Skip to content
Legal
Español

For brands

Terms of ServiceData Processing AgreementSub-processors

For shoppers

Privacy PolicyTerms of Use for shoppers

General

Cookie and storage noticeLegal notice

Legal · Version 2026-10 · Updated 26 October 2026

Privacy Policy

How TryYourSize handles your account, your body measurements and the sizes stores receive, and how to see, download or delete your data.

Contents

  • 1. Who we are
  • 2. When this policy applies
  • 3. What we collect
  • 4. Your measurements: sensitive, voluntary and kept to you
  • 5. What stores receive
  • 6. Why we use your data, and on what legal basis
  • 7. How long we keep your data
  • 8. Your rights, and how to use them
  • 9. Age: 16 and over
  • 10. Who we share data with
  • 11. Where your data is
  • 12. Security
  • 13. Cookies and storage
  • 14. Brand users of Studio
  • 15. Changes
Draft

Draft — requires review by counsel before publication. Written by an AI assistant, not a lawyer. Every "For counsel" note marks a point that needs legal judgement.

In short

  • You measure yourself once with a tape. Your TryYourSize profile keeps your body so that you can get your size in every store that has TryYourSize.
  • Stores receive your size, never your measurements. Nobody at a store, and nobody at TryYourSize, can open your body.
  • Giving measurements is voluntary. You can measure without an account ("try without saving"), and you can delete everything at any time at my.tryyoursize.com.
  • You must be 16 or older to have your own profile.
  • We host your data in the European Union and never sell it.

1. Who we are

[COMPANY LEGAL NAME], S.L. ("TryYourSize", "we"), [REGISTERED ADDRESS], Spain, tax ID [CIF], is the controller of your TryYourSize profile: your account, your bodies and measurements, your store connections and any child profiles. We decide how this data is used, independently of the stores where you use TryYourSize.

Contact for privacy: privacy@tryyoursize.com. [Data Protection Officer: NAME / CONTACT, if one is appointed.]

For counsel: Decision F8: TryYourSize is proposed as an independent controller of shopper accounts and bodies (like a wallet such as Shop Pay), not a processor of each store. Confirm. Also decide whether a DPO is required (Art. 37 GDPR, Art. 34 LOPDGDD) or appointed voluntarily, and whether a representative or EU establishment details need to be added.

2. When this policy applies

  • When you use the TryYourSize window on a store ("Find my size", "Size guide").
  • When you use my.tryyoursize.com (the Body app) or our website tryyoursize.com.
  • For brand users of Studio: section 14.

The store you are shopping on has its own privacy policy for what it does with your order and with the size it receives.

3. What we collect

DataWhere it comes fromRequired?
Email addressYou, to sign in with a one-time codeOnly for a saved profile
Body basics: height, weight, age (or birth year), body type used for the 3D bodyYouYes, to compute a size
Measurements: chest/bust, waist, hip and, if you add them, others (neck, inseam, …), and how precise each one isYou, with a tape measureYes, at least the essential ones
Your 3D body (a model computed from your measurements; no photo)Computed by usYes
Store connections: which stores you used TryYourSize on, when, and what each received (sizes)Created when you get a size on a live storeYes, for a saved profile
Sizes and size answers: the product, the size suggested and chosen, and the fit descriptionComputed by usYes
Child profiles: nickname, birth year, measurementsYou, as a parent or guardianOptional
Technical data: IP address, browser and device, the store page that opened the window, security and error logsYour deviceYes
Service statistics in the window, size guide and Body app: counts of steps (window opened, measurements completed, size shown, try-on opened, size used, first size in a new store) with the store, product category, language, device type and coarse timings. No identifier, IP address, email, measurement or size; counted on our servers, nothing stored on your deviceOur servers, from requests the service already makesYes (aggregated; you can object, section 8)
Usage analytics on tryyoursize.com and in Studio (pages, clicks) and error reports sent to PostHog from those sites, never with measurementsYour deviceOnly with your consent

We never ask for photos or videos of your body. Your 3D body is computed from the numbers you enter.

