Privacy Policy

1. Who we are and what this Policy covers

RetroEyeglasses by Tasha (“Retro by Tasha”, “we”, “us” or “our”) is responsible for personal information processed through the Retro by Tasha mobile application, the Retro by Tasha online services and associated customer support (together, the “Services”).

This Privacy Policy explains what we collect, why we use it, who may receive it, how long we retain it, and the choices and rights available to you. It is intended to comply with Ghana’s Data Protection Act, 2012 (Act 843) and other applicable law.

2. Information we collect

Account and authentication information

Your mobile telephone number, internal user identifier, account creation and last sign-in times, verification-request details, verification attempt status, session identifiers, IP address and user-agent information used for authentication security and fraud prevention. One-time verification codes are stored in hashed form and expire after a short period.

Orders and transactions

Order number, selected branch or fulfilment location, customer and pickup contact details, products, quantities, options, prices, charges, notes, order status, status history and timestamps. If a third-party payment service is introduced or used, it processes payment credentials under its own privacy notice; Retro by Tasha does not intentionally store complete card numbers or mobile-money PINs.

Preferences and shopping activity

Saved favourites, notification preference, cart-related actions submitted to the service, and limited feature-usage events such as an event name, time, session or user identifier and relevant technical properties.

Frame Finder information

Face shape, style preferences, budget, requested date and consultation method, notes, selected products, proposal information and up to six selfies or reference photos that you choose to take or select and upload.

Device, notification and technical information

Device notification token, platform, app version, locale, notification delivery and read status, request timestamps, IP address, browser or app user-agent, and security or service logs. Apple and your mobile network may process related device and delivery information independently.

Support communications

Information you provide when you email, call, message or visit us, including contact details, order references, screenshots, recordings and the content of your request.

3. Camera, photos and augmented reality

Camera and photo-library access is optional and controlled through iPhone permissions.

• Virtual try-on: the live front-camera view, face tracking and Apple AR/Vision processing operate on your device. Retro by Tasha downloads the selected frame image for local foreground isolation; it does not receive the live camera feed. A try-on snapshot leaves the app only when you choose an option in Apple’s share sheet.
• Frame Finder: selfies or reference photos are uploaded to Retro by Tasha’s cloud storage only after you select or take them and submit the request. They are made available to authorised Retro by Tasha staff who handle the request.

Only upload photos you are authorised to share. Avoid including other people or sensitive information, and remove any photo before submission if you do not want it uploaded.

4. How and why we use information

We process personal information only for specific, lawful purposes, including to:

• create and secure your account and send one-time sign-in codes;
• provide carts, favourites, orders, order history, returns and customer support;
• arrange and deliver Frame Finder consultations and prepare shoppable frame suggestions;
• send transactional order, security and service notifications;
• send promotional notifications only where allowed and consistent with your choices;
• operate, measure, troubleshoot and improve the Services;
• prevent fraud, abuse, security incidents and unlawful activity;
• keep business, tax and transaction records and comply with legal obligations; and
• establish, exercise or defend legal rights.

Depending on the context, our grounds for processing include performing a contract with you, taking steps you request before a contract, your consent, compliance with law, protection of legitimate interests in operating and securing the Services, and other grounds permitted by Ghanaian law.

5. When we share information

We disclose only what is reasonably necessary to:

• Retro by Tasha personnel: authorised retail, fulfilment, support, styling and administrative staff;
• service providers: cloud hosting and storage providers, SMS and telecommunications providers, Apple notification and app-platform services, delivery providers, payment processors where used, and technical support providers;
• professional advisers: auditors, insurers, lawyers and other advisers subject to appropriate duties; and
• authorities or other parties: where required by law, necessary to protect rights and safety, or connected with a lawful corporate transaction.

Service providers may use information only to perform services for us or as independently disclosed to you. We do not disclose personal information to data brokers.

6. International processing

Some technology providers may process or store information outside Ghana. Where personal information is transferred internationally, we take reasonable steps to use providers, contracts and safeguards consistent with Act 843 and applicable law.

7. Retention

We retain personal information only for as long as reasonably necessary for the purposes described above. Retention depends on the type of information and may include:

• account information while the account remains open;
• shorter periods for expired authentication material and routine security logs, unless needed to investigate abuse;
• order and financial records for the period required by tax, accounting, consumer-protection and other laws;
• Frame Finder records and submitted photos while needed to provide the service, handle follow-up or resolve a dispute; and
• limited backup, audit or legal-hold copies until they are securely overwritten or no longer required.

When retention is no longer justified, we delete, anonymise or securely isolate the information.

8. Security

We use administrative, technical and organisational safeguards designed to protect personal information, including HTTPS in transit, hashed verification and session secrets, secure device storage for sign-in sessions, access controls, tenant-isolated databases and restricted administrative access. No internet service can guarantee absolute security. Tell us promptly if you suspect misuse of your account, and never share a one-time code or payment PIN.

9. Your rights

Subject to Act 843 and applicable exceptions, you may ask us to:

• confirm whether we process your personal information and provide access to it;
• correct information that is inaccurate or incomplete;
• delete information that we no longer have a lawful reason to retain;
• stop or restrict particular processing where applicable;
• honour an objection to direct marketing;
• withdraw consent for future processing where consent is the basis; and
• explain significant solely automated decisions, if we ever use them.

Use our Privacy Choices page for instructions. We may need to verify your identity before acting. You may also complain to Ghana’s Data Protection Commission.

10. Account deletion

You can permanently delete your account from Account → Delete Account in the app. Active orders must first be completed or cancelled. Deletion removes the account and associated active profile data, favourites, notification devices, sessions, stored notifications, usage events, order history and linked Frame Finder records from the live service, subject to information we must retain by law, for fraud prevention, dispute resolution, security logs or limited backups.

If you cannot access the app, follow the verified-request process on our Privacy Choices page.

11. Children

The Services are intended for adults and are not directed to children under 18. We do not knowingly create accounts for children. A parent or guardian who believes a child provided personal information should contact us so we can investigate and take appropriate action.

12. Changes to this Policy

We may update this Policy when our Services, providers or legal obligations change. We will publish the current version and effective date at this URL and provide additional notice where required.

Privacy contact

When contacting us, do not send one-time verification codes, passwords, payment PINs or full card details.