Translation. This is an English translation of the Portuguese original, version 1.0. If there is any difference between the two, the Portuguese text prevails.
Summary
- The face stays on the device. In the try-on, the camera or photo image is processed on the phone or computer of the person trying on. It is not sent to us or stored by us.
- We do not identify who tries on. We receive only usage events (opened, tried on, added to cart) with a random code.
- We do not store data about who buys in the connected stores: no name, no email, no phone number, no CPF, no address.
- About the optical store (our customer), we store account and billing data. The card number stays only with the payment processor.
- We do not sell data and we do not use data for third-party advertising.
- Your rights can be exercised by email at privacidade@domeo.com.br.
1. Who we are
This policy belongs to DOMEO TECNOLOGIA HOSPEDAGEM DE SITES E TRATAMENTO DE DADOS LTDA, CNPJ 70.130.429/0001-89, with its registered office at Rua Pais Leme, 215, conj. 1713, Pinheiros, São Paulo/SP, CEP 05424-150 ("Domeo"), which offers Domeo Try-On.
Privacy channel: privacidade@domeo.com.br.
Data protection officer: we do not appoint a data protection officer. Domeo is a small-scale processing agent and, under art. 11 of Resolution CD/ANPD No. 2/2022, serves data subjects and the ANPD through the privacy channel above.
2. Who this policy applies to
| You are | The role of Domeo | Where to read |
|---|---|---|
| Someone who uses the try-on on an optical store's website | Processor: we process the data on behalf of the optical store, which is the controller | Section 3 |
| Someone who visits or buys in a storefront created by Domeo for an optical store | Processor: the optical store is the controller | Section 4 |
| The optical store and its team (who uses the dashboard) | Controller | Sections 5 and 6 |
| Someone who visits the Domeo website | Controller | Section 7 |
When Domeo is the processor, the privacy policy that applies to you is the optical store's. This document explains what our system does, for you and for the store.
3. Who uses the try-on
3.1. The face
- The try-on only turns the camera on after you allow it, on a screen that explains the use.
- The camera image, the photo you choose, the face points and the calculated measurements are processed on your device.
- None of this is sent to our servers, and none of it is recorded by us.
- If you type your pupillary distance to adjust the size, the number is stored only in your browser. It is not sent.
- The files that make the try-on work (the engine and the frame models) are downloaded from our servers and from our delivery network.
3.2. What we receive
When the optical store turns usage measurement on, the try-on sends:
- usage events: the button appeared, the try-on opened, the camera turned on, the frame was changed, the item went to the cart, an error happened. The events carry no image, face points, measurements or pupillary distance;
- a random visitor code and a random visit code, created in your browser. They do not say who you are;
- the product and the type of page where the try-on opened;
- the device class: browser, system and type (phone or computer), without the full browser text.
If the optical store requires consent for measurement, the try-on only measures after the store records your consent.
3.3. Orders
From the connected stores, we read from each paid order: the order number, the products, the quantities, the amounts and the date, together with the random try-on code. This shows the optical store how many sales came after a try-on. We do not read or store the name, email, phone number, CPF or address of who buys.
3.4. Technical logs
Like every internet service, our servers log access. The full IP address stays in these logs for up to 7 days, for security. After that, only the masked IP (without the ending) remains, for up to 90 days. The try-on event database does not store IP.
3.5. What stays in your browser
| Where | What | What for |
|---|---|---|
| Browser, at the try-on address | that you have already allowed the camera in this visit | not asking again |
| Browser, at the try-on address | the pupillary distance you typed and the tips already seen | keeping the adjustment |
| Browser, at the store address | the random visitor code | counting try-ons and visits, when measurement is allowed |
The try-on does not use advertising cookies.
4. Who visits or buys in a storefront
In the storefront, the optical store is the seller and the controller of the data.
- Purchase by WhatsApp: the conversation happens on the optical store's WhatsApp. Domeo does not receive the conversation or your phone number.
- Sign-up and order on the site, when the optical store offers it: name, email, phone number and address, stored so the optical store can fulfil the order.
- In your browser: the chosen store, the favourites and the cookies needed for the cart and to keep your session.
- Technical measurement: device data without identification (language, screen, browser and system), stored for 60 days, without IP.
- The postal code you type to find the nearest store is used only in your browser.
