Privacy Policy
Last updated September 25 2026
Looqko is a B2B virtual try on service that enables online stores to offer their customers a virtual fitting room experience using just a single photo. This policy outlines how we collect, use, and protect your personal data in compliance with the General Data Protection Regulation (GDPR - EU 2016/679) and French data protection laws.
1. Data Controller Identity
Looqko, virtual try on SaaS service
SIREN 101 532 596
Headquarters: 18 rue Eugène Varlin, Vigneux-sur-Seine, France
Legal Representative: Christivie Manzanza
Email: contact@looqko.com
Website: https://looqko.com
Two distinct roles. For client store data (account, billing, support), Looqko is the data controller. For photographs uploaded by shoppers via the widget, the store decides to offer the service: they act as the data controller, and Looqko acts as the data processor, operating solely on their instructions.
2. Data collected
2.1. Data provided by retailers
• Identity: first and last name, business name, store URL
• Contact Information: business email, phone number (optional)
• Authentication: password (bcrypt hashed, never stored in plain text)
• Billing Information: processed securety by Stripe (we never store card numbers)
• API Usage Logs: API keys, request volume, status
“For Shopify merchants, the app accesses order amounts to attribute sales driven by virtual try on; no personal customer data (name, email, address) is ever accessed or stored.”
2.2. Data provided by end users (shoppers)
• Photos: headshots and body images provided via the store widget to generate the virtual try on
• Body measurements: height and weight for size recommendations
• Technical data: IP address, session ID, browser type
Photos may contain biometric data. Processing is based on the explicit consent collected via the store widget. No persistent facial recognition systems are used.
2.3. Data Collected Automatically
• Technical logs (security, debugging, performance)
• Session cookies (authentication, language preferences)
• Anonymous analytics (heatmaps, conversion rates without personal data)
3. Purpose of processing and legal basis
• Providing the virtual try on service: Legal basis contract performance (GDPR Art. 6.1.b)
• Invoicing and subscription management: Contract performance
• Service security and fraud detection: Legitimate interest (Art. 6.1.f)
• Customer support: Contract performance
• Marketing communications and newsletters: Consent (Art. 6.1.a), withdrawable at any time
• Anonymous audience measurement: Legitimate interest
• Processing of photographs (biometric data): Explicit consent (Art. 9.2.a)
• Legal obligations (accounting, fraud, GDPR): Legal obligation (Art. 6.1.c)
4. Who We Share Data With
We work with technical service providers to keep the service running. They fall into the following categories:
• application and database hosting
• storage of generated photos and videos
• AI image generation and GPU computing
• payment processing and billing
• transactional email delivery
Each provider only accesses the data necessary for their specific tasks and cannot use it for any other purpose. Some are located outside the European Union, including in the United States; these transfers are governed by the Standard Contractual Clauses of the European Commission.
The specific list of these providers is included in the data processing agreement signed with each store, and can be requested at contact@looqko.com.
5. Data Retention
• Active merchant account: contract duration plus 3 years after termination (for contractual proof)
• Photos uploaded by end customers: automatically and irreversibly deleted within 24 hours of the try on
• Generated try on images and videos: 30 days maximum, then automatically deleted. Merchants can reduce this limit to 7 days from their dashboard.
• Technical logs: 12 months
• Billing data: 10 years (legal accounting requirement)
• Cookies: 13 months maximum
6. Security
We implement the following technical and organizational security measures:
• TLS encryption on all communication channels
• Encryption at rest for all files stored on Cloudflare R2
• Password hashing using bcrypt
• Personal data access restricted based on the principle of least privilege
• Automatic deletion of photos within 24 hours via a scheduled cron job and storage lifecycle rule
• Access and error logging
In the event of a personal data breach, we commit to notifying the CNIL within 72 hours and the affected individuals without undue delay, in accordance with Articles 33 and 34 of the GDPR.
Your Rights Under GDPR
You have the following rights regarding your personal data:
• Right of access (Art. 15): obtain a copy of your data
• Right to rectification (Art. 16): correct inaccurate data
• Right to erasure (Art. 17): "right to be forgotten"
• Right to restriction of processing (Art. 18)
• Right to data portability (Art. 20): receive your data in a structured format
• Right to object (Art. 21): specifically to profiling and marketing
• Right to withdraw your consent at any time
• Right to set post mortem directives on how your data is processed
To exercise these rights, send your request to contact@looqko.com and include a copy of your ID. We will respond within a maximum of 30 days (1 month, extendable by 2 months in complex cases).
Complaints: you can file a complaint with the CNIL (www.cnil.fr) if you feel your rights are not being respected.
Cookies and Tracking
We use the following types of cookies:
• Strictly necessary cookies: authentication, security, load balancing deployed without consent (CNIL exemption)
• Anonymized audience measurement cookies: without prior consent in accordance with CNIL recommendations
• Marketing and advertising cookies: only after your explicit consent
You can manage your cookie preferences at any time using the "Manage Cookies" button at the bottom of the page. Withdrawing consent is as simple as giving it.
9. Minors
Our services are not intended for minors under the age of 15, the digital consent age in France, which varies from 13 to 16 across European Union countries. However, a parent or legal guardian may use Looqko for a try on involving a minor. We do not knowingly collect personal data from minors without parental consent. Any data shared in error can be deleted upon request by contacting contact@looqko.com
10. Data Transfers Outside the European Union
Some of our technical service providers are based in the United States, specifically for image generation, computing, storage, and hosting. These international transfers are governed by:
• Standard Contractual Clauses approved by the European Commission (decision 2021/914)
• Adherence to the EU–US Data Privacy Framework for certified providers
• Additional technical measures: encryption in transit and at rest, data minimization, and a 24 hour retention limit for photographs
The specific list of providers and a copy of the applicable safeguards are available upon request at contact@looqko.com.
11. US Users — Biometric Data
This section applies to US residents, particularly in Illinois, Texas, and Washington, where biometric data laws are in place.
What we process. The photo you upload is used solely to generate your virtual try on. We do not extract facial or body geometry templates, we do not use facial recognition, and we never attempt to identify you. Your height and weight, when requested, are entered by you and are never inferred from the image.
Purpose. To generate the requested try on, and nothing else.
Retention and deletion. Your uploaded photo is deleted within 24 hours. The generated image or video is deleted after a maximum of 30 days, or sooner if the retailer has selected a shorter duration. Deletion is automatic and permanent.
Our commitment. We do not sell, lease, or trade your biometric data or the images they may be derived from. We do not share them with anyone outside the technical service providers listed in this policy, who process them exclusively to generate your try on. Your consent is always collected directly in the widget before any upload.
Changes to terms
We may update this policy to reflect legal, technical, or contractual changes. Active customers will be notified by email of any significant changes at least 30 days before they take effect. You can find the latest update date at the top of this page.
Get in touch
For any questions regarding this policy or the processing of your personal data:
• General Support: contact@looqko.com