This page is our transparency document under EU GDPR Articles 13 and 14. It explains who controls your data, why we process it, the legal basis for each purpose, how long we keep it, which third-party processors we use, and how to exercise all seven of your data subject rights. We do not sell your data. We do not use your images to train shared AI models.
The data controller responsible for your personal data is:
Picshoot
Operating at picshoot.app
General contact: [email protected]
Privacy & data requests: [email protected]
As data controller, Picshoot determines the purposes and means of processing personal data collected through the Picshoot platform and Shopify embedded app. Where we engage third-party processors (listed in Section 6), we do so under written data processing agreements that bind those processors to process data only on our documented instructions.
This GDPR compliance statement applies to EU and EEA data subjects who use Picshoot as Shopify merchants or brands. This includes individuals who:
Picshoot is a B2B platform. The data subjects covered by this document are merchants and their authorised staff — not end consumers of the merchants' stores. If you are a consumer of a Picshoot merchant's Shopify store, that merchant is the data controller for your consumer data; Picshoot does not access consumer order or personal data.
Your garment images and all AI-generated outputs are private to your account and are never used to train, fine-tune, or benchmark any shared AI model, whether operated by Picshoot or by a third-party processor.
Picshoot does not collect, process, or store:
We rely on four legal bases under GDPR Article 6. The table below maps each processing activity to its basis.
| Processing Activity | Legal Basis | Details |
|---|---|---|
| Providing the AI pipeline service (try-on, scenes, listing copy) | Art. 6(1)(b) — Contract | Necessary to perform the subscription contract you entered into |
| Account authentication and session management | Art. 6(1)(b) — Contract | Required to identify you and maintain secure access to your account |
| Billing, plan enforcement, and credit tracking | Art. 6(1)(b) — Contract | Necessary to administer the subscription and enforce plan limits |
| Publishing AI-generated listings to your Shopify store | Art. 6(1)(b) — Contract | Core service feature performed on your explicit instruction |
| Security monitoring, fraud detection, and rate limiting | Art. 6(1)(f) — Legitimate Interests | Protecting the platform and all users from abuse; interest does not override your rights |
| Aggregated product analytics and usage statistics | Art. 6(1)(f) — Legitimate Interests | Improving the service based on how features are used; data is anonymised before analysis |
| Customer support and dispute resolution | Art. 6(1)(f) — Legitimate Interests | Responding to your queries and resolving service issues |
| Marketing emails and product updates | Opt-in only; you may withdraw consent at any time via the unsubscribe link or by emailing [email protected] | |
| Responding to GDPR data subject rights requests | Art. 6(1)(c) — Legal Obligation | Required under GDPR Articles 15–22 |
| Financial record retention for tax and audit purposes | Art. 6(1)(c) — Legal Obligation | Required under applicable financial regulations; billing records retained 7 years |
| Responding to Shopify GDPR webhooks | Art. 6(1)(c) — Legal Obligation | Mandatory under Shopify Partner Program requirements and GDPR |
Where we rely on legitimate interests, you have the right to object to that processing at any time (see Section 5 below). We have conducted legitimate interests assessments for security monitoring and product analytics and concluded that our interests do not override your fundamental rights and freedoms.
You have seven rights under GDPR. We honour all of them. Email [email protected] to exercise any right — we will respond within 30 days.
We share data with the following sub-processors solely to operate the service. Each processor is bound by a data processing agreement (or equivalent contractual instrument) requiring them to process your data only on our documented instructions, maintain adequate security, and not disclose it to third parties for their own purposes.
| Processor | Role | Data Shared | Location |
|---|---|---|---|
| Shopify Inc. | OAuth authentication, App Store billing, product publishing API | Store domain, owner email, access token, billing status | Canada / United States (adequacy + SCCs) |
| Google LLC (Gemini AI) | AI image generation — try-on, scenes, zoom | Garment images, model images, scene prompts | United States (SCCs / Google EU DPA) |
| Anthropic PBC (Claude AI) | AI text generation — product listing copy, garment analysis | Garment metadata, style descriptors; no images transmitted to Claude | United States (SCCs / Anthropic DPA) |
| Cloudflare Inc. (R2) | Object storage for all user images and generated assets | Garment images, AI-generated images, scene images | United States / EU nodes (Cloudflare DPA) |
| Railway Corp. | Application hosting and SQLite database | Account data, session tokens, usage records stored in DB | United States (SCCs) |
We do not transfer personal data to countries outside the EU/EEA that lack an adequacy decision from the European Commission without ensuring that appropriate safeguards are in place, specifically Standard Contractual Clauses (SCCs) approved under GDPR Article 46(2)(c) or an equivalent mechanism recognised under applicable data protection law.
We retain personal data only as long as necessary for the purpose for which it was collected, or as required by law. The specific periods are:
We implement technical and organisational measures appropriate to the risk, including:
No system is unconditionally secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware and will inform affected data subjects without undue delay where required by Article 34 GDPR.
We use a single session cookie (ps_session) to maintain your authenticated session. This cookie is:
We also use browser localStorage to remember your UI preferences (theme, pipeline mode toggle). This data is stored locally on your device and is not transmitted to our servers. No third-party analytics cookies, advertising cookies, or tracking pixels are deployed. See our Cookie Policy for full details.
As a Shopify Partner, Picshoot implements all three mandatory GDPR webhooks required by Shopify:
POST /webhooks/customers/data_request) — on receipt we compile and make available any personal data associated with the requesting customer within the period required by ShopifyPOST /webhooks/customers/redact) — we do not hold consumer customer data, so this webhook is acknowledged and logged but requires no data deletion actionPOST /webhooks/shop/redact) — on receipt, we schedule full erasure of all data associated with the merchant's store within 30 days of the webhook, in line with our data retention scheduleAll webhook payloads are verified using HMAC-SHA256 against our Shopify API secret before processing.
Enterprise customers and organisations subject to GDPR Article 28 that require a formal Data Processing Agreement with Picshoot may request one by emailing [email protected] with the subject line "DPA Request".
Our standard DPA covers:
We aim to provide a completed DPA within 10 business days of a verified request.
Picshoot is a business-to-business platform for merchants and brands. We do not knowingly collect or process personal data from individuals under 18 years of age. If you believe a minor has created an account or their data has been submitted to our platform, please contact us immediately at [email protected] and we will take prompt action to delete that data.
If you are an EU/EEA resident and believe that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the data protection supervisory authority in your EU member state. You can find your local authority at:
https://edpb.europa.eu/about-edpb/about-edpb/members_en — European Data Protection Board member list
We always encourage you to contact us first at [email protected] so that we have an opportunity to address your concern directly and promptly before a formal complaint is filed.
We may update this GDPR compliance statement when our processing activities change, when we onboard new sub-processors, or in response to regulatory guidance. For material changes, we will notify you by email to your registered address at least 14 days before the change takes effect and update the "Last updated" date at the top of this page. Continued use of the Service following the effective date constitutes acknowledgement of the updated document.
For all GDPR-related enquiries, data subject rights requests, DPA requests, or questions about this document:
Privacy contact: [email protected]
General support: [email protected]
Response time: We acknowledge within 5 business days and respond substantively within 30 calendar days.