4. Your measurements: sensitive, voluntary and kept to you

Body measurements and weight are not a special category of personal data under the GDPR (they are not health data as we use them: we do not diagnose, assess or infer anything about your health). We know they feel personal, so we treat them as if they were sensitive:

  • Voluntary. You choose to measure. You can use TryYourSize without an account; then your measurements stay on your device and in short-lived calculations.
  • Only for your size. We use your measurements only to compute your sizes and the fit description, and to show you your body.
  • Never shared with stores. Stores receive the size, not the numbers. No store, brand or member of our staff has a way to read your body. A future option to share measurements with a store (for example for made-to-measure) would need your separate, explicit consent.
  • Not used for advertising and never sold.
  • Not used to judge you. We describe fit in physical terms only: centimetres of room, contact pressure (kPa) and fabric stretch (%).

For counsel: Confirm that measurements, weight and age, used only for sizing, fall outside Art. 9 GDPR (no health purpose, no inference), and decide whether to ask for explicit consent anyway as a safeguard. In particular weight, and the BMI that height and weight imply: if counsel considers them data concerning health (Art. 4(15), Art. 9), the body save would need an explicit-consent checkbox (Art. 9(2)(a)) next to the 16+ confirmation, and the "try without saving" path would need the same basis for the calculation. Today the only notices are "By continuing you accept the Terms and Privacy policy" at account creation and the 16+ confirmation (product decision 2026-10). The DPIA (docs/legal/dpia-outline.md) records this assessment.

5. What stores receive

When you get a size on a store, that store receives a size event: the product, the size, an ID for the size answer, and whether the size was verified or no size fits. The window tells you this where you sign in: "Stores see your size, never your measurements." The store uses the size on its own site (for example to select it in the size picker) and in its own analytics, under its own privacy policy.

Your connection to a store is listed in the Body app under Connected stores, and you can disconnect it at any time. The store is then told you disconnected, without any personal data, and stops receiving your sizes.

6. Why we use your data, and on what legal basis

PurposeLegal basis (GDPR)
Create and run your profile, sign you in, keep your bodies, compute sizes and fit, remember your store connections, send sign-in codes and export linksContract (Art. 6(1)(b)): the service you ask for under the Terms of Use
"Try without saving": compute a size from measurements you enter without an accountContract / steps at your request (Art. 6(1)(b))
Send the size to the store you are shopping onContract (Art. 6(1)(b)): it is the service you asked for on that store
Child profiles you createContract with you as the guardian, and your attestation of parental responsibility
Keep the service secure, prevent abuse, fix errorsLegitimate interest (Art. 6(1)(f)) in a secure, working service
Improve the size engine with aggregated, anonymous statisticsLegitimate interest (Art. 6(1)(f)); you can object (section 8)
Aggregated service statistics for the window, size guide and Body app (which steps are used, where people stop, how fast sizes arrive), counted on our servers with no identifier and no profileLegitimate interest (Art. 6(1)(f)) in knowing whether the service works and improving it; the counts cannot be linked to you, and you can object (section 8)
Usage analytics, and error reports sent to PostHog, on tryyoursize.com and in StudioConsent (Art. 6(1)(a) and Art. 22.2 LSSI); you can withdraw it at any time
Keep records we must keep (tax, answers to authorities, rights requests)Legal obligation (Art. 6(1)(c))

Automated decisions. The size suggestion is computed automatically. It is a recommendation; you choose the size you buy. It has no legal or similarly significant effect on you.

For counsel: Check the legal basis for (a) the size event disclosure to the store (contract vs. consent; the one-line notice is designed as information, not as a consent click); (b) child profiles; (c) engine improvement; (d) confirm Art. 22 GDPR is not triggered; (e) the server-side aggregated statistics on legitimate interest: a new random ID per event, no IP, no person profiles, only store / category / language / device class / surface / key mode / method / latency bucket (docs/tech/28 §5). Confirm the balancing test, whether the events are personal data at all (we think they are not, once sent), and that the request processing that produces them is covered.

