Privacy Policy

§1. Data Controller

1. The controller of the personal data of the users of the Homeful mobile application (available on the App Store and Google Play, hereinafter: the "Application") and of the marketing website available at gethomeful.com (hereinafter: the "Website") is Windify Digital Services, with its registered office at ul. Płocka 127/16, 87-800 Włocławek, Poland, NIP: 8943145650, REGON: 384382857 (hereinafter: the "Controller").
2. The Controller may be contacted on matters concerning personal data at: hello@gethomeful.com.
3. The Controller processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation, hereinafter: the "GDPR"), the Polish Personal Data Protection Act of 10 May 2018 (ustawa o ochronie danych osobowych), the Polish Act of 18 July 2002 on the provision of electronic services (ustawa o świadczeniu usług drogą elektroniczną), and the Polish Telecommunications Law Act of 16 July 2004 (Prawo telekomunikacyjne) (as regards Articles 173 and 174 concerning cookies).

§2. Scope of Data Collected

The Controller collects and processes the following categories of personal data:

Account Data

• Email address, required to create an Account, log in, verify identity, communicate, and send purchase confirmations.
• Name, required when registering with email and password, to personalise correspondence and the Application interface. When using Apple or Google sign-in, the Application may receive a name and profile image from the sign-in provider; availability depends on the provider and the information shared.
• Authentication identifier, where a user logs in with an Apple ID or Google account: the identifier returned by the sign-in provider (Sign in with Apple, Google Sign-In). A password, used solely for email login, is stored as a salted PBKDF2-SHA256 hash. The Controller does not store the password in plain text.

Content Uploaded by the User

• Photos of a room, a home exterior, or a floor plan, uploaded to the Application in order to perform a Generation. The photos are sent to the AI model provider, which returns the Generation result. Location and other metadata (EXIF) are stripped on upload.
• Generated Content, images produced by the Application's AI models on the basis of the user's Content. Stored in the Account "Archive" until the user deletes them or deletes the Account. User photos and results are never public: they are served only through an authenticated endpoint and are not accessible without the user's session.
• Reports about generated results, the selected report reason, the result reference and the submission time, used to review potentially inappropriate content. These reports are stored with the related Generation and are removed when that Generation or the Account is deleted.

Technical and Diagnostic Data

• IP address, collected in server logs and security systems for the purpose of detecting abuse.
• Device data, device model, operating system and its version, Application version, interface language.
• Application installation identifier, an internal identifier generated by the Application. The Controller does not use advertising device identifiers (IDFA on iOS, GAID on Android) for marketing purposes, nor does it share them with third parties for that purpose.
• Application activity and product-interaction data, including onboarding completion, demonstration and paywall events, plan selection, purchase outcomes, subscription lifecycle events, the type of Generations performed, and technical errors. Analytics use an internal user identifier and do not contain room photos, image URLs, email addresses, names, or text entered by the user. Session recording and automatic interaction capture are disabled.
• Push notification token, for sending notifications via Apple Push Notifications (APNs) or Firebase Cloud Messaging (FCM).
• Cookies and similar technologies, on the Website only (gethomeful.com). The Application does not use cookies in the traditional sense. Detailed information is set out in the Cookie Policy.

Transaction Data

• Subscription and purchase history, date, amount, plan selected, transaction identifier (App Store / Google Play).
• Generation balance and history, accruals, deductions, renewals.
• The Controller does not store payment card details. All payments within the Application are handled exclusively by the Apple App Store and Google Play, in accordance with their terms and payment mechanisms.

