Security & Privacy at Ello

Ello Virtual Try-On adds an AI try-on to online-store product pages: a shopper uploads a photo and sees the product on themselves before buying. This page describes how Ello protects that photo and the merchant's data. In short: shopper photos are processed in memory and never stored on Ello's servers, all data is encrypted in transit and at rest, and Ello runs on SOC 2 audited infrastructure.

Our commitments

We never store a shopper's photo on our servers.
We never use photos or try-on images to train AI.
We never sell shopper data.
Shoppers see a notice before their first upload on each store, and stores can require a one-tap consent screen.
The widget never runs on checkout and never sees card data.

How Ello handles shopper photos

A shopper's uploaded photo is held in memory only for the seconds it takes to render the try-on, then discarded. It is never written to Ello's databases or object storage, and Ello never uses it to train AI. The finished try-on image, and the photo for next time, are saved only in the shopper's own browser, on their device, until they clear them. AI rendering uses Google's Gemini models under paid-tier terms. On the Gemini API, Google keeps each request, including the photo, the try-on image and its answers, for 55 days to detect misuse and for required legal disclosures. Authorized Google staff can review it. Google doesn't use it to improve its products or train its AI models, apart from its abuse-detection systems. Swimwear and intimate apparel are rendered by FASHN.ai, reached through the fal.ai inference platform, which is also the fallback; FASHN stores no inputs and deletes results within 60 minutes, and fal.ai returns the result as a temporary link under its own terms.

Platform security practices

Encryption in transit (TLS) for every connection, and encryption at rest via Google Cloud and Supabase; production credentials for the try-on service are kept in Google Secret Manager.
Tenant isolation: each merchant's data is separated by store and protected by database row-level security, a signed-in account can only act on the stores it owns, and the widget's public key is limited to a small set of operations.
The try-on engine only accepts requests signed by Ello's backend, with per-shopper, per-store and fleet-wide limits, and image fetches restricted to trusted sources.
Only Ello's founder has production access; every release goes through one tested release process with a rollback plan, and dependencies are scanned for known vulnerabilities.
A coordinated vulnerability disclosure policy with a published security.txt and a security contact at security@ellotryon.com.

Sub-processors and inherited compliance

Ello runs on Google Cloud (SOC 1/2/3, ISO 27001/27017/27018, PCI DSS), Supabase (SOC 2 Type II), Cloudflare (SOC 2, ISO 27001, PCI DSS), Vercel (SOC 2 Type II), Shopify (PCI DSS Level 1), FASHN.ai (no input storage, results deleted within 60 minutes), and fal.ai (SOC 2 Type II, inference hosting). Payments are handled by Shopify and Stripe, both PCI DSS Level 1; transactional email to merchants by Resend. Twilio and Decart are used only for optional features that are off by default.

Privacy and compliance

Ello acts as a data processor and CCPA service provider. Its Data Processing Addendum (EU Standard Contractual Clauses plus the UK Addendum) is available on request, Ello is happy to sign a customer's own DPA, and Ello gives at least 15 days' notice before changing a sub-processor. Shopify's mandatory GDPR compliance webhooks are implemented and HMAC-verified. Ello requests Shopify protected customer data at Level 1 only and reads no name, email, phone, or address fields. The Ello widget never loads on checkout or payment pages, so Ello is out of PCI scope.

Biometric privacy (BIPA, CUBI)

Ello does not create, store, or match a face template or faceprint and does not identify anyone: it renders how a product looks on a photo the shopper chose to upload. For handbags it never locates the face; it reads only a few body positions (shoulders and wrists), never used more than an hour after they're read. Stores can require a one-tap consent screen with a record of each consent, the photo is never stored, and it is all set out in Ello's published Biometric Data Policy.

Frequently asked questions

Does Ello store shoppers' photos?

No. A shopper's uploaded photo is processed in memory only to render the try-on, then discarded. It is never written to Ello's databases or storage. The finished try-on image, and the photo for next time, are saved only in the shopper's own browser. Ello never uses photos to train AI models. Google, which draws the try-on, keeps each API request, including the photo and the try-on image, for 55 days to detect misuse and for required legal disclosures.

Is Ello SOC 2 or ISO 27001 certified?

Not yet. Ello's hosting providers (Google Cloud, Supabase, Cloudflare and Vercel) each hold SOC 2 reports, and Google Cloud and Cloudflare are also ISO 27001 certified. Ello's own SOC 2 examination is on the roadmap ahead of enterprise contracts; security documents, the sub-processor list and the Data Processing Addendum are available on request at security@ellotryon.com.

Does the Ello widget run on the checkout page?

No. The widget never runs on checkout or payment pages, and Ello never sees card data. A standard Shopify web pixel reports product views, add-to-carts and completed orders so try-ons can be matched to sales, with order numbers, totals and items but no names, emails, addresses or card details. Ello is out of PCI scope.