Privacy Policy

Roomé is an AI-powered interior-design tool operated by [DATA CONTROLLER NAME], based in [CITY], Greece. For any question about how we handle your data, email [CONTACT EMAIL].

When you join the waitlist: your email address.

When you create an account: your email, a bcrypt hash of your password (we never see or store the plaintext), and timestamps.

When you generate a design: the brief you submit (room type, style, dimensions, budget, colour palette, material preferences), a flag for whether the result came in over budget, and a flag for whether you uploaded a photo. If you're signed in, your user ID is linked to the record; anonymous designs are not linked to any identifier.

When you save a design: the full design payload (recommended furniture, layout, prices), the AI-generated redesign image if you produced one, and a display name.

When you upload a room photo: the photo is streamed through our server to Google Gemini and used to generate a redesign. We do not persist the original photo you uploaded — only the AI-generated redesign it produces, and only if you save the design.

Cookies we set:

• next-auth.session-token — sign-in session, required for account features.
• roomai_access — the access-code cookie while the site is in gated preview.
• No analytics or advertising cookies.

• Waitlist email — your consent (Article 6(1)(a)).
• Account data — necessary to perform the contract of providing your account (Article 6(1)(b)).
• Design generation — necessary to fulfil your request (Article 6(1)(b)).
• Aggregate usage flags — our legitimate interest in improving the product (Article 6(1)(f)). Not used to profile individual users.

When you join the waitlist or create an account, you can separately tick an optional checkbox to receive furniture and design offers from Roomé's partner stores. This is:

• Optional and off by default. You must actively tick the box — there is no pre-consent.
• Separate from your core account. Turning it off (or never turning it on) has no effect on the app itself.
• Style-targeted. If you opt in, the design styles you've generated or saved (for example "scandinavian", "industrial") may be used to send you relevant offers. We store this list on your user record; it is not shared with partners in raw form — partners receive segments, not individual profiles.

Legal basis: your explicit consent (Article 6(1)(a)).

You can opt out at any time by clicking the unsubscribe link in any offer email (a signed one-click link — no login needed), or by emailing [CONTACT EMAIL]. Opting out flips the marketing flag off and removes you from future segments.

We share your data with these processors, only to the extent needed to run the service:

• Vercel Inc. (USA) — hosting and edge network.
• Neon Inc. (USA) — managed Postgres database (currently us-east-1).
• Anthropic PBC (USA) — the Claude API generates furniture recommendations and layouts from your brief. Only your brief text is sent; not your email or account details.
• Google LLC (USA) — the Gemini API generates photorealistic redesigns. Only the uploaded photo is sent; not your email or account details.

Transfers to the USA rely on the European Commission's Standard Contractual Clauses, incorporated into each provider's terms.

We do not sell your data or share it with advertising networks.

• Waitlist emails — until you ask us to delete them, or until we close the waitlist.
• Account and saved designs — until you delete your account. Deletion removes your User record and all linked SavedDesigns and DesignEvents.
• Anonymous design events — kept indefinitely for aggregate analytics; contain no personal identifier.

You have the right to: access a copy of your data; rectify inaccurate data; erase your account and everything linked to it; receive your data in a portable machine-readable format; object to processing based on legitimate interest; withdraw consent for the waitlist at any time; and lodge a complaint with the Hellenic Data Protection Authority (dpa.gr) or your local supervisory authority.

To exercise any of these, email [CONTACT EMAIL]. We'll respond within 30 days.

If we materially change how we handle your data, we'll update this page and the date at the top. Changes that require renewed consent, we'll ask for.

[CONTACT EMAIL]