Nala Try-On

Privacy Policy

Last updated: October 11, 2026

1. About this policy

This Privacy Policy explains how Nala Try-On ("Nala", "we", "our", or "the app") handles information when a Shopify merchant installs or uses the app. Nala provides virtual try-on and interactive 3D product experiences for Shopify stores.

2. Information we process

To operate the app, we may process Shopify shop information, authentication and session information, product and variant data, app configuration, subscription/plan state, and technical diagnostics.

Shopify application session records may contain the store domain, access token, Shopify staff user ID and, when Shopify provides them, the staff user's name, email address, locale, account-owner status, collaborator status, and email-verification status. These fields are used only to authenticate and operate the merchant-facing app.

We may also process product, variant, category, theme, metafield, file, and related catalog information that the merchant authorizes the app to access.

Nala does not intentionally collect shopper payment card details, Shopify customer order histories, or shopper passwords through the Shopify Admin API.

3. Camera and Virtual Try-On images

When a shopper starts Virtual Try-On, camera frames are processed locally in the shopper's browser to render the experience. If the shopper creates a Try-On photo, that image is also composed locally in the browser and can be saved or shared by the shopper.

Nala does not upload or store shopper camera frames or Try-On photos on Nala application servers, and does not use camera imagery to identify a person or create a persistent facial identity profile.

The browser loads rendering and face-tracking libraries from third-party delivery infrastructure, including jsDelivr, and a MediaPipe face-landmark model hosted by Google. Those providers may receive ordinary network metadata such as IP address, user agent, and request information when the files are downloaded. Camera frames themselves are processed in the browser and are not sent to those providers by Nala.

4. Shopify protected customer data

Nala Try-On does not request Shopify protected customer data through the Shopify Admin API and does not maintain a database of shoppers' names, email addresses, postal addresses, order histories, or payment information.

The app implements Shopify's mandatory privacy webhooks for customer data requests, customer redaction, and shop redaction. Because Nala does not store Shopify customer personal data, customer-data and customer-redaction requests normally do not require a separate Nala customer record to be returned or deleted.

5. How we use information

We use the information described above only to authenticate the merchant, operate Virtual Try-On and 3D features, manage app-related Shopify data at the merchant's request, enforce the selected plan, maintain security and reliability, troubleshoot errors, and respond to support or legal requests.

6. Storage and service providers

Core product assets and app-owned product configuration are stored in Shopify. Cloudflare hosts and runs the production application and may process standard request, security, and diagnostic metadata as part of that service.

Shopify application sessions and subscription/plan state are stored in the app's managed PostgreSQL database configured through its DATABASE_URL. We do not identify the database provider in this policy because it may change without changing the categories of data or the purpose for which they are processed.

GitHub is used for source-code version control and deployment automation; it is not the production database for merchant or shopper data.

7. Retention and deletion

Shopify authentication session records and plan-state records are kept only as needed to operate the installed app. When a shop uninstalls Nala Try-On, or when Shopify sends the applicable shop-redaction request, Nala deletes the stored session and plan-state records associated with that shop.

Support correspondence may be retained as long as reasonably necessary to resolve the request and maintain support history. Infrastructure and security logs are retained according to the retention configured with the relevant infrastructure provider and may be kept longer where necessary for security, fraud prevention, dispute resolution, or legal compliance.

8. Sharing of information

We do not sell personal information. Information may be shared with Shopify and infrastructure/service providers only as necessary to operate the app, or where disclosure is required by law.

9. Security

We use HTTPS, Shopify authentication, restricted API scopes, application secrets, access controls, and managed infrastructure to help protect information. No system can guarantee absolute security, but we take reasonable measures appropriate to the nature of the service.

10. Privacy requests

Shopify merchants and customers may exercise applicable privacy rights through Shopify or by contacting us. Nala supports Shopify's mandatory privacy-webhook workflows for access and deletion requests.

11. Children's privacy

Nala Try-On is a commerce visualization tool and is not designed to knowingly collect personal information from children. The app does not intentionally create or maintain shopper profiles from camera imagery.

12. Changes to this policy

We may update this policy as Nala evolves, our service providers change, or legal requirements change. The current version will remain available at this URL with its latest update date.

13. Contact

Privacy and support inquiries: hello@nalacommerce.com.