Privacy Policy (Wix App Market Edition)

Effective Date: November 1, 2026 · Last Updated: November 9, 2026

YSAC (Yoon Sung & Company / Archetype Look) ('we', 'us', or 'Archetype Look') provides the Archetype Look AI Virtual Try-On application for Wix Stores merchants and their shoppers. This Privacy Policy explains what information we process, how customer-uploaded photos are handled strictly in volatile memory (RAM) and immediately destroyed, our cross-site cookie and session security practices, and how to exercise your privacy rights.

1. Scope of Data Collected & Processed

• Wix Merchant Store Metadata: When a merchant installs Archetype Look on a Wix site, we receive and store the cryptographically verified Wix instanceId, subscription plan tier (basic, starter, growth, or scale), billing cycle status, widget visibility state (ON/OFF), and aggregate non-personal conversion counters.
• Shopper-Uploaded Try-On Photos (Ephemeral RAM Only): When a shopper voluntarily uploads a photo in the storefront Virtual Try-On modal, the image is transmitted over TLS (HTTPS) solely to perform a real-time garment try-on synthesis with the selected Wix Stores product image.
• No Collection of Sensitive Shopper PII: We do not collect shopper names, payment card numbers, street addresses, or account passwords from storefront visitors.

2. Zero Persistent Photo Storage & Volatile Memory (RAM) Destruction Policy

Zero Disk Storage Guarantee: Customer photos uploaded for AI Virtual Try-On are processed strictly in volatile server memory (RAM) and are permanently wiped immediately after synthesis (typically within 3 to 8 seconds).

• Uploaded customer photos are never written to persistent disk, cloud object storage buckets, or database logs.
• Uploaded customer photos and synthesized try-on outputs are never used to train, fine-tune, or improve any external or foundational AI models.
• In-memory buffers holding uploaded photo bytes are explicitly zeroed out (buffer.fill(0)) inside a mandatory finally execution block immediately upon returning the synthesized preview.

3. Cookies, Cross-Site Iframe Session Tokens & Security Policy

• Merchant Admin Session Cookie (vto_sess): Because the Wix Merchant Dashboard renders inside a cross-site iframe, our server sets an HMAC-SHA256 signed session cookie (vto_sess) with SameSite=None; Secure; HttpOnly; Path=/ attributes and supports signed URL session tokens (?session=vto_sess.*) so merchants remain authenticated even when third-party cookies are blocked.
• Short-Lived Storefront Widget Token (wtok.*): Storefront try-on requests are protected by a short-lived (15-minute TTL) HMAC-signed widget token and per-IP rate limiting (max 5 requests/minute) to prevent automated abuse.

4. Cloud Infrastructure & Subprocessors

• Google Cloud Run (Region: us-central1): Hosts the stateless application container processing HTTPS requests.
• Google Cloud Storage (GCS): Stores only the merchant credit ledger (wix-merchants-ledger.json) containing store instanceId credit balances and aggregate KPI counters—never customer photos.
• Google Gemini Multimodal Vision API: Performs ephemeral real-time image synthesis without retaining customer payloads.

5. Data Retention, GDPR / CCPA / PIPA Rights & Contact Information

Shopper photos are retained for 0 seconds after synthesis completion. Merchant store ledger records are retained while the app is installed and deactivated upon uninstallation. For any privacy inquiries or data deletion requests, contact our Data Protection Officer at andrewysac7@gmail.com.