wigsmi.

Legal

Privacy Policy

Last updated: 10 May 2026

This policy explains how SHERWOOD CONSULTING SERVICES LTD, trading as Wigsmi ("we", "us", "our"), collects and uses your personal data when you use our website, mobile app, or virtual try-on service (the "Service"). We act as a data controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

Wigsmi is operated by SHERWOOD CONSULTING SERVICES LTD from the United Kingdom. If you have any questions about this policy or your data, contact us at privacy@wigsmi.com.

2. Data we collect

  • Account data: name, email, password (hashed), account type.
  • Profile data: optional preferences, style quiz answers, wishlist.
  • Photos: selfies you upload for try-on. Stored only as long as needed to render the result and any photos you choose to save.
  • Usage data: try-on counts, pages visited, device and browser info, IP address.
  • Retailer data: business name, contact details, catalog content, payment metadata (handled by our payment processor - we do not store card numbers).

3. Why we use it (lawful bases)

  • Contract: to provide the Service you signed up for (account, try-on, retailer portal).
  • Legitimate interests: to keep the Service secure, prevent fraud, measure usage, and improve our product.
  • Consent: for optional marketing emails and non-essential cookies. You can withdraw consent at any time.
  • Legal obligation: tax, accounting, and responding to lawful requests.

4. Try-on photos and AI processing

Photos you upload are processed by our AI try-on engine to generate a preview. They are stored in encrypted cloud storage. You can delete any saved photo from your account at any time. We do not use your photos to train third-party AI models, and we do not sell them. Try-on photos are sent to Google LLC's Gemini image API for processing and are not retained by Google after the result is generated.

5. Sharing your data

We share data only with processors that help us run the Service:

  • Cloud hosting and database providers.
  • Paddle (paddle.com) - our payment processor and merchant of record, who handles all billing for retailer and consumer subscriptions. Paddle is incorporated in the USA; transfers are covered by Standard Contractual Clauses. See paddle.com/privacy.
  • Google LLC (Gemini image API) - processes selfie photos you upload solely to generate your virtual try-on result. Google is incorporated in the USA; transfers are covered by Standard Contractual Clauses. See policies.google.com/privacy. Photos are not retained by Google beyond the processing request.
  • Email delivery providers.
  • Analytics providers (aggregated, where possible).

We do not sell your personal data. Where data is transferred outside the UK, we rely on appropriate safeguards (e.g. UK-approved Standard Contractual Clauses or adequacy decisions).

6. How long we keep it

We keep personal data only as long as needed for the purposes set out above, or as required by law. When you delete your account, we delete or anonymise your personal data within 30 days, except where we are legally required to retain it (e.g. financial records).

7. Your rights

Under UK GDPR you have the right to:

  • Access the personal data we hold about you.
  • Correct inaccurate data.
  • Request deletion ("right to be forgotten").
  • Restrict or object to processing.
  • Data portability.
  • Withdraw consent at any time.
  • Complain to the Information Commissioner's Office (ICO) at ico.org.uk.

To exercise any right, email privacy@wigsmi.com.

8. Cookies

We use strictly necessary cookies to keep you signed in and the Service working. With your consent, we may use analytics cookies to understand how the Service is used. You can manage cookies in your browser at any time.

9. Security

We use encryption in transit and at rest, role-based access controls, and regular reviews. No system is perfectly secure, but we take reasonable steps to protect your data.

10. Children

The Service is not directed at children under 13. If you believe a child has provided us with personal data, contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. Material changes will be notified via email or an in-app notice. The "Last updated" date above shows the latest revision.