AI Sample Room - Privacy Policy

Version 1.1 · Effective 25 June 2026

1. At a glance

• What it does. AI Sample Room adds an AI image-generation capability inside your existing WFX PLM. It reads the product data and images you already hold in WFX (such as the Bill of Materials, colourways, trims and reference imagery), generates photoreal sample renders from them, and writes the results back into the relevant places in your WFX records.
• We do not sell your data. We never sell or rent your product data, images or personal data, and we do not use them for advertising.
• AI processing. Image generation and analysis are performed by a third-party AI provider - currently Google's Gemini API - on a paid, billing-enabled basis under which your content is not used by the provider to train or improve its models. We may change or add AI providers as models and provider terms evolve, so the service keeps meeting customer needs. We never use your product data or images to train any AI model, whether for you, for us, or for any other customer.
• Your content stays yours. You retain ownership of your WFX data and of every render produced. We act as your data processor for that content.
• We don't store your images or product data. Source images, generated renders, BOM, colourways and prompts are processed only in memory while we handle your request and discarded as soon as it finishes - they are never written to our database or saved on our servers, and the authoritative copies stay in your WFX. We keep only limited diagnostic logs (up to 28 days) plus minimal usage and account records.
• Where it runs. Our service is hosted in a UK Tier IV, ISO 27001 certified data centre.

2. Who we are

AI Sample Room is provided by its.fashion, the technology division of Conceptable Ltd ("its.fashion", "we", "us", "our"), registered office and correspondence address: 167-169 Great Portland Street, 5th Floor, London, England W1W 5PF, United Kingdom.

For any privacy matter relating to AI Sample Room, contact us at privacy.contact@its.fashion.

3. Our role: controller and processor

AI Sample Room is used by businesses ("Clients") that hold their own product information in WFX PLM. Our role under the UK GDPR depends on the data in question:

• Client product data and images (we act as processor). The product records, Bill of Materials, colourways, trims, reference imagery, uploaded images and generated renders that the extension reads from and writes back to your WFX environment belong to, and are controlled by, the Client. We process this content only on the Client's documented instructions, to provide the service. Our processing of this data is further governed by our site-wide Data Processing Agreement, which we will sign where a Client's procurement requires it.
• Account and contact data (we act as controller). For the names and business email addresses of authorised users, company contact details, activation and subscription records, and service communications, we act as controller, as described in our general Privacy Policy.

Where this policy refers to "you", it means, as the context requires, the Client business and the individual users who use the extension.

4. What the extension accesses and what we collect

4.1 Data the extension accesses within your WFX environment

When you use AI Sample Room, the extension runs on your WFX PLM pages in your browser so that it can feel like a native part of WFX. To generate renders, it accesses:

• Product records and the Bill of Materials for the item you are working on;
• Colourway and trim libraries associated with that item;
• Reference and source imagery (for example CAD, flats or photographs) held against the item;
• The WFX fields and locations into which generated renders are written back.

The extension reads this information only when you are signed in and actively use it to run a generation task, and only the data needed for that task. It does not continuously monitor or scrape your WFX environment in the background, and it does not access WFX areas unrelated to the generation task.

4.2 Data we receive and process on our cloud service

To perform a render, the extension sends the relevant product data and images to our cloud service (hosted in the United Kingdom at cloud.its.fashion), which orchestrates the AI generation and returns the result to your WFX environment. In doing so we process:

• Generation inputs: the product attributes, colourway/trim details and the source/reference images you submit for a given task;
• Generation outputs: the rendered images produced for you;
• Job metadata: limited technical data about each generation request - an internal job identifier, the originating account, the action or operation type, a timestamp, and the processing cost - needed to deliver, account for and bill the service. This metadata does not include your product data, prompts or images.

4.3 Account, authentication and technical data

• Account data: the name and business email address of each authorised user, company details, and subscription/activation records.
• Authentication data: the credentials or tokens used to sign you in and to connect securely to your WFX environment. Your WFX API credentials are encrypted at rest using AES-256-GCM and are never displayed back or shared (see Section 10).
• Technical and usage logs: standard, short-lived logs (such as IP address, browser/extension version, timestamps, and error diagnostics) used to operate the service securely and to investigate problems.

