Mirror AR
Privacy Policy

Who we are

Mirror AR ("the app") is built and operated by MHB Digital ("we", "us", "our"). The app adds live virtual try-on for glasses and caps to Shopify stores, through a Try-On button on product pages and an optional Try-On Studio page.

This policy covers information handled when a merchant installs and uses the app, and when shoppers use the try-on on a merchant's store. It does not cover the merchant's own store, Shopify's services, or other websites, which have their own privacy policies.

Information we collect from merchants

When you install Mirror AR, Shopify shares certain information with the app so it can work with your store. We collect:

• Store details: your store's myshopify.com domain, store name, and the access token Shopify issues to the app. When you or your staff open the app in Shopify admin, Shopify may also share the name and email address of that staff account to identify the session.
• Product information: titles, images, variants, prices and collections of the products you choose to use with the try-on, read through Shopify's API.
• Content you add: the transparent PNG overlay images you upload and their alignment settings. Images are stored in your store's Shopify Files. Settings are stored in our database and in your products' app data (metafields).
• Plan and usage: which Mirror AR plan your store is on and how many try-ons have started, so we can apply plan limits. Billing is handled entirely by Shopify. We never receive your payment card details.
• Support messages: anything you send us when you contact us for help.

Information processed from shoppers

Camera and face tracking

When a shopper taps "Try it on live", their browser asks for permission to use the camera. If they allow it, the video is analysed inside their browser, on their own device, to find the position of the face so the product image can be drawn in the right place.

Video frames, photos and face position data are never sent to our servers or stored, and they are discarded when the try-on is closed. The app does not create facial recognition templates and cannot identify anyone. Shoppers can refuse or withdraw camera permission at any time in their browser settings.

Try-on count

When a try-on starts, the shopper's browser sends a short request to our server through Shopify's app proxy so we can count usage for the store's plan. Shopify adds standard details to these requests, such as the store's domain and, if the shopper is logged in to the store, their Shopify customer ID. We use the request only to update the store's total count. We do not store the customer ID or link the count to any individual.

Technical logs

Like any website, our servers and hosting provider may keep short-term technical logs, such as IP address, browser type and time of request. These are used only for security and troubleshooting and are deleted after a limited period.

Browser storage

The app saves a small marker in the browser's session storage so that one page view is counted once. It contains no personal information and is cleared when the tab is closed. Mirror AR does not use cookies for tracking or advertising.

Add to cart

When a shopper adds a product from the try-on, it goes into the store's own Shopify cart. Checkout, payment and order details are handled by Shopify and the merchant, not by us.

How we use information

• To provide the app's features, such as showing the right products and overlays on your store.
• To apply plan limits and confirm your subscription with Shopify.
• To respond to support requests and send important notices about the app.
• To keep the app secure, prevent misuse and fix problems.
• To meet legal obligations and Shopify's requirements for apps.

We do not sell or rent personal information, share it for cross-context behavioural advertising, or use it to train AI models.

Where the EU or UK GDPR applies, we rely on these legal bases: performing our contract with the merchant, our legitimate interests in running a secure and reliable app, compliance with legal obligations, and, for camera access, the permission the shopper gives in their browser.

How we share information

• Shopify, which provides the platform the app runs on and handles billing.
• Service providers that host our servers and database for us. They may use the information only to provide their services to us.
• Legal reasons: if required by law, or to protect the rights, safety or property of our users, the public or us.
• Business transfers: if MHB Digital is involved in a merger, acquisition or sale of assets, information may transfer as part of that deal under this policy.

Retention and deletion

• While the app is installed, we keep your store's data so the app keeps working.
• After you uninstall, Shopify sends us a request 48 hours later to erase your store's data. When we receive it, we delete your store's records from our database. Overlay images in your Shopify Files stay in your store under your control, and you can delete them at any time.
• Customer data requests: we respond to the data access and erasure requests Shopify sends on behalf of your customers. Because the app doesn't store shoppers' personal information, there is normally nothing to return or erase, and we confirm this.
• Technical logs are deleted after a limited period. Support messages are kept for as long as needed to help you.

Security and international transfers

All data between Shopify, the app and our servers is encrypted in transit (HTTPS). Access tokens are kept on our servers only, and access to our systems is restricted to people who need it to run the app. No method of storage or transmission is completely secure, but we work to protect your information and will notify affected merchants of a breach as required by law.

Our servers and service providers may be located in a different country from you. Where we transfer personal information internationally, we use appropriate safeguards, such as standard contractual clauses, as required by applicable law.

Merchant responsibilities

For information about shoppers, the merchant is in charge of their store, and we act as a service provider (a "processor") on the merchant's behalf. Merchants are responsible for their own store's privacy notice and for meeting the privacy laws that apply to their store.

Your privacy rights

Depending on where you live, including under the EU and UK GDPR, the California Consumer Privacy Act and South Africa's Protection of Personal Information Act (POPIA), you may have the right to:

• access the personal information we hold about you and get a copy;
• correct information that is wrong or incomplete;
• ask us to delete your information;
• object to or restrict certain uses, and withdraw consent where we rely on it;
• receive your information in a portable format;
• complain to your local data protection authority.

Merchants can contact us directly. Shoppers should contact the store where they shopped, as the store controls its customer data. You can also contact us and we'll help or pass your request to the store. We respond within 30 days and won't treat you differently for using your rights.

Children

Mirror AR is a business tool for Shopify merchants and is not directed at children. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

Changes to this policy

We may update this policy when the app changes or the law requires it. We'll change the "Last updated" date at the top, and for significant changes we'll notify merchants by email or in the app before they take effect.

Contact us

For questions about this policy or to make a privacy request, contact: