1. Who is responsible for your data
Roomr Inc., a Delaware corporation at 2261 Market Street, Ste 10772, San Francisco, California, 94114, USA, is the controller of the personal data described in this policy - that means we decide how and why it is used. Our production systems are hosted in the United States. Our affiliate Roomr Ltd (Edinburgh, Scotland) provides software engineering and support services to us under a written data-processing agreement and acts on our instructions; it does not decide how your data is used.
This policy applies to the Roomr website, web application and related services (the "Service") and to our marketing. It applies to individuals using the Service as consumers and to individuals who use it on behalf of a business.
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email, password (hashed), company name and role for business accounts, plan and settings | You |
| Billing data | Billing address, VAT/tax ID, transaction history. Card details go directly to our payment processor (Stripe) and never touch our servers; we see only the last four digits and card type | You; Stripe |
| Project content | Floor plans, measurements, photographs of rooms, design choices, and the renders and files the Service generates for you | You; generated by the Service |
| Usage and device data | IP address, browser and device type, pages and features used, rendering activity, error logs, approximate location derived from IP | Collected automatically |
| Cookies and similar technologies | Identifiers stored in cookies and local storage - see the Cookie Policy | Collected automatically; non-essential ones only with consent |
| Communications | Support tickets, emails, survey responses, feedback | You |
A note on photographs: if you upload photos of a home that show other people or someone else's property, you are responsible for having the right to share them with us. We do not use facial recognition.
3. Why we use it and our legal bases
| Purpose | Legal basis (UK/EU GDPR) |
|---|---|
| Providing the Service: your account, rendering and storing your projects, billing and support | Performance of a contract with you |
| Keeping the Service secure, preventing fraud and abuse, debugging and monitoring performance | Legitimate interests (running a safe, reliable service) |
| Improving the Service using de-identified, aggregated usage data | Legitimate interests (product improvement) |
| Training or improving our AI models using your identifiable project content or outputs | Consent - only if you turn on the "Help improve Roomr" setting; withdraw at any time [see drafting note] |
| Emailing existing customers about similar Roomr products and features | Legitimate interests / UK PECR "soft opt-in" - every message has an unsubscribe link |
| Other marketing to consumers (newsletters, promotions) | Consent - withdraw at any time |
| Contacting people at business customers or prospects | Legitimate interests (B2B relationship); you can object at any time |
| Non-essential cookies and analytics | Consent (see Cookie Policy) |
| Complying with tax, accounting, consumer-protection and other legal obligations; responding to lawful requests | Legal obligation |
| Establishing, exercising or defending legal claims; business transfers | Legitimate interests |
4. How we use AI
The Service uses machine-learning models and 3D rendering to turn your floor plans, photographs and choices into designs and images. This processing happens automatically when you ask for a render. We do not make decisions about you using solely automated means that have legal or similarly significant effects. Outputs may carry visible or machine-readable marks indicating they are AI-generated, as required by law. Your identifiable project content is not used to train generative models unless you opt in (Section 3); de-identified, aggregated usage statistics are used to improve the Service.
5. Who we share data with
We do not sell personal data. We share it only with:
- Roomr Ltd (our UK affiliate) - engineers and support staff who maintain, debug and support the Service, under a written data-processing agreement that limits their use of your data to our instructions.
- Service providers (processors) that act on our instructions: cloud hosting and storage AWS / Google Cloud - US regions, payment processing (Stripe), email delivery, customer-support tooling, analytics, error monitoring, and consent management. A full, current list of our service providers is available on request from privacy@roomr.ai.
- Professional advisers, authorities and courts where the law requires it, to protect our rights or users' safety, or to enforce our Terms.
- A buyer or successor if we sell, merge or reorganise the business, in which case this policy continues to apply to your data.
Nobody else - we do not share your project content with advertisers or data brokers.