4.4 Cookies and local storage

AI Sample Room does not set any advertising, analytics or third-party tracking cookies.

• Your WFX session cookie. To carry out a request you start, the extension reads your existing WFX session cookie - but only after you have given explicit, in-product consent, which you can withdraw at any time using "Revoke access". It is used solely to make the WFX requests you initiate, over TLS connections with certificate verification, and we do not store your WFX session cookie.
• Local extension storage. The extension keeps two small items in your browser's local extension storage: your activation token (so you stay signed in) and a record of your consent. Both remain on your device and are cleared when you uninstall the extension or choose "Revoke access".

5. How we use data and our legal bases

We process the above data for the following purposes, relying on the following UK GDPR legal bases:

• To provide AI Sample Room - reading your WFX inputs, generating renders, and writing results back. Legal basis: performance of a contract with the Client; and, for Client product data, processing on the Client's instructions as processor.
• To operate, secure and support the service - authentication, troubleshooting, abuse and fraud prevention, and maintaining service integrity. Legal basis: our legitimate interests in running a secure, reliable service, and compliance with legal obligations.
• To administer accounts and bill the service - managing subscriptions, activation and invoicing. Legal basis: performance of a contract; legitimate interests.
• To communicate with you - service, security and administrative messages. Legal basis: legitimate interests; contract. Marketing, where sent, is handled under our general Privacy Policy and you can opt out at any time.

We do not use your product data or images for automated decision-making that produces legal or similarly significant effects, and we do not use them to train, fine-tune or improve any AI model.

6. AI image generation and analysis

AI Sample Room performs its AI tasks - generating sample renders and, where applicable, analysing or recognising images - using a third-party AI provider. Our current provider is Google's Gemini API. Your inputs (product attributes and source images) are transmitted securely to the provider solely so that its model can produce the result you requested, which is then returned to you through our service.

• We use the provider on a paid, billing-enabled basis. Under the paid-service terms, the provider does not use the content you submit, or the responses it returns, to train or improve its models.
• The provider acts as our sub-processor for this step and processes the content only to provide the generation or analysis service.
• We do not use your inputs or outputs to train our own models or any third party's models, and we do not use one Client's data to benefit another.
• Results, including generated renders, are your property, consistent with our WFX Extensions Terms of Use.

Providers may change. As AI models and provider terms evolve, we may change or add AI providers so that the service continues to meet customer needs. Where we do, we will use providers that offer equivalent protections - in particular that your content is not used to train their models - and we will update this policy, our sub-processor list, and our site-wide Data Processing Agreement accordingly. The current provider's processing is subject to its own terms and security measures.

7. Sharing and sub-processors

We do not sell your data and we do not share it except as needed to provide the service or as required by law. We use the following categories of sub-processor:

We impose data-protection obligations on each sub-processor no less protective than those in this policy and our site-wide Data Processing Agreement, and we remain responsible for their performance. A current list of named sub-processors is available to any Client with an active account on request, and we will give Clients an opportunity to object to a new sub-processor on reasonable data-protection grounds. We may also disclose data where required by law or to protect our rights, users or the security of the service. We do not operate a card or online payment gateway; subscriptions are invoiced and settled by bank transfer, so we do not collect or process card or payment-account details through the service.

8. Where your data is held and international transfers

Our cloud service and its backups are hosted in the United Kingdom. Where generation inputs are sent to Google's Gemini API, that processing may involve transfer outside the UK. For any transfer of personal data outside the UK, we rely on an appropriate safeguard, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with any supplementary measures required. Because product data and images are processed only transiently and are never stored by us (Section 9), the personal data involved in any transfer is minimised.

