VIRTUE MIRAGE — PRIVACY POLICY

Issued by: Virtue Mirage Pty Ltd ABN: 16 697 834 343 ACN: 697 834 343 Contact: hello@virtuemirage.com.au Registered office: Sydney, Australia

Effective from: [DATE] Last updated: [DATE]

This Privacy Policy explains what personal information we collect when you use the Virtue Mirage service, how we use and protect it, and the rights you have over it.

Virtue Mirage is operated by Virtue Mirage Pty Ltd (ABN [TO INSERT]), an Australian company, of [registered address] ("we", "us", "our"). Where used in this Policy, "you" means a shopper interacting with Virtue Mirage through a participating fashion brand's online store.

If you are a fashion brand using Virtue Mirage to power your storefront, see the separate Brand Service Agreement for terms covering your processing relationship with us.

TL;DR — the privacy promise in five points

1. Your uploaded photographs are deleted immediately after we generate your Digital Twin. They are never stored, never retained, never shared.
2. We do not sell your personal information. Ever. To anyone.
3. We do not use your data to train AI models — yours or anyone else's.
4. Your identity is hashed. We refer to you internally by a one-way cryptographic hash of your email address, not by your email itself.
5. You can delete everything we hold about you, at any time, by emailing hello@virtuemirage.com.au — usually within minutes.

The rest of this document is the formal version of those five points, plus everything required by Australian Privacy Principles, the EU GDPR, the UK Data Protection Act, the California Consumer Privacy Act, and equivalent regimes.

1. What information we collect

We collect three categories of information.

1.1 Information you provide

1.2 Information generated about you

1.3 Information collected automatically

We do not use cookies for tracking or advertising. We use the minimum technical state necessary to keep you logged into the brand's storefront and to remember your Mirror Mode preference.

2. Why we use your information (legal bases)

Where the GDPR or UK GDPR applies, we rely on the following lawful bases:

Under the Australian Privacy Act and APPs, we collect biometric and sensitive information only with your express consent and only for the primary purpose of generating your Digital Twin.

3. How long we keep your information

When you request deletion, every category above is removed within 30 days, with the single exception of audit logs that we are required by law to retain (e.g. tax records related to billing the brand) — these are anonymised so no identifying information remains.

4. Who we share your information with

We do not sell, rent, or trade your personal information.

We share information only in the following limited circumstances:

4.1 With the brand you shop on

The brand sees the basic profile fields needed to display your Digital Twin in their store: a reference to your Digital Twin, your measurements (so they can recommend sizes), your consent preferences, and the rendered try-on images. The brand never sees your raw uploaded photographs (we never had them past generation), your email address in plaintext (only the hash), or any data from other brands.

4.2 With other brands on the Cross-Brand Network — default-on with informed consent

Your Digital Twin's identity is portable across every brand on the Virtue Mirage network by default. This is clearly disclosed during onboarding via a pre-ticked checkbox that you can untick before your avatar is generated. When you visit another participating brand, they automatically see your Digital Twin without you re-uploading photos. The brand still does not see your email address in plaintext.

We made portability the default because it benefits you (no re-uploading, no fragmented profiles across stores) and avoids data fragmentation (multiple drifting avatars under the same email).

You can revoke this consent at any time, either by visiting your account page at virtuemirage.com.au/customer/measurements or by emailing hello@virtuemirage.com.au. Revocation takes effect immediately for new render requests; existing rendered images on participating brands are removed within 7 days.

4.3 With our service providers ("sub-processors")

We use a small number of trusted infrastructure providers to deliver the service. We require each one to apply security and privacy standards equivalent to ours.

Each of these processes your data only on our instructions. None of them uses your data to train AI models or to build a profile of you. Google's enterprise terms expressly preclude training-data use of inputs to Vertex AI / Gemini.

We do not use any consumer-grade or non-enterprise AI service to process your data.

4.4 With legal authorities

We disclose information to law-enforcement or regulatory authorities only when required by a valid legal order (warrant, court order, subpoena, regulatory request) and only to the extent legally compelled. We will, where lawful and practical, notify you before disclosure.

4.5 In a business transaction

If our business is acquired or merged with another entity, your information may be transferred to the successor entity, subject to the same privacy protections. You will be notified of any such transfer.

