Privacy Policy

1. Who we are and how to reach us

Mera Software Pty Ltd is the data controller (under European and UK law) and the APP entity (under Australian law) responsible for the information described in this policy.

mera is based in Australia. If you are in the European Economic Area or the United Kingdom, you can contact us at the address above about anything in this policy, including your rights under the GDPR and UK GDPR.

2. Who this policy applies to

This policy covers shoppers and other individuals who open and use the mera Widget on any online store, whether or not you create a mera account.

If you are a retailer using the mera partner dashboard, our Partner Agreement governs your relationship with us and the information you give us about your business and your products. It also explains why shopper information is ours to look after rather than yours: we are the controller of it, and we are not the retailer’s processor.

3. What information we collect

We collect the following, and only the following:

• Photos. Two photos, one facing the camera and one from the side. You either provide them yourself, or you let the Widget use your camera and take them for you. Both are required, because a front view alone shows how wide you are and not how deep, and the Widget will not produce an estimate until it has both. They are used solely to estimate your body measurements, and as explained in section 4 they are analysed on your own device rather than sent to us. If you would rather not provide photos at all, you can decline and enter your measurements yourself instead.
• Body measurements. Numerical estimates derived from your photos, chest or bust, waist, hip, shoulders, inseam, together with quality indicators such as how confident the estimate is and whether the pose was usable.
• Height. A height you enter yourself, used to set the scale of the estimate.
• Date of birth. Used to confirm you meet the minimum age for the Widget (see section 14) and to improve fit modelling.
• Gender. The option you select, including “prefer not to say”. It is used to turn your photo measurements into a chest estimate, because chest shape differs by sex. “Prefer not to say” and “non-binary” use an average of the two.
• Fit preference and fit feedback. Whether you prefer a looser or closer fit, and any rating or size correction you give us afterwards.
• Account information (optional). If you choose to create a mera account, your email address and a password, which we store only as a cryptographic hash and never in readable form. An account lets you reuse your measurements on your next visit.
• Marketing consent records. If you tick the optional marketing box when creating an account, we record that you agreed, the exact wording you agreed to, the version of that wording, and the store you were on. We keep this as evidence of your consent, as privacy and anti-spam laws require.
• Purchase and returns outcomes. Where a retailer’s store passes it to us, the size you actually bought after seeing a recommendation, and whether you kept, returned or exchanged it. This is how we measure whether our recommendations are any good.
• Technical and usage data. A session identifier, a shopper identifier, the product you were viewing, which steps of the Widget you completed, your browser and device type (user agent), and your IP address, from which we may infer an approximate region. Your IP address is used for security and fraud prevention and is not used to build a profile of you.

Be aware: events we record about your use of the Widget are stored alongside your estimated measurements and an identifier for your session. We describe this data as pseudonymous rather than anonymous, on its own it does not name you, but it can be linked back to you, so we treat it as personal information and protect it accordingly.

We do not ask for, and do not want, your payment details, government identifiers, health records, or any information about your race, religion, politics, sexual orientation or trade union membership. Please do not send them to us.

4. Your photos and biometric information

Estimating body measurements from photographs may be treated as biometric processing under laws including the EU and UK GDPR, the Australian Privacy Act, the Illinois Biometric Information Privacy Act, the Texas Capture or Use of Biometric Identifier Act, the Washington My Health My Data Act, and the biometric provisions of several other US state privacy laws. We handle your photos on that basis, wherever you live.

What actually happens to your photos

1. You decide how the two photos are taken. You can choose two you already have. You can take two on the spot with your phone's own camera app. Or you can let the Widget use your camera, and it will take the two pictures for you. mera opens your camera only on that third path, only after you tap to start it, and only if your phone asks your permission and you agree. You can refuse, and the other two ways still work. We never look through your photo library.
2. If you let the Widget use your camera, this is what happens. Your phone shows a live view. Software running on your phone checks that view several times a second to work out where your body is, and tells you out loud and on screen how to stand. No person at mera sees that view, and no person is on the other end of it. Nothing from the live view is kept, saved or sent anywhere. Once you are in position it keeps a single picture for the front view, then a single picture for the side view. Those two are the only pictures kept, and they are handled exactly like two you chose yourself. The camera switches off as soon as it has them.
3. The analysis runs inside your own browser. Software loaded into the page locates body landmarks such as your shoulders and hips, and works out the measurements from them. Your photos are not uploaded to mera and are not sent to any other company.
4. Only the resulting numbers, your estimated measurements, are sent over an encrypted (HTTPS) connection to our servers. The photos themselves stay on your device and are discarded by your browser when you close or leave the Widget.
5. Because we never receive your photos, we cannot store them, and no retailer ever receives them.

