Privacy Policy

This Privacy Policy explains how the operator of Remake.House(“we”, “us”) collects, uses, and shares your personal data when you use the Remake.Housewebsite and services (the “Service”). We act as the data controller for this processing. For privacy questions or requests, use the contact page.

1. What we collect

• Account data — e-mail address, name (if provided by you or your sign-in provider, e.g. Google), and authentication identifiers.
• Photos and images— the photos you upload (“Inputs”) and the images we generate for you (“Outputs”). Photos of a home can reveal information about you; avoid uploading photos with identifiable people in them.
• Payment data — handled by our payment processor. We receive plan, payment status, and partial card metadata (brand, last four digits) — never full card numbers.
• Usage and technical data — generations requested, credits used, settings chosen, pages visited, IP address, device/browser type, and logs needed for security and rate limiting.
• Communications — messages and attachments you send via the contact form or e-mail.

2. How we use it, and the legal bases

• Providing the Service — generating images from your Inputs, storing your gallery, managing credits and subscriptions. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
• Content moderation — automated screening of uploads to keep prohibited content out of the pipeline. Legal basis: legitimate interests (Art. 6(1)(f)) — keeping the Service safe and lawful.
• Billing and accounting — payments, invoices, tax records. Legal bases: contract and legal obligation (Art. 6(1)(c)).
• Security and abuse prevention — rate limiting, fraud detection, log analysis. Legal basis: legitimate interests.
• Service communications — sign-in links, receipts, important changes. Legal basis: contract. Marketing e-mail, if ever sent, only with your consent and a working unsubscribe. Legal basis: consent (Art. 6(1)(a)).
• Analytics— aggregated, cookieless page analytics to understand product usage: Umami (hosted in the EU) and our hosting platform’s built-in analytics, which identifies visits via a short-lived anonymous hash rather than cookies or persistent identifiers. These analytics tools build no cross-site profiles and use no advertising identifiers. Legal basis: legitimate interests.
• Advertising and conversion measurement— we use the Meta (Facebook) Pixel and Meta’s Conversions API to measure our advertising — for example, which ad led to a sign-up or a purchase — and to build audiences for our campaigns. This sets advertising cookies (such as _fbp and _fbc) and shares event data — including the actions you took, your IP address, and a hashed (irreversible) version of your e-mail — with Meta Platforms, Inc., which uses it as an independent controller for its own advertising systems. Legal basis: your consent (Art. 6(1)(a)) where required — in the EEA and UK the Pixel loads only after you opt in, and we honour Global Privacy Control signals everywhere; for visitors elsewhere, our legitimate interest in measuring and improving our advertising.
• Error monitoring — when something breaks, we send an error report to our error-monitoring provider containing the error details, your IP address, browser/device type, and the pages involved. For a sample of sessions where an error occurs, a replay of the interface state may be recorded with text and images masked. Legal basis: legitimate interests — keeping the Service working.

We do not use your photos or generated images to train AI models, and we never sell your photos, generated images, or account content. We do share limited advertising-measurement data with Meta as described above and in sections 8 and 9; you can opt out at any time.

3. AI processing

To generate images and moderate content, your Inputs are transmitted to specialised AI infrastructure providers acting as our processors. They process your images solely to return the result and are bound by API data-handling terms that restrict use of your content for their own purposes.

4. How long we keep it

• Uploaded photos: the original upload file is deleted from storage on a short schedule (approximately one hour) after processing; free-preview uploads within approximately two hours.
• Generated images: kept in your gallery until you delete them or close your account.
• Account, credit, and billing records: for the life of your account, then for legally required accounting retention periods.
• Logs and rate-limit counters: short-lived — typically days to weeks.
• Error reports and session replays: retained by our monitoring provider for up to 90 days, then deleted.
• Contact messages: as long as needed to handle your request and for a reasonable period after.

5. Who we share it with

Only processors that help us run the Service, under data-processing agreements:

• Cloudflare — image storage and global content delivery, with servers across many regions operated in line with the applicable local regulations
• Google — sign-in, if you choose it
• Stripe — payments
• Umami — privacy-friendly web analytics (data hosted in the EU)
• Meta Platforms — advertising measurement (Pixel + Conversions API), where you have consented or where otherwise permitted
• and our cloud-hosting, database, AI image-processing, e-mail-delivery, security and error-monitoring providers — each engaged as a processor under a data-processing agreement

A complete, current list of our subprocessors is available on request via the contact page.

We may also disclose data where required by law, to protect rights and safety, or as part of a business transfer (with notice to you).

6. International transfers

Some providers process data in the United States and other countries outside the EEA/UK. Where that happens we rely on appropriate safeguards: the EU–US Data Privacy Framework where the provider is certified, and/or the European Commission’s Standard Contractual Clauses (with the UK Addendum where relevant).

7. Your rights (EEA/UK)

If the GDPR or UK GDPR applies to you, you have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• have your data deleted (“right to be forgotten”);
• receive a portable copy of data you provided;
• restrict or object to processing based on legitimate interests;
• withdraw consent at any time, where processing is based on it.

Exercise these rights via the contact page; we respond within one month. You can also complain to your local data-protection supervisory authority.

8. US residents (including California)

If you live in California or another US state with a comprehensive privacy law, you have rights to know, access, correct, and delete the personal information we hold, and the right not to be discriminated against for exercising them. Our use of the Meta Pixel for advertising measurement may count as “sharing” (and, in some states, a “sale”) of personal information for cross-context behavioral advertising. You can opt out at any time: decline the cookie banner, browse with Global Privacy Control enabled (we honor GPC signals), or ask us via the contact page. We do not use sensitive personal information for purposes requiring an opt-out, and we do not knowingly sell or share the personal information of anyone under 16.

9. Cookies

We use strictly necessary cookies for authentication and your theme preference, plus cookieless analytics that build no cross-site profiles. For advertising measurement we use the Meta Pixel, which sets advertising cookies (such as _fbp and _fbc) and may share data with Meta. In the EEA and UK these load only after you opt in via our cookie banner; everywhere, we honour Global Privacy Control signals, and you can decline or clear these cookies at any time through the banner or your browser settings.

10. Security

We use industry-standard measures: encrypted transport (TLS), access controls, scoped tokens, and isolation between users’ content. No system is perfectly secure — if a breach affects your data, we will notify you and regulators as the law requires.

11. Children

The Service is not directed to children under 16 and we do not knowingly collect their data. If you believe a child has provided us personal data, contact us and we will delete it.

12. Changes

We may update this policy; material changes will be announced by e-mail or in-product before they take effect. The date at the top reflects the current version.