5. International transfers

Virtue Mirage is operated from Australia, but our infrastructure currently runs on Google Cloud in the United States (us-central1 region). This means your personal information is transferred to and processed in the United States.

5.1 Safeguards for EU / UK transfers

For transfers of personal data from the European Economic Area, United Kingdom, or Switzerland, we rely on:

• the Standard Contractual Clauses issued by the European Commission (Decision 2021/914), and
• the equivalent UK International Data Transfer Addendum (IDTA).

Google LLC, our primary sub-processor, is certified under the EU–U.S. Data Privacy Framework, the UK Extension to it, and the Swiss–U.S. Data Privacy Framework — providing a valid adequacy basis for transfers as of [DATE].

A copy of the relevant Standard Contractual Clauses is available on request to hello@virtuemirage.com.au.

5.2 Safeguards for Australian transfers

Under APP 8 of the Australian Privacy Act, we take reasonable steps to ensure overseas recipients of personal information do not breach the APPs. Our agreements with Google require equivalent privacy protections to those imposed under Australian law.

5.3 Other regions

If you are accessing Virtue Mirage from a country other than those listed above, your information may be transferred to and processed in countries different from your own. By using the service, you consent to such transfers in accordance with this Policy.

6. Security

6.1 We implement industry-standard technical and organisational measures appropriate to the sensitivity of the information we process, including:

• Encryption in transit using TLS 1.2+ for all communications between your browser and our infrastructure;
• Encryption at rest for all stored data (Google Cloud default encryption);
• Cryptographic identity hashing (SHA-256) so we never store your email in plaintext;
• Memory-only photograph processing — uploaded photos are never written to disk;
• Principle of least privilege access controls for any human inside Virtue Creative who can administer the service;
• Regular dependency and vulnerability scanning of our code base.

6.2 No system is perfectly secure. While we apply the protections above, we cannot guarantee absolute security of any information you transmit to us. In the event of a security incident affecting your personal information, we will notify you and the relevant regulators in accordance with our legal obligations (within 72 hours under GDPR Article 33 where the breach is likely to result in a risk to your rights and freedoms).

7. Your rights

Your rights vary slightly by jurisdiction. In every region, you have at minimum:

7.1 Right to access

You may ask us to confirm whether we hold any personal information about you and, if so, to provide you with a copy. We respond within 30 days. The first request in any 12-month period is free; further requests may attract a reasonable fee.

7.2 Right to correction

You may ask us to correct any personal information that is inaccurate, out of date, or incomplete. This includes your measurements, which can also be updated through your brand's storefront where supported.

7.3 Right to deletion ("right to be forgotten")

You may ask us to delete your personal information. We honour this request within 30 days. Deletion removes your Digital Twin, all try-on images, all pre-rendered images across every brand on the network, and the customer record itself. Audit logs are anonymised.

7.4 Right to withdraw consent

You may withdraw any optional consent at any time. Withdrawing the consent for service use means we delete your Digital Twin.

7.5 Right to data portability (EU/UK)

Where technically feasible, we will provide your personal information in a structured, commonly used, machine-readable format on request.

7.6 Right to object / restrict processing (EU/UK)

You may object to processing based on our legitimate interests, and you may ask us to restrict processing where you contest its accuracy or where you have objected to it.

7.7 Right to lodge a complaint

If you believe we have mishandled your personal information, you have the right to lodge a complaint with the relevant supervisory authority:

• Australia — Office of the Australian Information Commissioner, www.oaic.gov.au, 1300 363 992
• EU — your local Data Protection Authority (list at www.edpb.europa.eu)
• UK — the Information Commissioner's Office, www.ico.org.uk, 0303 123 1113
• California — California Privacy Protection Agency, www.cppa.ca.gov
• Singapore — Personal Data Protection Commission, www.pdpc.gov.sg

We ask that you contact us first at hello@virtuemirage.com.au so we have an opportunity to address your concern directly.

7.8 Right to know what's collected (California)

California residents have the right under the CCPA / CPRA to know what categories of personal information we collect, the sources, the business purpose, and the categories of third parties with whom we share it. The relevant disclosures are in Sections 1, 2, and 4 of this Policy.

7.9 Right to opt out of "sale" or "sharing" (California)

We do not sell your personal information. We do not "share" your personal information for cross-context behavioural advertising. There is therefore no "opt out" required because there is nothing to opt out of. If our practices ever change, we will provide a "Do Not Sell or Share My Personal Information" link on our marketing site and notify you.