§3. Purposes and Legal Bases of Processing

§4. Recipients of Data

Users' personal data may be transferred to the following categories of recipients (processors and separate controllers):

1. Cloudflare, Inc. (USA), provider of the hosting and backend infrastructure for Homeful (Cloudflare Workers), the database (D1), object storage for photos and Generated Content (R2), content delivery network (CDN), bot and DDoS attack protection, and email routing for addresses in the gethomeful.com domain. The data stored in object storage is encrypted at rest and in transit.
2. OpenRouter, Inc. (USA), provider of the service through which the Application sends requests and the necessary User Content to its configured AI model providers for image analysis and visualisation generation. Processing and retention by OpenRouter and downstream providers are governed by the applicable API terms and service configuration.
3. OpenAI, provider of the image models used to generate visualisations, accessed through OpenRouter.
4. Google LLC and Google Ireland Limited, provider of the Gemini models used to analyse room, product and floor-plan images through OpenRouter, and provider of Google Play (in-app purchases) and Google Sign-In.
5. Apple Inc., in connection with the sale of Subscriptions within the Application via the App Store, Sign in with Apple, and the sending of push notifications (Apple Push Notifications).
6. Resend (email delivery provider), used to deliver transactional emails and to forward messages submitted through the Website contact form (name, email address, subject, message) to the Controller. The contact form is processed by the Controller's own Cloudflare Worker; there is no third-party form-forwarding service.
7. PostHog, Inc., provider of product analytics hosted in the European Union. PostHog receives only the limited product-interaction and subscription-event data described in §2. It does not receive User Content, image URLs, email addresses, names, or user-entered text. Automatic capture and session recording are disabled.
8. Public authorities, at the request of authorised bodies, on the basis of applicable law.
9. Legal and tax advisers, to the extent necessary for the establishment, exercise or defence of legal claims.

Nature of the Use of AI Models

1. The Generation of a visualisation is performed by AI models in a probabilistic manner; the result is not deterministic and may differ with each generation, even from the same input data. Complaints concerning defective results are governed by the Terms of Service (a Generation refund in the case of manifest defects).
2. The user's Content is transmitted to the AI model providers to analyse uploaded images and produce the requested Generation. Homeful does not train its own AI models using User Content. Downstream providers' use and retention of submitted data depend on their applicable API terms and service configuration; this Policy does not promise zero retention by every provider.
3. A Generation does not constitute automated decision-making within the meaning of Art. 22 GDPR; the Generation result is graphic content delivered to the user for any use, and not a decision producing legal effects concerning them or significantly affecting their situation.
4. The full list of the Controller's subprocessors is made available to the user upon a written request sent to hello@gethomeful.com.

§5. Transfers of Data Outside the EEA

1. Some of the entities to which the Controller entrusts the processing of data have their registered office outside the European Economic Area (EEA), in particular in the United States. This applies in particular to: Cloudflare, Inc., OpenRouter, Inc., OpenAI, Google LLC (Gemini API, Google Play, Google Sign-In), Apple Inc., PostHog, Inc., and the email delivery provider (Resend). Product analytics are configured to use PostHog's EU hosting endpoint.
2. Transfers of data to the USA take place on the basis of the EU-US Data Privacy Framework (European Commission implementing decision of 10 July 2023) or Standard Contractual Clauses (SCC) approved by the European Commission, in accordance with Art. 46 GDPR.
3. The Controller uses only providers that ensure an adequate level of personal data protection in accordance with the requirements of the GDPR.
4. In the event that a data transfer mechanism is invalidated or changed, the Controller will promptly take steps to ensure that the transfer complies with applicable law.

§6. Data Retention Period

1. Once the retention period has expired, the data is permanently deleted or anonymised.
2. Completing Account deletion removes the user's profile, projects, Generation history, uploaded photos and Generated Content stored by Homeful. Completed deletion is irreversible. Limited subscription lifecycle records, transaction identifiers and receipt-claim records may remain for accounting, legal compliance, fraud prevention and completion of outstanding purchase confirmations. These retained records do not include the deleted Account profile or its photos and Generated Content.

