Privacy Policy

01Who we are and scope

1.1This Privacy Policy explains how [LEGAL ENTITY NAME] (“ArchStudio”, “we”, “us”), of [REGISTERED ADDRESS], collects, uses, shares and protects personal information when you visit our website, use the ArchStudio 3D home design studio, sign in, or subscribe to a paid plan (together, the “Service”).

1.2For the personal information described in this policy we are the “controller” (under the EU and UK GDPR) or the “business” (under the California Consumer Privacy Act). Our contact details for privacy matters are in section 19.

1.3This policy applies to the Service only. It does not apply to third-party websites and services that we link to or rely on, such as Google and Stripe, which have their own policies (see sections 7 and 8).

1.4It should be read together with our Terms & Conditions. Terms we use, such as “Plan” and “Content”, have the meanings given in the Terms.

02Information we collect

2.1We collect the following categories of personal information. The table also shows where it comes from and why we use it.

2.2If you pay by card, your card details are entered on pages hosted by Stripe and are handled by Stripe. We never receive or store your full card number, expiry date or security code.

03Information we do not collect

3.1We do not knowingly collect precise location, biometric or health data, government identifiers, or the contents of your camera, microphone or contacts. We do not collect your Google password. We do not use advertising cookies or sell personal information, and we do not currently use third-party analytics or cross-site tracking.

04How we use personal information and our legal bases

4.1We use personal information only for the purposes below. If you are in the European Economic Area, the United Kingdom or Switzerland, the table shows the legal basis for each.

4.2Where we rely on legitimate interests, we balance them against your rights and freedoms and you can object (see section 12). We do not use your Content to train machine-learning models or to build advertising profiles.

4.3We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Plan limits and watermarks are applied automatically according to your Plan and are not profiling.

05Who we share information with

5.1We do not sell personal information. We share it only with the recipients below, and only as needed for the stated purpose.

5.2We also share information: with people you choose, such as team members you add or anyone who has a share link you create; where we are required to by law, court order or lawful request; to protect the rights, property, safety or security of our users, the public or ourselves; and with a successor in a merger, acquisition, financing or sale of assets, who must honour this policy or give you notice of changes.

5.3Service providers act on our instructions under written agreements that require them to protect personal information and use it only to provide services to us, except that Stripe and Google also act as independent controllers for their own purposes. A current list of the providers we use is available on request.

06Cookies, local storage and similar technologies

6.1We use browser storage and a small number of cookies that are strictly necessary to provide the Service you ask for. We do not use advertising or tracking cookies, so we do not show a cookie banner. If that changes we will update this page and ask for your consent where the law requires.

6.2Fonts are hosted on our own site, so loading a page does not send your IP address to a font provider. You can block or delete cookies and local storage in your browser settings, but parts of the Service will not work without them, and clearing local storage removes projects that are saved only on your device. Because we do not track you across other sites, we do not change our behaviour in response to “Do Not Track” signals.

07Payments

7.1Payments are handled by Stripe. When you subscribe, your browser is sent to a Stripe-hosted page to enter your payment details. Stripe processes them under its own privacy policy and terms, and may act as the merchant of record where its Managed Payments service applies. We receive confirmation of payment status, your plan and subscription details, billing details you provide, and a customer reference, and we keep invoices as described in section 10.

08Sign in with Google

8.1We use Google Sign-In to authenticate you. We request only your name, email address and profile picture, and we use them only to create and operate your Account and to personalise the Service. We do not use Google user data for advertising, we do not sell it, and we do not transfer it to others except to provide or improve the Service, to comply with law, or as part of a merger or acquisition. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. You can review or revoke access at any time from your Google account.

09International transfers

9.1We and our providers may process and store information in countries other than where you live, including the United States, which may have different data protection laws. Where we transfer personal information from the EEA, the UK or Switzerland to a country without an adequacy decision, we use appropriate safeguards, such as the European Commission’s standard contractual clauses and the UK International Data Transfer Addendum, together with supplementary measures where needed. You can ask us for a copy of the safeguards at [PRIVACY EMAIL].

