Privacy Notice

5. Face Data and Virtual Try-On Privacy

5.1 Collection and Purpose. When you use our Virtual Try-On feature, Squinted accesses your device camera using Apple ARKit / TrueDepth technology strictly to detect 3D facial anchor points and facial geometry in real time. This data is used solely to calculate frame positioning and render 3D virtual eyewear overlays on your screen.

5.2 Transient Processing and Zero Storage. Face data is processed entirely on your local device in volatile, transient memory (RAM) during your active Virtual Try-On session. Squinted does not collect, record, save, or store face data, facial measurements, or camera feeds on local disk storage or remote servers under any circumstances.

5.3 No Third-Party Sharing. Face data is strictly processed on-device and is never transmitted, disclosed, or shared with third parties, AI services, advertising networks, or external partners.

5.4 Retention and Immediate Deletion. Face data is retained for 0 seconds. All facial mapping points exist exclusively in transient memory for real-time rendering and are permanently discarded the instant you close the Virtual Try-On view or navigate away from the screen.

6. Sharing Your Personal Data

6.1 Between buyers and sellers. Because the Platform is a marketplace, some data is shared between users to enable a sale and delivery. In particular, when you buy, we share your name and delivery address with the seller and carrier so the item can be sent to you; and limited information is shared to enable messaging and, where relevant, a Buyer Protection claim. Each user is responsible, as an independent controller, for the personal data they receive about another user, and must use it only to complete the transaction.

6.2 Our service providers. We share personal data with providers who process it on our behalf or, where indicated, as independent controllers, including: Stripe (payments, seller onboarding and fraud prevention – Stripe acts as an independent controller for its own compliance, verification and fraud-prevention purposes); SendCloud and carriers (shipping and tracking); hosting, IT, identity-verification and fraud-prevention providers; and our professional advisers. Google LLC (Google Gemini AI for automated frame attribute extraction, where images are processed securely under strict enterprise confidentiality and equal data protection standards); hosting, IT, identity-verification and fraud-prevention providers; and our professional advisers.

6.3 Others. We may share data with regulators, HMRC, law enforcement and other authorities where required or permitted by law, and with a buyer of our business or assets (in which case personal data may transfer as part of that transaction). We do not sell your personal data.

7. International Transfers

7.1 Some of our providers process personal data outside the United Kingdom. Where we transfer personal data outside the UK, we ensure appropriate safeguards are in place, such as transfer to a country the UK has deemed adequate, or use of the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. In particular, we rely on those mechanisms for transfers by Stripe and SendCloud.

8. Data Security

8.1 We use appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls and regular reviews. No transmission over the internet is completely secure, so we cannot guarantee absolute security; you are responsible for keeping your login credentials confidential.

9. How Long We Keep Your Personal Data

9.1 We keep personal data only for as long as necessary for the purposes for which we collected it, including to meet legal, accounting, tax and dispute-resolution requirements. In general:

• (a) account, identity and contact data is kept for the life of your account and for 12 months after closure;
• (b) transaction, payout and tax records are kept for six years from the end of the relevant tax year, to meet accounting and platform-reporting obligations;
• (c) Buyer Protection, dispute and communications records are kept for six years; and
• (d) usage and analytics data is kept in pseudonymised or aggregated form in line with our analytics settings.

10. Cookies

10.1 We use cookies and similar technologies as described in our Cookie Policy, which explains the cookies we use and how you can manage your preferences.

11. Your Data Protection Rights

11.1 Subject to the conditions in data protection law, you have the right to: access your personal data; have inaccurate data corrected; have data erased; restrict or object to processing; data portability; and, where we rely on consent, to withdraw it at any time. You also have the right to complain to the ICO (see clause 1.4).

11.2 To exercise any right, contact us at [email protected]. We do not usually charge a fee, we may need to verify your identity, and we will respond within one month (which we may extend for complex requests, telling you if so).

12. Automated Decision-Making

We may use automated tools to help detect fraud and misuse. We do not make decisions producing legal or similarly significant effects based solely on automated processing; if this changes, we will update this Notice and tell you about your rights.

13. Changes to This Privacy Notice

We keep this Privacy Notice under review and may update it from time to time. Where changes are material, we will notify you by email or through the Platform. The “Last updated” date shows when it was last revised.

14. Lawful Bases – What They Mean