§7. Rights of the User

Under the GDPR, the user has the following rights:

• Right of access (Art. 15), to obtain information about the data processed, including a copy of the data.
• Right to rectification (Art. 16), to correct inaccurate data or complete incomplete data.
• Right to erasure (Art. 17), to request deletion of the data (the "right to be forgotten"). The user may delete their Account themselves in the Application settings or request deletion using the Homeful account deletion page, including when they no longer have the Application. This right does not apply to data the retention of which is required by law.
• Right to restriction (Art. 18), to restrict the processing of data in certain cases.
• Right to data portability (Art. 20), to receive the data in a structured, commonly used and machine-readable format.
• Right to object (Art. 21), to object to processing based on the Controller's legitimate interest, including objection to the use of anonymised Content for improving the Application.
• Right to withdraw consent (Art. 7(3)), at any time, without affecting the lawfulness of processing carried out beforehand.
• Right to lodge a complaint, with the supervisory authority: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland (uodo.gov.pl).

To exercise the above rights, please contact the Controller at hello@gethomeful.com. The Controller will deal with the request within 30 days. In the case of complex or numerous requests, this period may be extended by a further 60 days, of which the Controller will inform the user.

§8. Data Security

1. The Controller applies appropriate technical and organisational measures to protect personal data, including:

   • SSL/TLS encryption, all communication with the Application and the Website takes place over an encrypted HTTPS connection.
   • Encryption of data at rest, photos and Generated Content are stored in encrypted object storage.
   • Private media, user photos and results are never public; they are served only through an authenticated endpoint.
   • EXIF stripping, location and other metadata are removed from photos on upload.
   • Password hashing, passwords (for email login) are stored solely as a salted PBKDF2-SHA256 hash.
   • Token-based authentication, Application sessions are based on signed tokens, which can be revoked.
   • No storage of card details, payment data is processed exclusively by the Apple App Store / Google Play.
   • Access control, access to data is limited to authorised persons, with an access log.
2. Notwithstanding the above safeguards, the Controller is unable to guarantee the complete security of data transmitted over the Internet. The user is responsible for securing their own device and login credentials.

§9. Personal Data Breach

1. In the event of a personal data breach that may result in a risk to the rights or freedoms of natural persons, the Controller will report such breach to the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) without undue delay, and no later than 72 hours after becoming aware of the breach (Art. 33 GDPR).
2. Where a personal data breach may result in a high risk to the rights or freedoms of natural persons, the Controller will promptly inform the affected users (Art. 34 GDPR), including of the nature of the breach, the possible consequences, and the remedial measures.

§10. Profiling and Automated Decision-Making

1. The Application uses AI models to generate images. This is carried out solely at the user's request and does not constitute automated decision-making within the meaning of Art. 22 GDPR, as it produces no legal effects and does not significantly affect the user's situation.
2. The Controller does not use the Website for behavioural profiling and does not run analytics or marketing trackers on it; details are set out in the Cookie Policy.

§11. Children's Personal Data

1. The Application and the Website are intended for persons aged 13 and over. The Controller does not knowingly collect personal data from persons under 13 years of age.
2. Uploading photos depicting minors to the Application is prohibited (in accordance with §5 of the Terms of Service). If the Controller becomes aware that the Content contains the likeness of a child or that an Account belongs to a person under 13 years of age, it will promptly delete the relevant data and block the Account.

§12. Obligation to Provide Data

1. Providing Account data (email address) is voluntary but necessary to create an Account and use the Application.
2. Uploading photos is voluntary and necessary to perform a Generation.
3. Providing data in the Website contact form is voluntary and necessary in order for the Controller to respond to the message.

§13. Changes to the Privacy Policy

1. The Controller reserves the right to amend this Privacy Policy at any time, in particular in order to adapt it to changes in the law, technological changes or changes in the scope of data processing.
2. The Controller will inform users who hold an Account of material changes by email or by notification within the Application, at least 14 days in advance.
3. We recommend reviewing the content of this Policy regularly; it is available at gethomeful.com/privacy.

§14. Controller's Details

Windify Digital Services
ul. Płocka 127/16, 87-800 Włocławek
NIP: 8943145650 · REGON: 384382857
Contact: hello@gethomeful.com