6. Cookies and similar technologies
Strictly necessary cookies run the Service (login, security, session state, payment fraud prevention). Analytics and any marketing cookies are off by default for visitors from the UK, EU/EEA, Switzerland and US states that require it, until you consent through our cookie banner. You can change your choice at any time via Cookie settings in the footer. We honour Global Privacy Control signals as an opt-out. Details are in the Cookie Policy.
7. International transfers
The Service is provided from the United States, so your data is processed there. Because Roomr Inc. is a US company, the information you provide directly to us through the Service is received by us in the US. Where we send personal data to our service providers outside the country it was collected in, we use recognised safeguards:
We do not currently rely on the Data Privacy Framework. For transfers to providers outside the UK/EEA we use the European Commission's Standard Contractual Clauses (with the UK Addendum) or the UK International Data Transfer Agreement, together with any additional measures needed, or we rely on the recipient's DPF certification where it holds one.
Data handled by Roomr Ltd in the UK is protected by UK data-protection law and by our written data-processing agreement. You can ask us for a copy of the relevant safeguards using the contact details in Section 12.
8. Your rights
If you are in the UK, EU/EEA or Switzerland you have the right to: access your data and receive a copy; have inaccurate data corrected; have data erased; restrict or object to processing (including an absolute right to object to direct marketing); receive data you provided to us in a portable format; and withdraw consent at any time without affecting earlier processing. You also have the right to complain to a supervisory authority - in the UK the Information Commissioner's Office (ico.org.uk); in the EU your national authority.
If you are in the United States, depending on your state you may have the right to know what personal data we hold, to access, correct or delete it, to obtain a portable copy, to opt out of "sale", "sharing" or targeted advertising (we do not sell data; we treat cross-site advertising cookies, if used, as "sharing" and you can opt out via Cookie settings or a Global Privacy Control signal), and to appeal a refusal. We will not discriminate against you for exercising these rights. Where a state law does not yet apply to us, we still honour these requests as a matter of policy.
How to ask: email privacy@roomr.ai or use the tools in Settings (download or delete your account). We may need to verify your identity. We respond within one month (UK/EU) or 45 days (US states), extendable where the law allows. Authorised agents may act for you in states that permit it.
9. How long we keep data
| Data | Retention |
|---|---|
| Account data and project content | For as long as your account is open, then deleted within [30] days of closure (you can export first) |
| Billing and tax records | 7 years after the transaction (UK/EU tax law) or as required by US law |
| Usage logs and security logs | [12] months, then deleted or aggregated |
| Support communications | [24] months after the ticket closes |
| Marketing preferences and consent records | Until you withdraw or unsubscribe, plus a suppression record so we don't contact you again; consent records for auto-renewal and cookies kept as required (up to 3 years) |
| Backups | Rolling [35]-day cycle; deleted data leaves backups within that period |
10. Security
We protect your data with technical and organisational measures appropriate to the risk, including encryption in transit and at rest, access controls and logging, and staff confidentiality obligations. No system is perfectly secure; if a breach affecting you occurs we will notify you and the regulator as the law requires.
11. Children
The Service is for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18; if you believe we have, contact us and we will delete it.
12. Contact, representatives and complaints
Privacy contact: privacy@roomr.ai, or by post to Roomr Inc., 2261 Market Street, Ste 10772, San Francisco, California, 94114, USA.
UK representative (UK GDPR Article 27): Roomr Ltd, Suite 2, Ground Floor Orchard Brae House, 30 Queensferry Road, Edinburgh, United Kingdom, EH4 2HS, privacy@roomr.ai.
EU representative (EU GDPR Article 27): [TBD].
Complaints: if you are unhappy with how we handle your data, please tell us first at privacy@roomr.ai. We will acknowledge your complaint within 30 days, investigate it and reply with our conclusions without undue delay. You can also complain to the ICO (UK), your national data-protection authority (EU), or your state attorney general (US).
13. Changes to this policy
We will post any changes here and update the date at the top. For material changes we will notify you by email or in-app message before they take effect.