Privacy Notice

1. Controller and scope

The controller of personal data processed through Vizterior is Szymon Niemiec, a sole trader registered in CEIDG, with registered and correspondence address Kraśnica-Kolonia 77F, 62-590 Kraśnica-Kolonia, Poland, NIP 6653038169 and REGON 388609890. For privacy matters, email niemiec.say@gmail.com, write to that address or call +48 607 309 910.

This Notice applies to vizterior.com, user accounts and the related AI interior visualisation service (the "Service"). It should be read with our Terms of Use. We have not appointed a data protection officer; privacy requests go directly to the controller.

2. Data we collect

Depending on how you use the Service, we process:

• Account data: email address, name where supplied, internal user ID, authentication method and account timestamps;
• Workspace content: private photos, sketches, reference images, prompts, generated Outputs, projects, messages, chosen settings and feedback;
• Billing data: Stripe customer and transaction references, selected plan, subscription state, credit ledger, payment status, refunds and limited invoice or tax information; we do not receive or store full card details;
• Technical and security data: IP address or a one-way hash derived from it for rate limiting, browser and device information, request time, route, session and security events, and sanitized error details;
• Communications: support, complaint, privacy and optional feedback messages, reply address and related delivery information; and
• Optional analytics: pseudonymous account or browser identifiers, allowlisted product events and limited campaign/referral attribution after consent.

Most data comes from you or your device. OAuth account data comes from Google or Apple if you choose that sign-in method; payment status comes from Stripe. Account details and content needed to operate the Service are contractual requirements. Optional analytics and a reply email in the feedback form are not required.

3. Purposes and legal bases

Our legitimate interests include network and information security, fraud prevention, enforcing agreements, improving reliability and defending legal claims. We balance those interests against your rights. Where processing is required by law, this can include tax, accounting, consumer-protection and authority requests.

We do not sell personal data, use it for third-party behavioural advertising or send marketing email at launch. If that changes, we will provide the required information and choice first.

4. Images and AI processing

Images and instructions selected for a generation are sent to OpenAI to create the requested Output. Under OpenAI's default API controls, API data is not used to train its models unless the customer opts in; Vizterior does not opt private customer content into training. Default abuse-monitoring data may be retained for up to 30 days, or longer where legally required. Deleting a project cannot recall a request already submitted to an AI provider.

Uploads are private and served through short-lived access links. Supported images are decoded and normalized, which removes embedded metadata. Do not upload health, biometric, political, religious, sexual-orientation or other sensitive data, official identifiers, financial credentials, private keys, or images of people unless they are necessary and you have a lawful basis and all required permissions.

AI generation is automated, but Vizterior does not make decisions based solely on automated processing that produce legal or similarly significant effects about you. Stripe may separately use automated fraud-prevention systems under its own policy.

5. Recipients and providers

We disclose data only as needed to provide, secure and support the Service, complete a transaction, comply with law or protect legal rights. We may also disclose relevant data to professional advisers, insurers, authorities or a successor in a business reorganisation, subject to applicable confidentiality and data-protection duties.

6. International transfers

Supabase primary project data and PostHog analytics are hosted in the EU. Other providers may process data outside the European Economic Area, including in the United States. Where the destination is not covered by an applicable adequacy decision, transfers are protected using safeguards such as the European Commission's Standard Contractual Clauses and supplementary measures where appropriate. A provider may instead rely on an adequacy framework where it is validly certified. Contact us to request more information or a copy of relevant safeguards, subject to protection of confidential information.

7. Retention and deletion

We keep personal data only for the purpose and period reasonably necessary, applying these rules:

• account and workspace content remains until you delete the project or account; abandoned pending uploads are marked for deletion after 24 hours;
• project and account deletion is queued, access is blocked, provider cleanup is retried after failures, and storage deletion is swept again after existing signed upload links have expired;
• PostHog product events are configured for 12 months; the analytics consent cookie lasts up to 12 months and limited attribution up to 90 days unless cleared earlier;
• security and operational records remain for the shortest period needed to detect, investigate and document incidents or service failures;
• support and legal records remain while the matter is active and, where necessary, through the applicable claim period; and
• transaction, invoice, tax, fraud and dispute records remain for periods imposed by law or reasonably required to establish and defend claims, including records kept independently by Stripe as merchant of record.

Deletion is irreversible in the product. Residual encrypted backup copies may remain until ordinary provider backup rotation completes and are not used for normal product access. We may retain a minimal record where required by law, to resolve a dispute or to prevent repeated abuse. Data already downloaded by you or lawfully received by another controller is outside our control.

8. Cookies and analytics

Essential cookies keep you signed in, remember security state and store your cookie choice. They are necessary to provide the Service. PostHog analytics and the 90-day attribution cookie load only after you accept analytics. Analytics uses allowlisted events and pseudonymous identifiers; autocapture, session recording, heatmaps and GeoIP enrichment are disabled, and we do not intentionally send images, prompts, filenames, email addresses or full URLs.

You can decline analytics without losing access and withdraw consent at any time. Withdrawal does not affect earlier lawful processing. Use Cookie settings to review or change your choice.

9. Your rights

Subject to the conditions in applicable law, you may request access, correction, deletion, restriction, objection and portability of your personal data. You may withdraw consent at any time and object to processing based on legitimate interests. You also have the right to complain to the supervisory authority where you live or work, or where an alleged infringement occurred. In Poland this is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.

Use Settings → Privacy for account deletion or email niemiec.say@gmail.com for any request, including a manual copy of data not available in the product. We normally respond within one month. We may ask only for information reasonably necessary to verify identity. Rights are not absolute; if we refuse or limit a request, we will explain why and identify available complaint options.

10. Security, children and changes

We use access controls, private object storage, row-level database security, short-lived links, encryption in transit, rate limits, restricted service credentials and data minimisation. No system is completely secure; protect your password and report suspected misuse promptly.

The Service is for adults aged 18 or over and is not knowingly offered to children. If you believe a child has provided data, contact us so we can investigate and delete it where required.

We may update this Notice when the Service, providers or law changes. Material changes will be communicated by email or in the Service where appropriate. The date above identifies the current version.