Privacy policy
How your personal data is processed, in line with the GDPR.
Processing of personal data in accordance with the GDPR and the French Data Protection Act.
1. Data controller
The data controller is Emelva, société par actions simplifiée unipersonnelle with share capital of €1,000, currently being registered with the Commercial and Companies Register (RCS) of Compiègne, whose registered office is at 9 rue Notre-Dame de Bon Secours, 60200 Compiègne, France. SIREN and intra-EU VAT number pending allocation. The company is represented by Vincent Darsonville (see the legal notice). For any question about your data: hello@emelva.com.
2. Data collected
- Customer: full-length photo and generated silhouette, looks tried on, size, favourites, messaging exchanges, and where applicable an e-mail address for availability alerts.
- Shop: business contact details, shopfront information, billing data.
- Technical: connection data and cookies necessary for the service to work (see the Cookie policy).
3. Purposes and legal bases
- Providing the virtual fitting room, performance of the service / consent for the photo;
- Filling the shop’s customer file and enabling the commercial relationship, legitimate interest;
- Managing subscriptions and billing, performance of the contract;
- Sending alerts and reports, consent / legitimate interest;
- Complying with legal and accounting obligations, legal obligation.
4. The photo and the silhouette, a special case
The photo provided by the customer is used solely to generate her fitting silhouette and the renderings she asks for. It stays private: Emelva never publishes it — only the customer may choose to share a rendering, and a shop sees only what the customer does in its own space. To produce each try-on, the photo or the silhouette is passed to the artificial-intelligence providers named in section 6, strictly for that generation. Processing is based on explicit consent, obtained before any transmission and withdrawable at any time from the customer’s own space.
5. Retention period
Data is kept for as long as the purposes require: the photo and the silhouette until the account is deleted or after 24 months of inactivity; billing data for the legal retention period; customer-file data for as long as the relationship with the shop is active.
6. Recipients and processors
The data is accessible to the publisher and, for the customer file, to the shop concerned. The following processors are involved strictly within the scope of the service, under a GDPR-compliant contract:
- Generating try-ons, imagery and videos: OpenAI (United States), FASHN AI (United States) and Seedance (United States) receive the photo or the silhouette for as long as it takes to produce the requested rendering;
- Hosting and storage: Vercel (application), Neon (database, hosted in the European Union — Frankfurt), Cloudflare (image storage, Western Europe);
- Payments: Stripe — Emelva neither sees nor stores any card number;
- E-mails: Brevo (European Union).
No data is sold to third parties.
7. Your rights
You have rights of access, rectification, erasure, restriction, objection and portability, as well as the right to withdraw your consent and to give post-mortem instructions. A customer can exercise them directly from her own space: “Download my data” (a complete export in JSON format) and “Delete all my data” (immediate erasure of the account, the images and the conversations, with no human involvement). You may also write to hello@emelva.com. You may also lodge a complaint with the French data protection authority, the CNIL (cnil.fr).
8. Security
The publisher implements appropriate technical and organisational measures to protect the data: encryption in transit, access to images subject to authorisation and checked on every request, strict separation between shops, and transmission to AI providers limited to the duration of the requested generation. A customer’s photo is never accessible to her shop.
9. Transfers outside the EU
The database is hosted in the European Union. Generating try-ons, however, involves transferring images to providers located in the United States (OpenAI, FASHN AI, Seedance — section 6), for as long as it takes to produce the rendering. These transfers are covered by appropriate safeguards: the European Commission’s standard contractual clauses and, for certified providers, the EU–US Data Privacy Framework. No other transfer outside the EU takes place.