7.10 Right to limit use of sensitive personal information (California)

California residents have the right under the CPRA to limit our use of "sensitive personal information" (which includes biometric information). We already limit our use of biometric information to the single purpose of generating your Digital Twin and discard the original photographs immediately. No additional opt-in or opt-out applies.

8. Children

The service is not directed at and not available to anyone under 18 years of age. We do not knowingly collect personal information from minors. If you become aware that a minor has used the service, please contact us and we will delete the information immediately.

9. AI training disclaimer

We do not use your personal information — your photographs, your Digital Twin, your measurements, your try-on history, your behaviour, or any derivative of these — to train any AI model, ours or anyone else's. We use Google's Vertex AI under enterprise terms that expressly preclude the use of customer inputs to train Google's foundation models. We do not share your information with any other AI provider.

We may, in aggregate and after stripping all identifying information, use anonymised metadata (e.g. "Brand X had a 30% avatar adoption rate in Q3") to improve our product and our marketing. This anonymised metadata cannot be linked back to you.

10. Data Protection Officer / Privacy contact

You can reach the person responsible for privacy at Virtue Mirage at:

• Email: hello@virtuemirage.com.au (subject: "Privacy Request")
• Postal: Privacy Officer, Virtue Mirage Pty Ltd, [registered address], Australia

For EU residents who need a point of contact in the European Union, we will appoint a Representative under GDPR Article 27 once we cross the Article 27(2) threshold. Until then, all enquiries should be directed to the email address above.

11. Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices or in applicable law. Material changes will be communicated to you by email (where you have provided one) and posted on our marketing site at virtuemirage.com.au/privacy.

We will not reduce your rights under this Policy without your explicit consent. Continued use of the service after a material change is deemed acceptance of the updated Policy.

12. Specific country addenda

12.1 California (USA) — CCPA / CPRA disclosures

In the 12 months preceding the date of this Policy:

• Categories of personal information collected: identifiers (email hash), commercial information (try-on history), biometric information (photographs, momentarily; avatars, durably), internet activity (browser, page visited), geolocation (approximate region), inferences (size recommendation).
• Sources: the consumer (you), the brand whose storefront you used.
• Business purposes: delivering the service, security, fraud prevention, compliance with legal obligations.
• Categories of third parties with whom information was shared: the brand whose storefront you used, our sub-processors (Section 4.3).
• Sale of personal information: none.
• "Sharing" of personal information for cross-context behavioural advertising: none.

12.2 European Union / United Kingdom — GDPR / UK GDPR disclosures

Our lawful bases for processing are set out in Section 2. Your rights are in Section 7. International transfer safeguards are in Section 5.

We do not engage in fully automated decision-making that produces legal or similarly significant effects on you within the meaning of GDPR Article 22.

12.3 Australia — APPs

Our handling of personal information complies with the Australian Privacy Principles set out in Schedule 1 of the Privacy Act 1988 (Cth). Biometric / sensitive information is processed only with your express consent (APP 3.4).

12.4 Canada — PIPEDA

Canadian residents have the right to access, correct, and request deletion of their personal information consistent with the Personal Information Protection and Electronic Documents Act. Our practices in this Policy meet PIPEDA requirements.

12.5 Brazil — LGPD

Brazilian residents have rights equivalent to those described in Section 7 under the Lei Geral de Proteção de Dados (LGPD). We do not currently appoint a DPO under Article 41 because we are below the relevant threshold, but our Privacy Officer (Section 10) serves the equivalent function.

12.6 Singapore — PDPA

Singapore residents have rights under the Personal Data Protection Act. Our processing of your personal data complies with the PDPA's Consent, Purpose Limitation, Notification, Access & Correction, Accuracy, Protection, Retention Limitation, Transfer Limitation, and Data Breach Notification obligations.

13. How to contact us

• General questions: hello@virtuemirage.com.au
• Privacy / data subject requests: hello@virtuemirage.com.au (subject: "Privacy Request")
• Legal notices: Privacy Officer, [registered legal address], Australia
• Postal mail: as above

We aim to acknowledge any contact within two business days and to fully resolve any privacy request within 30 days, subject to verification of your identity.

This Privacy Policy was last updated on [DATE]. Earlier versions are available on request.