Ello Biometric Data Policy

Ello Virtual Try-On, by Nollage LLC (doing business as Ello), lets a shopper see a product on their own photo. This is Ello's public written policy on biometric data, including the retention schedule and destruction guidelines called for by the Illinois Biometric Information Privacy Act (740 ILCS 14/15(a)) and the notice expected by Texas Business and Commerce Code section 503.001 and Washington RCW 19.375. Version 1.0, effective October 22, 2026.

The short version

• Ello does not create, collect, store, sell or use face templates, faceprints, scans of face or hand geometry, or any other biometric identifier, and never uses a photo to identify or recognize anyone.
• Ello's servers never write a shopper's photo to a database, file store, disk or log. The photo is held in memory only for the seconds the try-on takes.
• For handbags, Ello never locates the face.
• The few body positions Ello's servers read from a photo stay in memory only and are never used more than one hour after they are read.
• Ello never sells, leases, trades or otherwise profits from a photo or anything read from it.

What is read from a photo

• In the shopper's browser: an open-source person detector (COCO-SSD) confirms a person is in the photo. It does not look for a face; only a single confidence number is sent to Ello when no person is found.
• Rendering: the photo and the product image go to Google's AI, which draws the product on the photo. The photo is held in memory for the seconds the render takes; the finished image is held up to 3 minutes for dropped connections.
• Bags with known dimensions: Google's model returns a box around the person and the shoulder and wrist points; Ello keeps ten numbers (the box's top and bottom and four points) to place the strap and size the bag. Kept in memory for at most one hour.
• Glasses and hats only: a box around the face to frame a close-up. Switched off for every store, never used for bags or clothing.

Retention schedule and destruction

• Shopper photo on Ello's servers: seconds, released from memory when the request ends; never written anywhere, so no copy exists to delete later.
• Body positions and face box: at most one hour, then never used again and deleted at the server's next try-on or shutdown.
• Finished try-on image: held in memory up to 3 minutes for dropped connections, never written to disk.
• Consent records (stores that turn on the consent screen): 6 years, no photo, IP address, name or email.
• Bag-check log lines (about the bag only, never the person's position or face): 30 days.
• Any biometric identifier or biometric information: none is created; if any data were ever found to be one, Ello destroys it as soon as the try-on's purpose is satisfied, and always within 3 years of the person's last interaction with Ello.

Consent

Every store shows a notice before the first upload. A store can turn on Ello's consent screen: the camera and upload stay locked until the shopper reads a short written notice and taps "I'm 18 or older. I agree", which Ello intends as their written release by electronic signature. It appears once per browser session and again after 12 hours, and the server refuses a photo without a recent consent.

Providers

Google draws the try-on: every request starts on the Gemini API (paid tier), with Vertex AI as the backup. On the Gemini API, Google keeps each request, including the photo, the try-on image and its answers, for 55 days to detect misuse and for required legal disclosures. Authorized Google staff can review it. Google doesn't use it to improve its products or train its AI models, apart from its abuse-detection systems. On Vertex AI, Google keeps only requests its safety systems flag, up to 90 days. fal.ai and FASHN handle swimwear, intimates and clothing backup, never bags. Ello never sells, leases or trades a photo.

Questions: security@ellotryon.com. Read the Privacy Policy and the security overview.