Privacy Policy

1. Scope

This Privacy Policy applies to Onlie, including the Onlie Chrome extension, the Onlie website at https://onlie.fit, payment flows, support communications, and related backend services. It does not apply to third-party shopping sites where you use the extension, or to payment, browser, AI, hosting, or database services that process data under their own terms and privacy notices.

Onlie is designed for adults. Do not use Onlie or upload any photo if you are under 18.

2. Information We Collect

Chrome extension permissions

The extension uses Chrome storage to save your reference photo, device token, selected settings, receipt email if you provide one, and page replacement metadata. It uses active tab and site permissions to run on supported shopping sites, identify product images, and let you choose which images to try on. If you grant access to another site, the extension may run there according to the permission you granted.

3. How We Use Information

We use the information described above to:

• provide AI virtual try-on previews that you request;
• store your reference photo so you do not need to select it for every try-on;
• fetch selected product images and prepare prompts for generation;
• return, cache, and restore generated try-on images for a limited time;
• track free try-ons, paid credits, balances, reservations, and purchases;
• process payments, receipts, chargebacks, refunds, tax, and accounting records;
• prevent abuse, fraud, scraping, excessive use, and unauthorized access;
• debug errors, maintain service reliability, and improve product quality; and
• respond to support, privacy, deletion, and legal requests.

Where consent is required, we rely on your consent, including when you upload a reference photo and request a try-on. We also process information to provide the service you requested, to meet legal obligations, and for legitimate business interests such as security, fraud prevention, support, and service improvement.

4. AI Processing, No Facial Recognition, and No Training by Onlie

Onlie sends your reference photo, the selected product image, and relevant prompt or page context to Google Gemini to generate the requested output. We use those inputs to produce a visual approximation of how an item might look on you.

We do not use your reference photo to identify you, verify your identity, create or store a faceprint, or perform facial recognition. We do not sell your reference photos or generated images. We do not use your reference photos, prompts, product images, or generated outputs to train Onlie models, and we do not contribute them to model-training datasets.

Generated outputs are AI-created approximations. They may be inaccurate and are not a guarantee of fit, sizing, color, texture, drape, availability, or how a product will look in real life.

5. Service Providers and Other Disclosures

We share information only as needed to operate Onlie, process payments, comply with law, protect users and the service, or complete a business transaction. Key providers include:

• Google Gemini: processes reference photos, selected product images, prompts, and generated outputs for AI generation and related safety or abuse processing.
• Stripe: processes payments, receipts, payment-method details, fraud checks, disputes, and payment metadata. Onlie receives payment status and related transaction information, not full card numbers.
• Supabase: stores credit accounts, purchase ledgers, reservations, restore records, hashed device-token records, and email addresses when provided.
• Render: hosts Onlie's backend and related storage for uploaded reference photos, generated image cache files, logs, and API traffic.
• Vercel: hosts the Onlie website and static policy pages.
• Chrome and Google services: distribute and run the extension through the Chrome browser and Chrome Web Store ecosystem.

We may also disclose information to professional advisors, law enforcement, regulators, courts, or other parties when we believe disclosure is required by law or necessary to protect rights, safety, security, or the integrity of Onlie. If Onlie is involved in a merger, financing, acquisition, reorganization, or sale of assets, information may be transferred as part of that transaction.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

6. Retention

• Local reference photo and extension data: kept in Chrome storage until you replace it, clear extension storage, uninstall the extension, or use browser controls that remove it.
• Backend reference photos: kept while associated with your device token so you can generate additional try-ons without re-uploading, unless you request deletion or we no longer need the photo to provide the service.
• Generated images: cached briefly, typically up to about 24 hours, to return results and support repeat requests.
• Credit, payment, and email records: kept while your credit balance is active and as needed for receipts, support, fraud prevention, chargebacks, tax, accounting, and legal compliance.
• Technical logs: kept only as long as reasonably needed for security, abuse prevention, debugging, analytics, and legal compliance.
• Support requests: kept as long as needed to respond, maintain business records, and resolve disputes.

We may retain de-identified or aggregated information that cannot reasonably be used to identify you.

7. Your Choices, Access, and Deletion Requests

You can control some information directly:

• choose not to upload a reference photo or not to request a generation;
• replace or remove your reference photo through extension or browser storage controls;
• clear Chrome extension storage or uninstall the extension;
• revoke optional site permissions in Chrome; and
• choose whether to provide an email address, except where needed for receipts or credit restore.

You may request access, correction, deletion, export, withdrawal of consent, or information about how we process your personal information by emailing support@onlie.fit. We may need enough information to verify and locate your records, such as the email used for purchases or a device-token-related identifier. If you have not provided an email address, we may have limited ability to connect backend records to you.

Deletion requests may not remove information we must keep for legal, security, accounting, fraud-prevention, dispute, or compliance reasons. If we deny or limit a request, we will explain why where required by law.

8. Children and Minors

Onlie is for adults who are at least 18 years old. Do not upload photos of minors, even if you are their parent or guardian. We do not knowingly collect personal information from children or minors. If you believe a minor's information has been provided to Onlie, contact us and we will take appropriate steps to delete it.

9. International Transfers

Onlie is operated from Canada, and our service providers may process and store information in Canada, the United States, Europe, and other countries where they or their subprocessors operate. Those countries may have privacy laws different from your location, and information may be subject to lawful access requests by courts, law enforcement, regulators, or national security authorities in those jurisdictions.

10. Security

We use administrative, technical, and organizational safeguards designed to protect personal information, including encrypted transport, restricted backend access, hashed device-token records in Supabase, rate limiting, and separation of payment-card handling through Stripe. No system is completely secure, and we cannot guarantee that information will never be accessed, disclosed, altered, or destroyed.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The effective date above shows when this version took effect. If we make material changes, we will provide notice as required by law, such as by updating the website, extension listing, or in-product notices.

12. Contact

You may also contact us to ask questions about our privacy practices or to challenge our compliance with this policy.