NailTry — Privacy Policy

Last updated: October 19, 2026

NailTry ("the App") is a Shopify app published by MAXICARDS, a French simplified joint-stock company with a sole shareholder (SASU) with a share capital of €1,000, registered with the Paris Trade and Companies Register under SIREN 935 408 351, 60 rue François 1er, 75008 Paris, France ("Maxi Cards", "we"). This policy explains what information the App collects when a merchant installs it, how it is used, and the rights of merchants and their customers.

Information about the merchant

• Shop domain, plan and app settings (button text, colours, limits).
• Usage figures: number of try-ons per day and per product, kept 90 days.

Information about the merchant's customers

• The hand photo the shopper chooses to upload, resized in the browser with location data (EXIF) removed. It is sent to Google's Gemini API only to create the preview and is never stored by us.
• The generated preview image, kept 30 minutes so it can be shown, then deleted.
• A random identifier created in the shopper's browser, which we store only as a one-way hash (no name, no e-mail, no IP address), to apply fair-use limits.

How we use it

Only to provide the App's features to the merchant, to bill the App through Shopify, and to keep the service secure. We never sell personal data, never use it for advertising, and never share it except as listed below.

Who else processes data

Shopify (the platform and its billing), and Fly.io, Inc. (servers in Paris, France) which hosts the App's servers and database.

• Google LLC (Gemini API, paid tier: inputs are not used to train Google's models): creates the preview image

Artificial intelligence

Previews are created by AI and are labelled "AI preview" in the storefront. Before taking or choosing a photo, the shopper is told what it is used for (this preview only, never stored; the preview is deleted after 30 minutes) and gets a link to this policy. Nothing is sent until they take or choose a photo.

How long we keep data

Data are deleted when the merchant uninstalls the App: Shopify sends a shop/redact request 48 hours after uninstalling, and we then erase everything about the shop. Customer erasure requests (customers/redact) are handled within 30 days.

Our role

For the merchant's own data, Maxi Cards is the controller. For data about the merchant's customers, the merchant is the controller and Maxi Cards processes them on the merchant's behalf.

Where data are stored

Our servers are located in the European Union. When a processor outside the EU is used, the transfer relies on the European Commission's standard contractual clauses or the EU-US Data Privacy Framework.

Security

Encrypted connections (HTTPS), access limited to what the App needs (Shopify permissions), access tokens kept only on our server and never shared, and webhooks checked with Shopify's signature.

Your rights

Under the GDPR you may ask to access, correct or erase your data, object to or limit their use, or receive them in a portable format. Customers of a shop should first contact the merchant; requests sent through Shopify reach us automatically. You may also complain to the French data protection authority (CNIL, www.cnil.fr).

Contact

Maxi Cards — fourelalexandre@maxicards.net