Privacy Policy

Last updated: 9 September 2026

Virtual Change Room ("we", "us") is an AI try-on service. This policy explains what we collect, why, and what we never do with it. The short version: your photos are yours, they are private by default, and we do not sell your data.

Who we are

Virtual Change Room (ABN 59 359 846 570) is a registered business name of an Australian business, and we are the data controller for the personal information described here. Write to us at PO Box 2300, Rosebud VIC 3939, Australia, or email support@virtualchangeroom.app.

What we collect

Account details: your name, email address, and password (stored hashed, never in plain text).
Your date of birth. We ask for it when you sign up and use it to apply our age rules - who can have an account, which AI models are available, and who can publish a share link. We keep the full date rather than just your age so the rules stay correct as you get older, and we use it to send you a birthday gift of credits if that offer is running. It is not shown to anyone else.
Your content: the photos you upload, the outfit images you add, and the looks and videos the service generates for you.
Billing records: your credit balance, purchases, and subscription status. Card details are handled entirely by Stripe on their secure checkout - we never see or store your card number.
Device tokens: if you install our mobile app and allow notifications, we store a device token so we can send you push notifications. You can turn notifications off at any time in your device settings.
Service records: sign-in sessions, and technical logs needed to run and secure the service. These include your IP address and browser or device description.
Image fingerprints: a short mathematical summary of each image, used to recognise a picture that has been reported and taken down. See "Reporting and image fingerprints" below.

Your photos and looks are private

Everything you upload or generate is private to your account. There are no public galleries and no public links to your images unless you create one yourself. Files are stored outside the public web space and served only to your authenticated account. Our support staff can access files solely to operate the service and help you with a problem; access is logged.

To generate a look, your images are sent to the AI infrastructure that powers the service and processed there. They are used to produce your result, not to build a public gallery, and we do not sell or license your images to anyone.

We do not scan or classify your photos ourselves. The AI providers we use apply their own safety filters and may refuse to generate from an image; when that happens we are told the request was refused, and we pass that on to you. Beyond that, content is reviewed by a person only when somebody reports it.

Cookies and analytics

We use cookies that are strictly necessary to run the service - keeping you signed in, remembering your consent choice, and keeping the site secure. These do not need your consent and cannot be turned off without breaking the service. The cookie that remembers your consent choice is called ez-consent, lasts 12 months, and is shared across virtualchangeroom.app and its subdomains so you are not asked the same question twice.

We also measure how the service is used, with Google Analytics, and that measurement starts when you arrive rather than waiting for you to opt in. We use it to see which features people actually use, where they get stuck, and what to improve - not to build advertising profiles about you, and not to follow you around other websites. We do not sell this information, and we do not use it to serve you ads.

Advertising and ad-personalisation signals are switched off by default and stay off unless you turn marketing cookies on. We use Google Consent Mode, so your choice is passed to Google rather than merely applied on our side. If you are visiting from a region where consent is required before any measurement, nothing is measured until you answer the banner.

You can turn analytics off at any time from the cookie settings on the site, and signed-in users can also manage it under Account then Privacy. Switching it off takes effect immediately and stops measurement for the rest of your visit and every visit after it. You can also block or delete these cookies in your browser, or install Google's own opt-out add-on, without losing access to any part of the service.

When you create an account or complete a purchase, we may send Google a record of that event together with an identifier for your browser and a randomly generated account identifier, so that we can tell which marketing efforts work. It does not include your name, email address or any of your images, and it is marked as not for ad personalisation.

Reporting and image fingerprints

Anyone can report an image without an account. If you send a report we collect the email address you give us and whatever you tell us about the image, and we use them only to investigate the report and reply to you. If we uphold a report, we record a fingerprint of the image: a short mathematical summary derived from the picture, which lets us recognise the same picture if it is uploaded again. A fingerprint is not an image and the image cannot be reconstructed from it.

Fingerprints are kept for as long as the block needs to hold, which means they can outlive the account the image came from and the deletion of the image itself. That is deliberate: a fingerprint that disappeared with the image would let a taken-down picture be re-uploaded the next day.

Who we share it with, and where it goes

We do not sell your personal information. We share it only with the service providers we need to run Virtual Change Room, and only so they can perform that service for us:

AI image generation - your uploaded photos and the generated results are processed by our AI infrastructure provider, located in the United States.
Payments - Stripe.
Email, SMS and push notifications - our messaging providers, and Google (Firebase) for push.
Hosting and file storage - our application runs on servers in Australia, and your images are stored in an access-controlled object store in the Oceania region.
Analytics - Google, as described above.

