Virtual Try-On Privacy Notice

1. Who we are

The Try-On is provided by Olena Gertsuska, an individual entrepreneur (empresário em nome individual / independent worker) established in Portugal, with tax identification number (NIF) 318064839, trading as “Morphy.Vision” (“Morphy”, “we”, “us”, “our”). “Morphy.Vision” is a business name; the data controller is the named individual above.

You will normally encounter the Try-On embedded on the website of an eyewear retailer or brand (the “Retailer”) whose products you are browsing. The relationship between us and the Retailer is described in Section 12.

• Contact for privacy matters: privacy@morphy.vision
• Postal address: Available on request.
• Supervisory authority: Portugal — Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt
• Data Protection Officer: Not appointed. We are not required to appoint one, as our processing does not involve large-scale regular monitoring or large-scale special-category data under Article 37 GDPR.
• EU representative: Not applicable — we are established in the EU (Portugal).
• UK representative: Not applicable

2. Privacy at a glance

3. Scope of this policy

This policy covers the Morphy.Vision Try-On application (the Live Try-On and the 360° Viewer) wherever it is embedded or hosted.

It does not cover:

• The Retailer’s own website, checkout, account system, marketing, cookies or analytics. The Retailer is responsible for those and has its own privacy policy.
• The separate Morphy.Vision corporate / marketing website (morphy.vision/privacy-policy), or scheduling tools used for business enquiries between Morphy and Retailers. Those are governed by their own notices and providers.

4. What information is involved, and what happens to it

4.1 Camera video (Live Try-On only)

• What: the live image stream from your device’s front (“selfie”) camera.
• When: only after you explicitly grant camera permission by tapping “Enable Camera”. Your browser also asks for its own permission.
• How it is handled: each video frame is analysed locally, inside your browser, to detect where your face is, then drawn to the screen with the virtual glasses overlaid. Frames are held briefly in device memory to render smoothly and are then discarded.
• What we do not do: we do not record, save, upload, transmit, or share the video. No audio is ever captured (the microphone is not requested).
• When it stops: the camera stream ends when you close the try-on window, navigate away, or revoke permission in your browser.

4.2 Face geometry / landmark data (Live Try-On only)

• What: to position the glasses, the app uses an on-device machine-learning model (Google’s open-source MediaPipe FaceLandmarker, which we self-host) to estimate the location of facial points such as the eyes and nose bridge and the orientation of your head.
• How it is handled: this computation happens entirely on your device. The resulting coordinates exist only transiently in memory for the fraction of a second they are used to draw each frame, and are then overwritten by the next frame.
• What we do not do: we do not create a stored faceprint or biometric template; we do not attempt to identify or recognise who you are; we do not store, log, upload, transmit, sell, lease, trade, or otherwise profit from this data. It never reaches our servers or any third party.

Note on “biometric” data. Because these measurements are used solely to place a graphic on screen, are processed only on your device, are never retained, and are never used to identify a specific individual, we do not use them as biometric identifiers. Even so, because some laws define biometric terms broadly, we address them expressly in Section 11 (Illinois, Texas, Washington and similar) and treat this category with the highest level of care.

4.3 Technical and hosting data (both experiences)

To deliver the Try-On to your browser, the application files (code, 3D glasses models, fonts) are served from our hosting/CDN provider. As with visiting any website, your browser’s request necessarily includes:

• your IP address,
• your browser type, version and device/operating-system information (user agent),
• the date, time and files requested, and referring page.

Our hosting provider may process this in server logs for security, fraud prevention, load balancing and reliability. We do not use this data to build a profile of you, and we do not combine it with the camera/face processing (which never reaches any server).

4.4 The glasses catalogue

The app loads a small configuration file (models.json) listing available frames and their images. This is generic product data and contains no information about you.

4.5 What we deliberately do not collect

• No cookies or similar tracking technologies.
• No advertising, analytics, pixel, or fingerprinting trackers.
• No account, name, email, address, or payment data (any purchase happens on the Retailer’s site, outside the Try-On).
• No microphone/audio.
• No photographs saved to your device or ours (unless a future feature offers a “save/share your look” option, which would be optional and separately disclosed at that time).

5. Purposes and legal bases (EU/EEA & UK GDPR)

To the extent any face-position processing were ever treated as special-category (biometric) data under Article 9, our basis would be your explicit consent (Art. 9(2)(a)) — but as explained above, this data is never stored or used to identify you.

6. How we use information

We use the limited information described above only to:

1. render the virtual try-on you requested, on your device;
2. deliver, operate, secure and troubleshoot the Service; and
3. comply with legal obligations.

We do not use any information for advertising, profiling, automated decision-making with legal or similarly significant effects, or to train machine-learning models on your face.

7. Disclosure and sub-processors

We do not sell or rent personal information, and we share it only as follows:

• Hosting / content-delivery provider — our infrastructure provider (Vercel Inc., established in the United States) serves the application files and processes technical/server-log data (Section 4.3) on our behalf as a processor.
• The Retailer — the Retailer whose site embeds the Try-On is the operator of the page you are on. The Try-On does not send them your camera or face data. Any data they collect about your visit (e.g. their own analytics) is governed by their privacy policy.
• Legal / safety — we may disclose information if required by law, regulation, legal process, or to protect the rights, safety and security of users, the public, or Morphy.

The on-device machine-learning model is Google’s open-source MediaPipe, which we self-host; using the Try-On sends no request and no data to Google.

A current list of sub-processors is available on request at privacy@morphy.vision.

