Last updated: 2 October 2026 · Version 2.0

This Biometric Notice is CATCHES Limited's public written policy on biometric data, including our retention schedule and our guidelines for destroying biometric data. It supplements the CATCHES User Privacy Policy. Questions: [email protected].

1. What we collect

When you upload a photograph, our VTO engine derives measurements of your body geometry and proportions from it. We use these to build a digital model of you (your "digital twin") that shows how garments fit you. Some laws treat this as a "biometric identifier" or "biometric data", such as a scan of face or body geometry. Whatever the legal classification, we treat it as biometric data.

We do not use biometric data to identify you, to recognise your face, to authenticate you, or to infer your age, ethnicity or health.

2. Why we collect it

Only to create the virtual try-on result you ask for and, if you have an account and choose to keep your digital twin, to let you reuse it.

3. Your consent

Before we collect any biometric data, we:

  1. tell you in writing that biometric data will be collected and stored;
  2. tell you in writing the specific purpose and how long we will keep it; and
  3. ask for your written consent, given by ticking a box, which is your electronic signature.

The system cannot process your photograph without this consent. We keep a record of each consent (date, time, wording version and what you agreed to) for at least 5 years. If you have not interacted with us for 24 months, we will ask for your consent again before using any biometric data.

4. Retention and destruction schedule

We permanently destroy biometric data at the earliest of:

Event When we destroy it
No account: purpose fulfilled 30 days after your last interaction with the Service
You withdraw consent or delete your account Within 30 days
Account inactive 24 months after your last interaction
Annual review finds it is no longer needed Within 45 days of that review
A shorter period required by the law where you live That shorter period (for Texas residents, no later than one year after the purpose ends)

We destroy it by deleting it from live systems. Backup copies are overwritten within 35 days. We review our retention of biometric data at least once a year.

5. Withdrawing consent

You can withdraw consent at any time in your account settings, in the VTO Widget, or by emailing [email protected]. We then delete your biometric data, photographs and measurements within 30 days. Your account can remain, and photo features will work for single sessions only.

6. Disclosure