Data processing for pilots (DPA)

Last updated: 8 September 2026.

This page describes data processing arrangements for a WooCommerce pilot. The parties must agree and conclude a detailed processing agreement before processing shopper photos. Submitting the contact form does not conclude that agreement.

1. Parties and roles

The store deciding why to use try-on is the controller of its shoppers' data. Wearlo processes entrusted data on the store's documented instructions. The service provider is Ailo sp. z o.o., Parkowe Wzgórze 100, 32-031 Mogilany, Poland, Tax ID (NIP) 6762430848.

Information submitted directly in a pilot enquiry is covered separately by the Privacy Policy.

2. Data and pilot purpose

Try-on uses a person's photo, product images and the generated result. Handling the request can involve store, product, session and generation identifiers, operation timestamps and technical data needed to operate and secure the service. Photos may show a person's face and body.

Data, operations and access to results should match the pilot purpose: creating clothing or handbag visualisations in the store. Tests using staff photos must also take account of their rights.

3. What the processing agreement covers

Arrangements cover purpose and duration, data and individuals concerned, store instructions, confidentiality, security, sub-processors, assistance with rights requests, breaches, audits, and data return or deletion. The European Data Protection Board explains the required agreement.

4. Providers and processing locations

The product architecture uses Railway hosting, Amazon Web Services S3 file storage, and a Kie.ai integration for image generation. Error monitoring can use Sentry, depending on the environment configuration.

Each pilot needs an identified list of active sub-processors, data shared, regions, and arrangements for any transfers outside the European Economic Area. These arrangements need to be documented before processing begins.

5. Retention, deletion and security

Retention periods for photos, results, logs and backups, and the deletion process, need to be agreed and checked in the pilot configuration.

Pilot documentation should describe implemented safeguards, authorised access and incident handling. Support arrangements follow the parties' agreement and applicable law.

6. Contact

For the processing agreement and pilot configuration, email [email protected]. See also the pilot terms.