8. International data transfers

The camera and face-position processing happens on your own device and is not transferred anywhere. For the limited technical/hosting data (Section 4.3), our provider (Vercel Inc.) serves the application via a global edge/CDN network and is established in the United States, so data may be processed in the United States and other regions. Where such processing involves transfers out of the EEA, the UK or Switzerland, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, and/or the applicable Data Privacy Framework, as applicable. You may request details of these safeguards using the contact in Section 15.

9. Data retention

• Camera video and face-position data: not retained. They exist only transiently in your device’s memory during the session and are discarded frame-by-frame and when the session ends.
• Technical/hosting/server-log data: retained by our hosting provider (Vercel) for a limited period for security and reliability, in line with its own log-retention policy, then deleted or aggregated, unless a longer period is required by law.

10. Your privacy rights

Depending on where you live, you may have some or all of the rights below. Because we do not retain your camera or face data and hold no account for you, in most cases we will have no personal information about you to access, correct or delete beyond transient hosting logs.

EEA / UK / Switzerland (GDPR / UK GDPR): the rights to access, rectification, erasure, restriction, objection, data portability, and to withdraw consent at any time, plus the right to lodge a complaint with your supervisory authority (e.g. your national data protection authority, or the UK ICO).

California (CCPA/CPRA): the rights to know, access, delete, and correct personal information; to opt out of sale/sharing and of certain use of sensitive personal information; and to non-discrimination for exercising your rights. We do not sell or share personal information and do not use sensitive personal information for purposes requiring an opt-out. “Shine the Light” requests: we do not disclose personal information to third parties for their direct marketing.

Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and other US states with comprehensive privacy laws: the rights to access, correct, delete, obtain a portable copy, and to opt out of targeted advertising, sale, and certain profiling. We do not engage in those activities through the Try-On.

Canada (PIPEDA / Québec Law 25), Brazil (LGPD), Australia (Privacy Act), and other jurisdictions: equivalent rights of access, correction, deletion and withdrawal of consent, and the right to complain to your local regulator (e.g. the OPC, ANPD, or OAIC).

How to exercise your rights: contact us at privacy@morphy.vision. We will respond within the timeframe required by applicable law. We may need to verify your request; because we hold so little data, verification may be limited to the information contained in your request. You may use an authorised agent where the law permits.

11. Biometric-privacy notice (Illinois, Texas, Washington and similar)

This section addresses laws that regulate “biometric identifiers” or “biometric information,” including the Illinois Biometric Information Privacy Act (BIPA, 740 ILCS 14), the Texas Capture or Use of Biometric Identifier Act (CUBI), and Washington’s biometric law (RCW 19.375).

• The Live Try-On analyses the camera image on your device to estimate facial points for the sole purpose of positioning virtual glasses on screen in real time.
• We do not collect, capture, purchase, receive through trade, or otherwise obtain a biometric identifier or biometric information from you; we do not store, transmit, or possess any faceprint, scan of face geometry, or biometric template; and we do not use any such data to identify you.
• We do not sell, lease, trade, or otherwise profit from biometric data, and we impose no biometric enrolment as a condition of using the Service.
• Because no biometric data is retained, we have no biometric retention or destruction schedule to apply; any transient face-position data ceases to exist when the frame is rendered and when your session ends.

If, in the future, we introduce any feature that would collect or store biometric identifiers, we will first provide the specific written notice and obtain the written consent (release) required by applicable law, and publish the required retention-and-destruction schedule.

12. Our role, and the Retailer’s role (controller / processor)

• For the on-device camera and face-position processing, no personal data reaches Morphy or the Retailer; that processing occurs solely on your device under your control.
• For technical/hosting data (Section 4.3), Morphy acts as a data controller and our infrastructure provider acts as our processor.
• The Retailer is an independent controller for its own website, and for any data it chooses to collect about your visit. When Morphy provides the Try-On as a service to a Retailer, the specific roles and responsibilities are set out in the agreement (and, where applicable, the data processing addendum) between Morphy and that Retailer. For questions about the Retailer’s own data handling, please consult the Retailer’s privacy policy.

13. Children’s privacy

The Try-On is not directed to children and does not knowingly collect personal information from children. Because no camera or face data is retained, the Service does not create records about any user, including minors. If you believe a child has used the Service in a way that raises a concern, contact us at privacy@morphy.vision. Retailers are responsible for any age-related restrictions on their own sites.

14. Security

Because the sensitive processing happens on your device and nothing is uploaded, the primary protection for your camera and face data is architectural: there is no server-side copy to breach. For the limited technical data that does reach our hosting provider, we and our provider maintain appropriate technical and organisational measures, including encryption in transit (HTTPS/TLS), access controls, and secure, industry-standard infrastructure. The Service is served only over HTTPS, which browsers require for camera access.

15. Contact and complaints

For any privacy question or to exercise your rights:

• Email: privacy@morphy.vision
• Post: Olena Gertsuska — postal address available on request

We are established in Portugal, and our lead supervisory authority is the Portuguese Comissão Nacional de Proteção de Dados (CNPD) (www.cnpd.pt). If you are in the EEA/UK/Switzerland you may also lodge a complaint with your local supervisory authority; if you are in another jurisdiction, with your local data protection or consumer-protection regulator.

16. Changes to this policy

We may update this policy from time to time. When we do, we will revise the “Last updated” date above and, for material changes, provide a more prominent notice where appropriate. The version in force is the one published with the Service at the time you use it.