Our commitments

• We analyse your photos, and collect the measurements derived from them, only after you have been told this policy applies and have chosen to continue. That is your explicit consent, and it is the only basis on which we do either.
• We never sell, lease, trade or otherwise profit from your photos, your measurements, or any biometric information derived from them. We never use them for advertising or profiling.
• We disclose your measurements only to the service providers listed in section 8, only to run the service, and never to the retailer whose store you are on. Your photos are disclosed to nobody, because we never hold them.
• We destroy them according to the published schedule in section 10, and sooner if you ask us to.
• You can withdraw your consent at any time by emailing us. Withdrawing consent does not undo processing that already happened, but it stops any further use and triggers deletion.

5. How we use your information, and our legal bases

Under the GDPR and UK GDPR we must have a lawful basis for each use. Under Australian law we must only use information for the purpose we collected it for, or a purpose you would reasonably expect. Here is each use, and the basis for it:

• To estimate your measurements and recommend a size. Your explicit consent for the biometric part (GDPR Articles 6(1)(a) and 9(2)(a)), and performance of our agreement with you for the rest (Article 6(1)(b)). We ask for that consent on its own screen in the Widget, before any photo is chosen or taken, and you can decline and type your measurements in instead.
• To save your measurements to your account, so you do not have to upload photos again. Only if you create an account, and on the basis of your consent.
• To improve the accuracy of our size and fit models, including by comparing what we recommended against what you bought and kept. Your consent for anything derived from your photos; our legitimate interest in a service that works (Article 6(1)(f)) for the rest.
• To send you marketing email, but only if you have separately ticked the box asking for it. Your consent, which you can withdraw from any email we send.
• To give the retailer aggregate analytics, such as how many shoppers used the Widget on a product and the overall spread of recommended sizes. Our legitimate interest, and the retailer’s, in understanding whether the tool works.
• To keep the service secure and prevent fraud and abuse. Our legitimate interest in protecting the service and its users.
• To meet our legal, tax and accounting obligations. Compliance with a legal obligation (Article 6(1)(c)).

Where we rely on a legitimate interest, we have weighed it against your rights and concluded it does not override them. You can object to that processing at any time, see section 12.

6. Automated processing

A size recommendation is generated automatically. It is a suggestion for your consideration: it does not decide anything about you, it has no legal or similarly significant effect, and you are free to ignore it and buy whatever size you like. We do not use your information to make automated decisions about credit, employment, insurance, pricing, or access to any service.

If you think a recommendation was wrong, you can tell us so in the Widget, and you can email us to ask a person to look at it.

7. What the retailer sees

The store you are shopping on receives:

• Aggregate, product-level analytics, for example, how many shoppers opened the Widget on a product and how many recommendations were produced.
• Where an order follows a recommendation, the size we recommended for that order, so the retailer can see whether the tool is helping. Because the retailer already knows who placed that order, please assume the retailer can connect the recommended size to your order.

The retailer never receives your photos, your date of birth, your account details, or your individual body measurements.

8. Who else processes your information

We share information only with service providers who need it to run the service. Each is bound by a written agreement, may only act on our instructions, and may not use your information for its own purposes.

• Supabase (United States and European Union regions), database and account authentication hosting.
• Vercel (United States, with our application hosted in the Sydney region), application hosting and content delivery.
• Shopify (Canada and United States), where the store you are on runs on Shopify, order and refund information reaches us through Shopify so we can measure recommendation accuracy.

We may also disclose information where the law requires it, for example in response to a valid court order, or to establish or defend a legal claim. If mera is ever sold or merged, information may transfer to the buyer, who would remain bound by this policy or give you notice before changing it.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined by the California Consumer Privacy Act and comparable US state laws. We have not done so in the preceding twelve months.

9. Sending information overseas

mera is based in Australia and some of our providers are in the United States, the European Union and Canada. This means your information may be stored or processed outside the country you live in.

Before disclosing personal information overseas we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, as Australian Privacy Principle 8 requires. For transfers out of the European Economic Area or the United Kingdom we rely on the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, together with additional technical measures including encryption in transit. You can ask us for a copy of these safeguards.

10. How long we keep things, and when we destroy them

This is our retention and destruction schedule. We publish it because biometric privacy laws require it, and because you are entitled to know.

• Photos: never received or stored by mera. Your browser holds the two pictures only while you are using the Widget, and discards them when you leave. If you let the Widget use your camera, the live view the software reads while guiding you is never kept at all.
• Measurements and biometric information, if you do not have an account: destroyed no later than 24 months after your last interaction with the Widget.
• Measurements and biometric information, if you have an account: kept while your account is open, and destroyed at the earlier of 30 days after you ask us to delete them, or 3 years after your last interaction with the Widget.
• Fit feedback: kept for up to 24 months to measure accuracy, then deleted.
• Purchase outcomes: kept for up to 24 months to measure accuracy. After that, we remove the details that link the record to you, so no individual remains identifiable. The order line itself stays on the 7 year clock below as an accounting record, with no person attached to it. We do the same, sooner, if you ask us to delete your information, or if the retailer asks us to erase a customer or removes our app from their store.
• Marketing consent records: kept for 6 years after you withdraw consent, because we are required to be able to prove what you agreed to and when.
• Biometric consent records: kept for 6 years from the day you give consent. This is the record of the exact words you were shown before your photos were read, and the date you agreed to them. We are required to be able to prove it, so it outlives the measurements it covers. It holds no photograph and, unless you were signed in at the time, no name or address.
• Billing, tax and accounting records: kept for 7 years, as Australian law requires. These concern retailers, not shoppers.