9. Data retention

We keep data only as long as needed:

• Product data and images: not stored. Source images, generated renders, BOM, colourways and prompts are held only transiently in memory (with a short-lived temporary file) while we process your request, and are discarded as soon as the request finishes, whether it succeeds or fails. Nothing is written to our disk or database, and the authoritative copies remain in your WFX.
• Diagnostic logs: limited technical logs (such as timestamps, the action performed and limited request detail) are retained for up to 28 days and then automatically deleted by a daily maintenance process, except where a longer period is needed to investigate a security incident or to meet a legal obligation.
• Internal usage and cost records: minimal records of which user generated how many images and the associated AI-processing costs are kept for the life of the account and as internal business and financial records. These records contain no product data, prompts or images.
• Account data: retained while your account is active. After your account closes we keep it only for as long as needed to meet legitimate business and legal obligations (for example tax and accounting), after which it is deleted. You can request deletion at any time, subject to those obligations.

10. Security

Our service is hosted in a UK Tier IV, ISO 27001 certified data centre. We use technical and organisational measures appropriate to the risk, including encryption of data in transit using TLS with certificate verification on all outbound connections, role-based and least-privilege access controls, and logging and monitoring. Your WFX API credentials are encrypted at rest using AES-256-GCM (software encryption). The single master key used to encrypt them is held in the application server's protected, non-web-accessible configuration, kept separate from the encrypted data, and is never displayed or shared. As described in Section 9, your product data and images are not stored - they are processed only transiently in memory and discarded at the end of each request. We restrict access to data to personnel who need it to operate or support the service. No system can be guaranteed perfectly secure, but we work to protect your data and will notify affected Clients without undue delay if a personal data breach affecting their data occurs.

11. Your rights

Under the UK GDPR you have rights to access, rectify, erase, restrict, or object to our processing of your personal data, and to data portability. Because much of the product content is held in your WFX environment under your own control, requests relating to that content are often best actioned there; for personal data we hold as controller, contact us at privacy.contact@its.fashion and we will respond within one month. Where we process personal data as a processor on a Client's behalf, we will refer relevant requests to that Client and assist them in responding.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk, although we would welcome the chance to address your concern first.

12. Children

AI Sample Room is a business tool and is not intended for, or directed to, children under 16. We do not knowingly collect personal data from children.

13. Browser extension store compliance (Chrome Web Store and Microsoft Edge Add-ons)

AI Sample Room is distributed through the Chrome Web Store and the Microsoft Edge Add-ons store. Our handling of user data complies with the Chrome Web Store User Data Policy, including its Limited Use requirements, and with the Microsoft Edge Add-ons developer policies. The same commitments apply in both stores:

• Single purpose. The extension collects and uses data only to provide its single purpose - generating product sample images from your WFX data and returning them to WFX.
• Explicit consent. The extension reads your WFX session cookie only after you have given explicit, in-product consent, which you can withdraw at any time via "Revoke access" (see Section 4.4).
• Data minimisation. We access only the data needed for the request you start, and your product data and images are processed transiently and never stored (see Section 9).
• No selling, no brokering, no ads. We do not sell or broker your data, and we do not use or transfer it for advertising, ad targeting, creditworthiness or lending. We do not use it for any purpose unrelated to the single purpose above, and we do not transfer it to third parties except as set out in this policy (to provide the service, on your instructions, or where legally required).
• Limited, consent-gated human access. We require your explicit consent before the extension reads any cookies. Beyond that, our staff do not access your product data or images except where necessary to investigate a problem or security issue, or where required by law. Note that limited request details - which can include short prompt previews and product metadata - appear in the diagnostic logs described in Section 9 and are accessible to authorised personnel for that purpose until those logs are deleted (within 28 days).

14. Changes to this policy

We may update this policy from time to time. For material changes we will notify Clients by email or through the extension, and we will update the version and effective date above. Continued use of AI Sample Room after a change takes effect constitutes acceptance of the updated policy.

15. Contact

Questions, requests or complaints about this policy or your data:

• Email: privacy.contact@its.fashion
• Post: Conceptable Ltd, its.fashion Division, 167-169 Great Portland Street, 5th Floor, London, England W1W 5PF, United Kingdom