10How long we keep personal information

10.1We may keep information for longer where necessary to comply with a legal obligation, resolve disputes, prevent fraud or enforce our agreements. Stripe and Google retain information under their own policies.

11How we protect personal information

11.1We use technical and organisational measures appropriate to the risk, including:

• encryption in transit using HTTPS, with HSTS, and encryption at rest for server-side data held by our providers;
• a strict Content Security Policy, escaping of user-generated text, and no inline scripts, to reduce cross-site scripting;
• hosted payment pages, so card details never touch our systems, and server-side keys that are never exposed to the browser;
• least-privilege access to production systems, with access limited to people who need it;
• verification of sign-in tokens, anti-forgery tokens on requests, and the ability for you to sign out of all devices; and
• vetting of providers and written data-protection terms with them.

11.2No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please protect your Google account and device. Report suspected vulnerabilities as set out in our Terms & Conditions.

12Your rights and choices

12.1Depending on where you live, you may have some or all of the following rights. We will not discriminate against you for exercising them.

Self-service. You can exercise many rights yourself in Account settings: edit your profile and billing details (rectification), download a JSON export of your profile, preferences, billing records and projects (access and portability), delete saved projects, change notification choices (consent), and delete your Account (erasure). Sign-out of all devices is on the Security page.

12.2To make a request that you cannot make in the settings, email [PRIVACY EMAIL] from the address on your Account. We may need to verify your identity, and an authorised agent may act for you with written permission. We will respond within one month (45 days for California, extendable by a further 45 days where permitted), and will tell you if we need more time or cannot comply and why.

12.3To stop marketing messages, switch them off in Account settings or use the unsubscribe link. We will still send essential service messages such as receipts and security alerts.

13Children

13.1The Service is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, contact us at [PRIVACY EMAIL] and we will delete it.

14Links and shared content

14.1The Service may link to other websites and services whose privacy practices we do not control. Anything you place in a share link can be viewed by anyone with the link, and we cannot control onward sharing, so avoid including personal information in project names or designs that you share.

15Personal data breaches

15.1If a breach of security leads to a high risk to your rights and freedoms, we will notify you and the relevant authorities without undue delay and within the time required by law, and we will tell you what happened, what information was involved and what we are doing about it.

16Notice for California residents

16.1This section supplements this policy for California residents under the California Consumer Privacy Act as amended (CCPA/CPRA). In the last 12 months we have collected, and disclosed to service providers for business purposes, the following categories of personal information:

16.2We do not sell personal information and do not share it for cross-context behavioural advertising, and we have no actual knowledge of selling or sharing the personal information of anyone under 16. We use sensitive personal information, if any, only as permitted by law. You can submit requests as described in section 12. We recognise opt-out preference signals, although they have no effect because we do not sell or share.

17Other regions

Australia. We handle personal information in line with the Australian Privacy Principles. You may request access to and correction of your information, and you may complain to us and, if unsatisfied, to the Office of the Australian Information Commissioner.

Canada. We handle personal information in line with PIPEDA and applicable provincial laws. You may request access and correction and may complain to the Office of the Privacy Commissioner of Canada.

EEA and UK. Details of our legal bases are in section 4. Where required, our representative in the EU is [EU REPRESENTATIVE] and in the UK is [UK REPRESENTATIVE]. You may complain to your national supervisory authority, for example the Information Commissioner’s Office in the UK.

Other countries. We apply the rights in section 12 to everyone and will honour additional rights that apply to you under local law.

18Changes to this policy

18.1We may update this policy from time to time. We will post the new version here with a new effective date and, for material changes, notify you by email or in the Service before they take effect. Earlier versions are available on request.

19Contact and complaints

Privacy questions and requests: [PRIVACY EMAIL]. Post: [LEGAL ENTITY NAME], [REGISTERED ADDRESS].

Data protection officer (if appointed): [DPO CONTACT].

If you are not satisfied with our response, you have the right to complain to your data protection authority. We would appreciate the chance to resolve your concern first.