In every case, if the purpose we collected something for has been satisfied sooner, we destroy it sooner. If you ask us to delete your information we will do so within 30 days, except for the narrow categories above that we are legally required to keep.

11. Security and data breaches

We protect your information with encryption in transit (TLS), access controls that limit who on our team can reach what, hashed passwords, and regular reviews of our systems. No method of transmitting or storing information is completely secure, and we cannot guarantee absolute security.

If a breach occurs that is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme. Where the GDPR or UK GDPR applies, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, and notify you directly where the risk to you is high.

12. Your rights

Wherever you live, you can ask us to:

• Tell you what personal information we hold about you, and give you a copy.
• Correct anything that is wrong or out of date.
• Delete your information.
• Stop or limit a particular use of it.
• Send your information to you, or to another provider, in a portable format.
• Withdraw a consent you previously gave, including consent to biometric processing.

Email privacy@mera.software to exercise any of these. We will respond within 30 days, and we will not charge you or treat you any differently for asking. We may need to confirm your identity first, so that we do not hand your information to someone else.

If you have a mera account, you can get your copy yourself. Open the profile page from the Widget and choose Download my information. That gives you a file holding your measurements, your size history, the recommendations you bought from and the permissions you gave us, in a format you can keep or hand to another provider. We hold no photograph of you, so there is none to include. If you do not have an account, or you would rather a person put it together, use the email address above.

If you have a mera account, you can also delete it yourself. Open the profile page from the Widget and choose Delete my information. That removes your measurements, your size history and your account, and you will not be able to sign in again. We complete it within 30 days and usually within a day. If you do not have an account, or you would rather we did it, use the email address above.

If you are in Australia

These rights come from the Australian Privacy Principles. If you are unhappy with how we have handled your information or your request, please tell us first so we can try to fix it. If you are still unsatisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

If you are in the European Economic Area or the United Kingdom

These rights come from the GDPR and UK GDPR, including the rights of access, rectification, erasure, restriction, portability, and objection to processing based on legitimate interests. You also have the right to complain to your national data protection authority, or to the UK Information Commissioner’s Office at ico.org.uk.

If you are in California

You have the rights to know, delete, correct, and to opt out of sale or sharing, although as stated in section 8 we do not sell or share your personal information. Because we treat your photos and measurements as sensitive personal information, you also have the right to limit our use of it; we already limit that use to producing your size recommendation and improving accuracy, and to nothing else. We do not discriminate against you for exercising any right. You may use an authorised agent to make a request on your behalf.

If you are elsewhere in the United States

Residents of states with comprehensive privacy laws, including Colorado, Connecticut, Virginia, Texas, Oregon, Washington and others, have comparable rights to access, correct, delete and port their information, and to appeal if we refuse a request. To appeal, reply to our decision and we will review it and explain the outcome in writing.

If you are in Canada or Brazil

You have rights of access and correction under PIPEDA, and rights of access, correction, deletion, portability and information about sharing under the LGPD. Use the same email address above.

13. Cookies and similar technologies

The Widget uses a small amount of browser storage, such as localStorage and a session cookie, to remember where you are in the process and to keep you signed in if you have an account. This storage is strictly necessary to provide the service you asked for.

We do not use advertising cookies, third-party trackers, or cross-site tracking of any kind. A session identifier may be used to connect your use of the Widget to a resulting order, so we can measure whether the recommended size was the size that worked.

Because we do not sell or share personal information, there is nothing for a Global Privacy Control or Do Not Track signal to opt you out of. We honour those signals as an opt-out of any future sale or sharing.

The retailer’s own website may set its own cookies, which are governed by that retailer’s privacy policy, not this one.

14. Children and young people

The Widget is not for children under 13, and we ask for your date of birth to check. We do not knowingly collect personal information from anyone under 13, in line with the United States Children’s Online Privacy Protection Act.

In the European Economic Area and the United Kingdom, the minimum age for consenting to online services without a parent varies between 13 and 16 depending on the country. If you are under the age that applies where you live, please only use the Widget with your parent’s or guardian’s permission.

If you believe a child has given us information, email us and we will delete it promptly.

15. Changes to this policy

We may update this policy. When we do, we will change the date at the top of this page. If a change materially affects how we handle your information, for example, a new purpose or a new category of recipient, we will tell you before it takes effect and, where the law requires it, ask for your consent again.

16. How to complain

If you have a concern about how we handle your information, email privacy@mera.software. We will acknowledge you within 5 business days and give you a substantive answer within 30 days.

If you are not satisfied with our answer, you can complain to your privacy regulator: the Office of the Australian Information Commissioner (oaic.gov.au) in Australia, the Information Commissioner’s Office (ico.org.uk) in the United Kingdom, or your national data protection authority in the European Economic Area.