Shade Studio Privacy Policy

Effective date: October 20, 2026.

1. Who we are and scope

Shade Studio is operated by Zyro AI LLC (“Zyro”, “we”, “us”). This policy covers cartlab.ai, its contact form and Shade Studio demo. It also covers our merchant app and its cosmetic preview, shade-suggestion and product-appearance tools on participating stores. Contact privacy@cartlab.ai with privacy questions or requests.

Merchants’ storefronts, purchases, marketing and other tools are subject to their own policies. Separate website services are covered by the notice displayed on those services.

2. Information we process

We receive merchant store and account identifiers and merchant-authorized access tokens needed to connect the App to a store. We also receive product and variant data, catalogue images, and installation and subscription information. We process merchant settings, drafts, approvals, publications and related service records.

We process information you provide through our contact form or when contacting support, such as your name, email address, store address and message. We use contact requests to respond to you. Please do not send shopper face images or unrelated sensitive information.

We process technical and usage information, such as IP address, browser and device information, usage identifiers and interactions with our website and App. We use this information for service operation, security, website analytics, usage measurement and allowance administration.

We do not receive shopper account information, passwords or login credentials through the App, or access merchants’ customer or order records. Product purchases use the merchant’s commerce platform and checkout. We do not receive payment-card details through the App’s billing flow.

3. Shopper camera, photos and facial processing

Shoppers choose whether to use a camera, selected photo or available preset model. Camera frames, selected shopper photos, facial landmarks and skin-colour measurements are processed in the shopper’s browser to position cosmetic effects and suggest approximate shades. They are not uploaded to Zyro or our image-processing providers, used to identify or authenticate people, or used to train AI models.

This local processing serves the requested preview or shade suggestion. Stopping or closing the preview stops active capture and analysis. A paused photo may remain locally so the experience can resume; retained input is released when cleared or replaced, the viewer is destroyed, or the page ends, subject to browser memory management. We do not maintain a server-side store of this input or sell, lease or trade it. This describes its purpose and retention/destruction schedule where biometric laws apply.

The App explains camera/photo processing before the shopper chooses to start it. Shoppers can decline, stop the preview or revoke camera permission. Any additional notice or consent required by applicable law remains necessary.

4. Merchant catalogue images and automated suggestions

Merchant catalogue imagery is processed separately from shopper camera/photo input, including through service providers and automated tools, to prepare product appearances and approximate shade suggestions. Suggestions require merchant review and approval before publication. Previews and suggestions are illustrative, not guaranteed physical shade matches.

We use merchant data to provide the authorized App service. General-purpose or cross-merchant AI training is not part of this service.

5. Purposes and lawful grounds

We use information to authenticate installations, operate and secure the App, prepare and publish merchant-approved appearances, administer subscriptions and usage, provide support, prevent abuse, meet legal obligations and handle requests. We do not sell personal information or use shopper face data for advertising.

Where applicable law requires a lawful basis, we rely on contract performance for requested services where you are a party to that contract. We rely on legitimate interests in business account administration, service operation, usage measurement, security and support where permitted; legal obligations for required compliance; and consent where the particular processing requires it.

6. Recipients and processing locations

We use commerce platforms, billing providers, and providers of hosting, storage, content delivery, website analytics, security, logging and image-processing services. Authorized personnel and providers may process relevant information as necessary for these purposes, subject to applicable confidentiality and data-protection obligations. Providers processing information for their own purposes do so under their own agreements and policies.

We may disclose relevant information to meet legal requirements, investigate fraud, protect legal rights, or complete a business transaction such as a merger or sale, subject to applicable safeguards and restrictions.

Server-processed information is currently hosted in the United States and may be handled outside your country. Where international processing requires a transfer safeguard under applicable law, that requirement applies to the relevant processing. Contact privacy@cartlab.ai for information about safeguards applicable to your data.

7. Retention, uninstall and deletion

We retain information as needed to provide the service, administer usage and billing, protect security, handle requests and meet legal obligations. Retention depends on the information’s type and purpose.

Uninstall revokes App access. Verified platform privacy notifications trigger deletion of the associated store data; you can also request deletion using the contact below. Where platform terms require deletion within 30 days after uninstall, an enforceable deletion request or the end of the service need, that deadline applies to originals and copies. Exceptions apply only where applicable law prohibits or varies that requirement. Any earlier binding deadline still applies.

Limited information may be retained only where permitted or required by applicable law and binding platform requirements. These limits also apply to backups. Information merchants independently hold in their commerce platforms remains under their control.

8. Security, storage and privacy choices

We use reasonable technical and organizational safeguards appropriate to the information. No service can guarantee absolute security. We handle and report incidents as required by applicable law and binding platform obligations.

The preview may use browser memory or storage to operate and remember permitted choices. Other storefront tools, cookies and advertising are governed by the merchant and their providers.

Our merchant service is intended for businesses. If you believe we have received a child’s personal information in violation of applicable law, contact privacy@cartlab.ai. We will investigate and take any action required by law, including deletion.

9. Requests and your rights

Email privacy@cartlab.ai to exercise rights available under applicable law, which may include access, correction, deletion, a usable copy, restriction, objection, withdrawal of consent, appeal or a complaint to a competent authority. We may verify identity and authority and respond within applicable legal timeframes. We do not discriminate for exercising legally protected privacy rights.

Contact the merchant about records it holds. We handle requests concerning information we process as required by applicable law and platform obligations. We cannot retrieve shopper face input that never reached our systems.

10. Changes and contact

We will publish changes with an updated effective date and provide additional notice or obtain consent when legally required. A changed policy does not authorize an incompatible new use of previously collected information without the necessary permissions.

Privacy contact: Zyro AI LLC, privacy@cartlab.ai.