Kora Privacy Policy
Last updated: September 18, 2026
1. Introduction
Thesimus Limited ("Kora," "we," "us," or "our") provides a virtual try-on service that lets you visualize products on yourself using a photo you choose to upload, and an optional Kora account that saves your photos and try-on images for reuse across participating stores.
This Privacy Policy explains what data we collect, how we use it, how long we keep it, and the choices you have. It applies wherever you use Kora.
2. What We Collect
- Your photo. The photograph you voluntarily upload to create a try-on.
- Generated images. The try-on images our service creates from your photo.
- Account information (only if you create a Kora account): your email address, and — if you sign in with Google — your name and profile picture as provided by Google. We never see your Google password.
- Newsletter opt-in (only if you choose it): your email address and your choice to receive offers from a specific retailer.
- Usage analytics. Anonymized events about how the try-on feature is used (for example, that a try-on was generated for a product category). We derive an approximate location (country/city) from your IP address at the time of the request, but we never store your IP address.
- Technical logs. Limited device and security information (such as device type) to keep the service stable and secure.
3. How We Process Your Photo
When you request a try-on, your photo is sent over an encrypted connection to our AI image service, which generates a new composite image showing the product on you. This is image generation, not identification:
- No face recognition. We do not create, store, or use face-recognition templates or other biometric identifiers. Your photo is not matched against any database, and we do not use it to identify you.
- No AI training. We do not use your photos or generated images to train AI models.
- No sale. We do not sell, lease, or trade your photos or generated images to anyone.
- Separation of data. Your email address is never linked to any face database. We do not build searchable databases of faces.
4. Why We Process Your Data (Purposes and Legal Bases)
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Creating your try-on image | Your photo | Performance of the service you request (Art. 6(1)(b)) |
| Saving your photos and try-ons to your account | Photo, generated images, email | Performance of the service you request (Art. 6(1)(b)) |
| Sending you your images or service updates | Performance of the service; consent for marketing | |
| Retailer newsletter offers | Your explicit opt-in consent (Art. 6(1)(a)) | |
| Usage analytics | Anonymized events | Consent / legitimate interest in improving the service |
| Security and abuse prevention | Technical logs | Legitimate interest (Art. 6(1)(f)) |
5. Data Retention
Without a Kora account (guest use):
- Your photo and the generated try-on image are processed to create your result and are not retained on our servers after your session. Anything you see in your browser (such as recent looks) is stored locally on your own device.
With a Kora account:
- Photos you choose to save and your try-on history are stored securely with your account so you can reuse them across participating stores. They are kept until you delete them or delete your account.
- Your email address is kept for as long as your account exists.
Other data:
- Newsletter opt-ins are kept until you unsubscribe.
- Consent records are kept for up to 5 years as required for compliance.
- Anonymized analytics contain no identifying information.
You can delete saved photos, try-ons, or your entire account at any time (see Section 8).
6. Data Sharing and Processors
We share data only with the service providers needed to operate Kora:
- Google Cloud — AI image generation (processing location: United States).
- Supabase — database and account authentication (processing location: European Union).
- Our hosting provider — application hosting.
If you explicitly opt in to a retailer's newsletter through Kora, we share your email address only with that retailer (or their email platform). We never share your photos or generated images with retailers.
International transfers: where data is processed outside the EEA (AI image generation in the United States), the transfer is protected by Standard Contractual Clauses and enterprise-grade security agreements.
7. Security
Your photo is protected with industry-standard encryption (TLS) in transit. Account data is stored in access-controlled infrastructure. Processing memory used for image generation is cleared after your result is produced.
8. Your Rights
Depending on your location, you have the right to access, correct, delete, or receive a copy of your personal data, to object to or restrict certain processing, and to withdraw consent at any time.
- Delete saved content: remove saved photos and try-ons directly in the Kora widget, or delete your account entirely.
- Unsubscribe: every marketing email contains an unsubscribe link.
- Everything else: contact us at privacy@kora.fashion and we will respond within 30 days.
EU/EEA users may also lodge a complaint with their local supervisory authority; our lead authority is the Irish Data Protection Commission.
9. Children's Privacy
Kora is not intended for users under 16. We do not knowingly process photos of children. If you believe a minor has used the service without parental permission, contact us and we will delete the data immediately.
10. Changes to This Policy
We may update this Policy as our technology or legal requirements change. The "Last updated" date shows the latest revision. Material changes will be communicated through the service.
11. Governing Law
This Policy is governed by the laws of Ireland. Disputes shall be resolved exclusively in the courts of Ireland.
12. Contact
Questions about privacy: privacy@kora.fashion