Because several of these providers operate overseas, your information - including the images you upload - may be stored or processed outside Australia. We take reasonable steps to ensure it is handled consistently with this policy and with Australian privacy law wherever it is processed, and we only use providers who commit to protecting it.

How long we keep it

We keep your account details and your content for as long as your account is open. We do not delete your looks on a timer; they stay until you delete them or close your account.

When you delete a look, a video or a photo, it is gone from your account straight away and cannot be restored. Because your images sit on our servers and on the servers of the providers who process them for you, the copies take a little longer to disappear everywhere: we erase them within 30 days.

After the images are gone we keep a technical record of the generation itself for up to 12 months. It contains no photographs - only details like when it ran, whether it succeeded or failed, why it failed, how long it took and what it cost. We keep it to investigate faults, to answer billing questions, to detect fraud and abuse, and to make the service more reliable.

Our operational records have their own limits:

Sign-in sessions - 90 days, then deleted. These hold the IP address and device description of each sign-in.
Error logs - 90 days, then deleted.
The security and audit trail - 2 years. This is the record of what was done on an account and by whom, so it needs to outlast the disputes it may have to settle.
Messages you send us through a form on the site - 12 months, then deleted.

Some things are kept for longer where the law requires it, or where we are asked to preserve them:

Billing and transaction records - Australian tax law generally requires financial records to be kept for five years.
Content reported or flagged for breaching our terms, kept as the record of that decision.
Records of your unsubscribe and opt-out choices, kept indefinitely, because the only way to keep honouring "do not contact me" is to remember it.
Anything covered by a legal request. If we receive a lawful request from a law-enforcement agency, a regulator or a court, or if we need to establish or defend a legal claim, we may be required to preserve the relevant data - including images you have deleted - and we will keep it until we are no longer required to. In that situation a deletion or account-closure request may be paused or partly refused, and the law may prevent us from telling you.

Deleting your content and your account

You can delete any look, video or photo at any time from your feed. Deletion is permanent - it cannot be undone - and the stored images are erased within 30 days as described above.

You can request deletion of your whole account from Account then Privacy. There is a 30-day cooling-off period before we act on it, so a request made in a bad moment can be withdrawn. After that a person carries out the erasure: your name and email are replaced with anonymous values, your date of birth is removed, your password, sign-in methods and sessions are deleted, and your photos, looks, videos and their stored files are erased. Once done it cannot be reversed.

A few things deliberately survive that erasure, because removing them would cause harm rather than prevent it:

Your unsubscribe and opt-out records, so we do not start contacting you again.
Our security and audit trail, including the IP addresses and device descriptions in it, kept as the record of what happened on the account.
Content held under a legal request or preserved as the record of a safety decision.
Image fingerprints of anything taken down after a report.

You can also request a copy of your data from the same page. We build it automatically and email you a link; the download expires after 7 days.

Legal requests

We may receive requests from law-enforcement agencies, regulators or courts to disclose or preserve account data. We check that each request is lawful and properly served, and we give only what it actually covers. Where we are permitted to tell you about a request, we will; sometimes the law prevents us.

Children

Virtual Change Room is not for children. You must be at least 16 to have an account, and we ask for your date of birth at sign-up to apply that rule. If we learn that we hold personal information about someone below that age, we delete it and close the account. If you believe a child has an account, or that an image of a child is on the service, tell us at support@virtualchangeroom.app or report the image.

Emails

We send transactional email (account confirmation, receipts, security notices, and the outcome of a report you have made). Marketing email only ever goes to people who opted in, and every marketing email has a working unsubscribe. Unsubscribing stops marketing and automated messages; it does not stop the transactional ones, because those are how we tell you about your own account.

Keeping it secure

We protect your information with measures appropriate to how sensitive it is, including encrypted connections, hashed passwords, private-by-default file storage and logged staff access. No service can promise perfect security, but if a data breach occurs that is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

Your rights

You can request a copy of your data, correct it, or ask for it to be erased, from Account then Privacy or by contacting support@virtualchangeroom.app. Your date of birth is the one detail you cannot change yourself, because our age rules depend on it; contact us if it is wrong. If you are unhappy with how we have handled a privacy matter, you can complain to us first and then, if you are still not satisfied, to the Office of the Australian Information Commissioner.

Changes

We may update this policy. If a change materially affects how we handle your information, we will tell you in the app before it takes effect.

Contact

Privacy questions: support@virtualchangeroom.app.