Purposes and legal grounds
We process necessary information to verify store control, authenticate requests, validate images, generate and deliver previews, maintain usage accuracy, prevent fraud and abuse, troubleshoot, respond to support and meet applicable obligations. Depending on the activity and applicable law, legal grounds may include performing a contract, legitimate interests in operating and securing the service, consent where required, and legal obligations. Merchant instructions and any applicable processing agreement govern processing performed on a merchant's behalf. A merchant must provide the notices and obtain the permissions required for its shoppers; merely installing the connector does not by itself establish every necessary consent.
4. Image handling and AI providers
The WC application processes images in request memory and does not intentionally save portraits, product images or results to Firestore or object storage. Result delivery uses a short-lived gateway memory cache: cached results are eligible for retrieval for five minutes. The cache is limited to eight entries and 32 MiB of cached image/receipt bytes per instance, and may evict results earlier. Background cleanup attempts to remove expired entries every 30 seconds; access also checks expiry. Actual memory release depends on runtime scheduling, including cloud CPU suspension, and is not a guarantee of precise physical erasure at five minutes. Instance shutdown removes its cache; transient copies can remain in process memory until released. Browser-held images and downloaded files remain under the shopper's and device's control.
Google Cloud Vertex AI processes selected images for validation and generation under the applicable Google Cloud terms. Google describes restrictions on training with customer data, but provider-side abuse monitoring, logging and other retention conditions can apply. We do not claim provider-wide zero retention or that all provider processing ends at the same time as our cache window. We do not use submitted photos or results to train our own models. See Google Cloud service terms and Google's data-governance documentation.
5. Recipients and international processing
Information is disclosed only as needed to service providers involved in hosting, storage, AI processing and support, to the merchant or shopper receiving the requested service, or where necessary for applicable law, protection of rights or security. We do not sell shopper photos or use them for behavioral advertising.
The WC gateway, image service and operational database are hosted in the United States. AI requests use configured global endpoints, so processing is not promised to remain solely in that hosting region. Information may also be accessed where the operator or its authorized support personnel work. Where transfer safeguards are required, the relevant contractual or other lawful arrangements must apply; this notice is not itself a substitute for a required transfer agreement. Contact us about arrangements needed for your deployment.
WooCommerce/Automattic will separately handle applicable Marketplace account and billing data if Woo Billing is enabled. No active Woo Billing integration is represented by this notice.
6. Retention and deletion
| Data | Retention criteria and current mechanism |
|---|---|
| Portraits, wig images and results | Transient processing and the memory-cache behavior described above; no application database/object-storage image archive. Provider and device copies follow their separate handling. |
| Store connection and Free eligibility | Retained to support the connection, credential revocation, continuity on reconnect and prevention of duplicate allowances. Disconnection does not erase the underlying eligibility identity. Deletion requests are reviewed against those purposes and applicable obligations. |
| Request, usage and display records | Ordinary request records, including their first display-receipt timestamp, become eligible for automatic Firestore TTL deletion 60 days after request creation. Later success, failure or display does not restart the period. Deletion is asynchronous, not an exact 60-day erasure deadline. Necessary cumulative balances, payment history and fraud-prevention identities are separate records and do not inherit this expiry. |
| Paid accounting and adjustments, when enabled | Retained for payment deduplication, credit history, refund reconciliation and applicable recordkeeping/dispute obligations. Archiving a source moves its audit record; it does not delete it. |
| Infrastructure logs and support | Retention depends on the relevant logging configuration, provider controls, support resolution and applicable obligations. We do not promise an unverified universal log-expiry period. |
We assess whether records remain necessary by reference to the active service relationship, unresolved support or billing matters, documented anti-abuse needs and applicable retention obligations. Records should not be retained merely because storage is available. There is no in-app button that deletes all cloud data. Email a request so we can verify authority, identify relevant records and explain any justified retention. An operator can preview and clear a verified store's ordinary request and connection-proof records through a controlled script; this revokes the connection, waits for live reservations, preserves necessary eligibility/accounting records and records a minimal cleanup audit. It is not represented as unconditional deletion of every record. Retained identity and financial records require separate review when relevant to your request. Deleting or deactivating the plugin does not automatically erase cloud records or reset usage.
7. Choices and privacy rights
Shoppers can decline to upload, stop using the widget, close the page and manage downloaded files or browser-held copies. Merchants can disable individual products or disconnect the service. Where applicable, individuals can request access, correction, erasure, restriction, portability or objection, and withdraw consent without affecting processing already lawfully performed. Rights are subject to applicable conditions and record-retention obligations. We respond within the timeframe required by applicable law and explain the outcome. You may also complain to the relevant data-protection authority.
Send requests to contact@tryhair.ai or through the merchant. Include the store address, approximate request time and the nature of the request. Do not send passwords, API keys, payment-card details or a portrait unless a secure, necessary process has first been agreed. Limited verification may be needed to protect others' information.
8. Security, children and automated processing
Controls include HTTPS, scoped short-lived tokens, server-held credentials, access restrictions and private service-to-service authentication. No system is completely secure. The service is not directed to children; merchants must not invite a child's upload without the authorization and safeguards required by applicable law. Upload only images you are authorized to use.
Automated input checks can reject unsuitable images, and AI produces illustrative previews. The service is not intended for identity verification, medical diagnosis or decisions about employment, credit, insurance or other similarly significant matters.
9. WC documentation pages and changes
These WC pages do not embed additional analytics or advertising scripts; hosting infrastructure can still record requests. Following a link to a separate TryHair product, WooCommerce or another provider takes you to that service's own practices. We update this notice when relevant processing changes and provide additional notice where required. The effective date identifies this version.