5. The optical store and its team
5.1. Data we process
| Data | Where it comes from |
|---|---|
| Name, email, password (stored irreversibly), language, security factors (second factor and passkey) | Sign-up |
| Sessions: date, part of the IP and browser summary (for example, "Chrome / Windows") | Use of the dashboard |
| Log of actions in the account (who did what and when) | Use of the dashboard |
| Email of whoever is invited to the team | The optical store itself |
| Name or corporate name, CPF or CNPJ, billing email, phone number and address | Billing data |
| Card reference created by the payment processor. We do not receive the card number | Payment processor |
| Record of the acceptance of the terms: account, store, date and time, full IP address, browser, version and cryptographic digest of each document | Contracting |
| Support messages (dashboard, email and WhatsApp) | Support |
| Catalogue of the connected store (products, photos, variants, prices) and paid orders without buyer data | Store platform, with the optical store's authorization |
5.2. What for and on what legal basis
| Purpose | Legal basis (LGPD) |
|---|---|
| Creating the account, providing the service, billing and giving support | Performance of contract (art. 7, V) |
| Issuing invoices and keeping tax and access records | Legal obligation (art. 7, II) |
| Keeping the proof of acceptance of the contract | Regular exercise of rights (art. 7, VI) |
| Security, fraud prevention and improvement of the service | Legitimate interest (art. 7, IX) |
| News and offers by email, when there are any | Consent or legitimate interest, with the option to opt out in every message |
6. Studio
- The optical store sends photos of frames, without people. The system asks for this confirmation and refuses the generation without it.
- The photos are re-saved without the embedded data (such as location and device).
- To generate the images and the 3D models, the photos and the instructions are sent to artificial intelligence and 3D modelling providers (section 8).
- The people who appear in the Studio images are generated by artificial intelligence. We do not use photos of real people to create them.
- Working files are deleted in 30 days.
7. Who visits the Domeo website
- We count visits and clicks in aggregate form, without identifying the person.
- The chosen language is stored in your browser during the visit.
- The site does not use advertising cookies.
- If you talk to us by WhatsApp or email, we process the conversation data to answer.
8. Who we share with
We share data only with those who help us provide the service, and only what each one needs:
| Category | What it receives |
|---|---|
| Cloud hosting | All platform data, stored on the servers |
| Content delivery network | The IP of whoever downloads the try-on files, during delivery |
| Payment processor | The optical store's billing data and the card data, typed on the processor's page |
| Email delivery | Name, email and the content of the messages |
| Support by WhatsApp | Name, phone number and the messages of whoever contacts us through this channel |
| Artificial intelligence and 3D modelling providers | Photos of frames and generation instructions. They do not receive data about who tries on or who buys |
| Store platforms (Nuvemshop, Shopify and others) | What is needed for the integration the optical store asked for |
The list with the name of each company is in Annex III of the Data Processing Agreement, published on the site.
We may also hand data over to authorities, when there is a legal order.
We do not sell personal data.
9. Data outside Brazil
The servers and databases of the platform are in Brazil. Some suppliers store or process data outside Brazil, mainly in the United States. In those cases, we use the LGPD mechanisms for international transfer (art. 33) and those of Resolution CD/ANPD No. 19/2024. The country of each supplier is in Annex III of the Data Processing Agreement.
10. How long we keep data
| Data | Period |
|---|---|
| Detailed try-on events | 13 months. After that only aggregate numbers remain |
| Access logs with full IP | Up to 7 days |
| Access logs with masked IP | Up to 90 days |
| Technical measurement of the storefront | 60 days |
| Account and store data | While the account exists and for 30 days after the end of the contract |
| Studio working files | 30 days |
| Billing data and invoices | 5 years, or the longer period that tax law requires |
| Registration and payments at the payment processor | They stay with the processor. If the account is deleted, the registration is marked as removed, but it is not erased: the processor keeps these records to comply with its legal obligations |
| Record of the acceptance of the terms | For the duration of the contract and for 5 years after |
| Support messages | 2 years |
11. Your rights
Under the LGPD (art. 18), you can ask for:
- confirmation that we process your data and access to it;
- correction of incomplete or wrong data;
- anonymization, blocking or deletion of data that is unnecessary or processed in breach of the law;
- portability;
- deletion of data processed with your consent, and withdrawal of consent;
- information about who we share your data with.
How to ask: write to privacidade@domeo.com.br. We answer within 15 days.
If you tried on glasses on an optical store's website: the controller is the optical store. You can ask the store or us. If you ask us, we pass the request on to the optical store and help answer it. As we do not store data that identifies who tries on, the answer is usually that we hold no data about you.
You can also complain to the Brazilian National Data Protection Authority (ANPD).
12. Security
We use an encrypted connection, separation of data by store, role-based access control, a second authentication factor and a log of the actions in the dashboard. If there is a security incident with relevant risk or harm, we notify the ANPD and the people affected, as required by art. 48 of the LGPD.
13. Children and teenagers
The platform is contracted by companies. The try-on does not ask for or store data that identifies who tries on, of any age.
14. Changes to this policy
Each version has a number and a date and is published on the site. Relevant changes are notified to the optical stores by email and in the dashboard.
Version history
- 1.0 (15 November 2026): first version.