7. How long we keep your data

DataHow long
Your profile, bodies and measurementsUntil you delete your account. [PROPOSED: profiles not used for 3 years are deleted after an email warning]
Previous versions of your body (each edit makes a new one)With your account; deleted when you delete it
Store connections and the consent text version you sawUntil you disconnect the store or delete your account
Sign-in codes10 minutes
Sign-in sessionsUp to 180 days, or until you sign out or delete your account
Try-on results (the garment simulated on a body, kept to show it again quickly)30 days without an account; 180 days after last use with an account; deleted with your account. They do not contain your body or measurements
Calculation files in storage7 days
Background job records (which can contain measurements while a job runs; encrypted by us, so our job-scheduling provider cannot read them)30 days
Data export files24 hours
Server and security logs30 days
BackupsAbout 30 days after deletion, then gone
Analytics events (consented, tryyoursize.com and Studio)[PROPOSED: 12 months]
Service statistics (aggregated, no identifier)[PROPOSED: 25 months]
Records of rights requests[PROPOSED: 3 years, to prove we answered]

For counsel: Decide the inactivity period, the analytics retention and the retention of rights-request records. Engineering note: account deletion also deletes the fitted-body files (bodies/) and try-on result files in storage (doc 24 §5).

8. Your rights, and how to use them

You can use most rights yourself, at once, in the Body app at my.tryyoursize.com:

RightHow
Access and portabilityYour data → Download my data: a ZIP with JSON and a spreadsheet (CSV) of your measurements
RectificationEdit your measurements; each change makes a new version of your body
ErasureYour data → Delete my account, confirmed with a fresh code. Sessions end at once; bodies, versions, connections and linked results are deleted; connected stores are told, without personal data
Objection and restrictionDisconnect a store; object to the use of your data for anonymous statistics by writing to us
Withdraw consent"Cookie settings" at the bottom of our pages, at any time; it does not affect what was done before

You can also write to privacy@tryyoursize.com from the email of your profile. We may ask you to confirm with a code. We answer within one month (extendable by two months for complex requests, and we will tell you).

You have the right to complain to the Agencia Española de Protección de Datos (www.aepd.es, C/ Jorge Juan 6, 28001 Madrid) or to the authority of the EU country where you live or work.

9. Age: 16 and over

You must be 16 or older to create your own profile, in every country. If you are younger, a parent or guardian can create a child profile under their own account: a nickname, a birth year and a short list of measurements, with no login and no photos. The guardian confirms they have parental responsibility. Stores never learn that a size was for a child, apart from the product being kidswear.

If we learn that someone under 16 created their own profile, we delete it.

For counsel: Decision F9: 16 everywhere (the highest Art. 8 GDPR threshold; Spain's is 14 under Art. 7 LOPDGDD). Confirm, and confirm the guardian attestation for child profiles.

10. Who we share data with

  • Stores: your size only, as in section 5.
  • Service providers that host and run TryYourSize for us, under contracts that bind them to our instructions: listed on /legal/subprocessors/.
  • Authorities, when the law requires it.
  • A buyer of our business, if that happens, under this policy.

We do not sell your data and do not use it for advertising.

11. Where your data is

Your data is stored in the European Union (Google Cloud, Belgium). Some providers are companies based in the United States; where they may access data from outside the EEA, we rely on the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses. Details per provider: /legal/subprocessors/.

12. Security

Encryption in transit and at rest, EU hosting, sign-in with one-time codes, no staff access to bodies, an audit trail of staff actions, and backups that expire. No system is perfectly secure; if a breach puts you at high risk, we will tell you without undue delay.

13. Cookies and storage

The window, the size guide and the Body app use only storage they need to work (your session, your language, a cache of your body and results) and no analytics cookies or identifiers, so they show no cookie banner; their statistics are counted on our servers (section 6). On tryyoursize.com and in Studio, analytics and error reports sent to PostHog run only after you agree; nothing is sent to PostHog before that, or if your browser sends Global Privacy Control. Error reports to our own servers carry no identifier and are kept with our server logs (30 days), for security and reliability. Details: Cookie and storage notice.

14. Brand users of Studio

If you use Studio for a brand, we process your name, email, role, sign-in events and actions in the audit log to run your organization's account, keep it secure and bill it (legal bases: contract with your organization and legitimate interest). Sign-in is provided by WorkOS and billing by Stripe or Shopify. The same rights apply; write to privacy@tryyoursize.com.

For counsel: G7 lists a separate "brand privacy notice"; this section is the short version. Decide whether a separate notice for brand users and B2B contacts (sales, marketing emails) is needed.

15. Changes

We will publish any change here with a new version number, and tell you by email or in the app before a significant change takes effect. Earlier versions stay available on request.

© 2026 TryYourSize Privacy PolicyCookie and storage noticeLegal notice