Privacy policy

1. Who the controller is

The data controller is Sparrowlabs sp. z o.o., ul. Tadeusza Korzona 115/15, 03-571 Warszawa, NIP 5243079518, KRS 0001258379, REGON 545417991. For matters relating to personal data, write to kontakt@redomium.com.

2. What we process and why

• Interior photos and videos you upload — to make the changes you ask for (legal basis: performance of the service, Art. 6(1)(b) GDPR). Photos may show people; if they are not needed, do not photograph them.
• The instructions you type and the descriptions of elements in photos — to understand what to change (Art. 6(1)(b)).
• The content of the client link and of quote requests to contractors (photo versions, studio name, contact details, comments, quotes) — when you publish them yourself (Art. 6(1)(b)).
• Data of a shop that registers the widget (name, email address, domains) and the number of try-ons — for billing and support (Art. 6(1)(b) and (f)).
• Technical data: time, page address and browser in server logs — for security and fixing errors (legitimate interest, Art. 6(1)(f)). Your IP address may be processed by the hosting provider when handling the connection.
• Anonymous statistics on choices (types of changes, product categories, colours) — only if you turn them on; they contain no photos, text or identifiers.
• Prices from contractor offers — only when the contractor ticks the consent box when sending an offer: the amount, the duration, the scope in numbers (m² of walls, number of pieces), the region and the month, without the company name, contact, notes or any link to the request. They are used to show average labour prices in the cost estimate (consent, Art. 6(1)(a) GDPR).
• Account data, if you create an account: email address, password (stored only as a hash), name or studio name, dates of sign-up and sign-ins — to run the account (Art. 6(1)(b) GDPR). An account is optional.
• Payments, if you buy credits or a plan: email address, billing name and address, VAT number (if you give one), the plans you bought, payment and credit history — to perform the contract and issue invoices (Art. 6(1)(b) and (c)). We never see your card details: they go straight to Stripe.
• Use of paid AI features: type of operation, time and estimated cost and, once you are signed in, the account identifier. Used to enforce limits, control costs and protect the service from abuse (Art. 6(1)(b) and (f)).
• Visit statistics, counted on the server from the page request itself, without scripts or cookies: the page address, the domain of the site you came from, the country derived from the IP address, the device type and an encrypted trace of the IP address and browser that changes every day (the address cannot be recovered from it). We do not store the IP address itself. Visits are not linked to your account unless you consent to analytics cookies. Purpose: knowing how many people use the service and where they come from (Art. 6(1)(f) GDPR).
• If you consent to analytics cookies: a random identifier from the rd_aid cookie that links your visits across days, and which studio features you use (for example adding photos, a successful edit, an export) — to develop what is useful (your consent, Art. 6(1)(a) GDPR and Art. 399 of the Polish Electronic Communications Law). You can withdraw consent at any time.

3. Where your projects are

Without an account, projects, photos and change history are saved only in your browser, on your device — we have no access to them, and they disappear when you clear your browser data. When you sign in, we also save projects on your account (database and files at Supabase, in Ireland) so you can open them on other devices; only you can access them. Projects made in this browser before signing in join the account. Apart from that, only these reach the server: the photo needed for the current edit, a client link or a quote request if you create them, photos sent from a phone with the QR code, and the video for the “Detailed 3D model from a video” feature — these files are temporary (see “How long we keep data”).

4. Who we entrust data to

We use providers that process data on our behalf and solely for the purpose of providing the service:

• Vercel Inc. (USA) — application hosting and storage of client links, quote requests to contractors, photos from phones and — temporarily — videos and models for the “Detailed 3D model from a video” feature.
• Features & Labels Inc. — fal.ai (USA) — AI models that edit photos and build 3D models and animations. It does not keep a history of our requests and deletes the photos we upload after 7 days.
• Anthropic PBC (USA) — the Claude model, which understands your instructions and names elements in photos.
• MakeSplat — only when you use the “Detailed 3D model from a video” feature; the video first goes to our storage at Vercel, and once it has been passed on to MakeSplat we delete it.
• Supabase Inc. (USA) — accounts, sign-in, projects saved on accounts and statistics; the database and files are located in the European Union (Ireland).
• Stripe Payments Europe, Limited (Ireland) — payments and invoices; Stripe processes card and payment details, and we receive information about the payment, plan and invoice.
• Upstash, Inc. (USA) — counters limiting the number of requests from one IP address (kept for up to 2 days).

Data is transferred outside the European Economic Area on the basis of standard contractual clauses approved by the European Commission or an adequacy decision (EU-US Data Privacy Framework), where the provider is covered by it.

5. How long we keep data

• Photos for editing at the AI provider: up to 7 days.
• Temporary files — photos sent from a phone, and videos and finished models for the “Detailed 3D model from a video” feature: we delete them once they have been used (photos from a phone when the upload window is closed). The phone upload window expires after 24 hours. Unused files older than 24 hours are removed by an automatic daily clean-up, so they are gone within 2 days at the latest.
• Client link and quote request to contractors: until you delete them (the “Delete link” and “Withdraw request” buttons).
• Shop account data: for as long as the widget is used and up to 5 years after it ends, if required by tax law.
• Payment data and invoices: 5 years from the end of the year in which the payment was made (tax and accounting law).
• Server logs: from 1 hour to 1 day, depending on the hosting plan (Vercel).
• Account data and projects saved on the account: until the project or the account is deleted — you can delete the account yourself on the Account page, together with its projects. We erase a deleted project completely after 30 days.
• Usage and visit statistics and studio events: 13 months. Visits are linked to an account only with consent to analytics cookies; after an account is deleted, the statistics remain without a link to it.
• Request counters per IP address: up to 2 days.

6. Cookies and browser storage

On your first visit we ask for consent to analytics cookies. You can change your decision at any time: “Cookie settings” in the page footer or in the project menu in the studio. We do not use advertising cookies or third-party analytics tools.

• Necessary — the service does not work without them, so we do not ask for consent: browser storage (IndexedDB and localStorage) with your projects and settings, such as the language; the rd_consent cookie with your cookie decision (12 months); sb-…-auth-token cookies with your sign-in session (only when signed in, until you sign out).
• Analytics — only with your consent: the rd_aid cookie with a random identifier (13 months). It links your visits across days and records which studio features you use. The data stays with us.

Fonts, the HEIC photo decoder and product photos are loaded from our own server, so your browser does not connect to Google or the shops for them.

7. Your rights

You have the right to access your data, to have it rectified or erased, to restrict its processing, to data portability and to object to processing based on legitimate interest. Write to kontakt@redomium.com. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.

8. Visualisations and reality

The results are visualisations created by AI. If you publish them, for example in a property sale listing, label them as visualisations.

9. Changes to this policy

When we change this policy, we will publish the new version on this page with a new date. We will inform you of significant changes in the app.