Privacy Policy

Controller: TryItOn.com

Privacy contact: info@luxatica.com

We provide an AI-powered valuation service for collectibles and curiosities.

We rely on one or more of the following legal grounds:

• Contractual necessity – to deliver the Service you request.
• Consent – where you actively consent (e.g., when you email us or accept cookies).
• Legitimate interests – to operate, secure, and improve the Service in ways that do not override your rights.
• Legal obligation – to comply with UK law (e.g., keeping financial records).

Data Minimization: We collect only the minimum personal data necessary to provide our valuation services.

Automated Decision Making: Our valuations are generated using automated AI analysis through Google Gemini and OpenAI APIs. You have the right to request human review of any valuation result and to understand the logic behind automated decisions that significantly affect you.

Children's Data: We do not knowingly collect personal data from children under 16 years of age. If we become aware that we have collected such data, we will delete it promptly.

In the event of a data breach affecting your personal data, we will:

• Notify the UK Information Commissioner's Office (ICO) within 72 hours where required by law
• Notify affected individuals without undue delay where the breach is likely to result in high risk to your rights and freedoms
• Take immediate steps to contain and remedy the breach
• Provide clear information about what happened and what we are doing about it

We may update this Privacy Policy periodically. Any material changes will be highlighted on our website or sent by email (where we have that information). The "Effective Date" at the top will always show when revisions take effect.

If you have questions about this policy or our data practices, please contact our Data Protection Officer at info@luxatica.com

Thank you for trusting TryItOn with your information.

We process your information to:

• Provide and improve the Service – generate valuations, refine our models, and enhance user experience.
• Process payments and manage credits – verify purchases, maintain your credit balance, and record single-credit cookies.
• Create and manage user accounts – when you register via Clerk or purchase five (5) credits or more, we use your email to activate your account, secure access, and send receipts.
• Communicate with you – respond to enquiries, send service notifications, credit balance reminders, and, where you opt-in, product updates.
• Ensure security and prevent fraud – detect misuse, enforce our Terms, and protect users.
• Comply with legal obligations – meet accounting, tax, and regulatory requirements.

▶︎ Marketing and advertising: We never sell or rent your personal data. We may send you service-related messages and, with your consent or where lawful, occasional news or offers about TryItOn. You can opt out of marketing emails at any time by following the unsubscribe link or contacting us. We do not engage in third-party behavioural advertising or create advertising profiles that track you across unrelated services.

We share personal data only as necessary:

• Service providers – trusted partners that supply AI-model hosting, cloud infrastructure, databases, authentication, analytics, and payment processing. They act strictly as processors under written contracts that:
  • require them to follow our documented instructions,
  • prohibit them from selling or using your data for advertising, and
  • forbid them from retaining images or other content for unrelated training unless we have obtained your explicit consent.
• Authorities or regulators – where required by law, court order, or to protect rights, property, or safety.

Transfer Locations: We currently transfer personal data to the United States (Google Gemini and OpenAI APIs) and other countries where our service providers operate.

Safeguards: For transfers outside the UK/EEA, we rely on:

• UK-approved Standard Contractual Clauses (SCCs) where available
• Adequacy decisions by the UK government for certain countries
• Appropriate technical and organisational measures to ensure data protection

We regularly review the adequacy of these safeguards and will implement additional measures if required to ensure your data receives equivalent protection to that provided under UK law.

• Item images and content: processed transiently for valuation and deleted shortly thereafter, unless you have an account and choose to save results. If you choose to save results, they are stored in our managed cloud database and retained until you delete them or close your account.
• Saved valuation results: permanently deleted within 30 days of account closure to ensure complete data removal.
• Payment and contact records: retained for up to seven years to meet legal and accounting obligations.
• Single-credit cookie: retained on your device for up to 30 days solely to track usage and prevent fraud.
• Account data: retained while your account is active and for up to 12 months after closure, unless a longer period is required by law.
• Local storage data: remains on your device until you clear your browser data or we update the tracking mechanism.

We retain data no longer than necessary for the purposes stated above.

Under the UK GDPR you can:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase data ("right to be forgotten") in certain circumstances.
• Restrict or object to processing where legally applicable.
• Port data to another provider (where technically feasible) - data exports will be provided in commonly used formats such as JSON or CSV.
• Withdraw consent at any time (this does not affect prior lawful processing).
• Complain to the UK Information Commissioner's Office (ICO) if you believe we have infringed your rights.

Response Times: We will respond to data subject requests within one month of receipt. Complex requests may require up to three months, and we will notify you if additional time is needed.

To exercise any of these rights, email info@luxatica.com.

We employ industry-standard safeguards, including:

• End-to-end encryption of data in transit (HTTPS/TLS).
• Encryption and access controls on servers and storage.
• Regular security audits, penetration tests, and staff training.
• Strict internal policies governing data access and handling.

We use first-party cookies and similar technologies for:

• Essential functionality – including a credit-tracking cookie for single-credit sessions.
• Session management – keeping you logged in via our authentication provider. (if you have an account).
• Aggregated analytics – understanding how users interact with our Service.

Where required, we display a cookie banner requesting your consent. You can manage cookies in your browser settings at any time.