Privacy Policy

Last updated: October 16, 2026

This policy explains what data Instaroom AI collects, how we use it, and the choices you have. In short: we use your room photos only to create your designs, we do not use them to train AI models, and we never sell your images or personal data.

1Who is responsible

Instaroom AI is an AI-powered interior-design app operated by Kirill Kazakov, Sole Trader (IČO 29900077), Polská 1260/24, Vinohrady, 120 00 Praha 2, Czech Republic. Kirill Kazakov is the data controller under the GDPR. You can reach us about privacy at instaroom.team@gmail.com. We have not appointed a data protection officer because the law does not require one for our processing.

2Who this applies to

This policy applies to everyone who uses the app and this website. The Service is for adults aged 18 and over.

3Information we collect

• Account information. When you sign in with Apple: an account identifier and, if you choose to share them, your name and email address (Apple may give us a private relay address instead). We store Apple sign-in credentials encrypted so we can revoke them when you delete your account.
• Content you provide. Room photos you upload or take, reference room photos, product photos, your Design Chat messages, and the choices and instructions you give.
• Generated content. The designs created for you and the details needed to keep editing them.
• Usage and device data. App events, crash reports, device model, operating system and app version, and a push notification token if you allow notifications.
• Subscription information. Your plan, trial and purchase events. Apple handles payment; we never receive your card details.
• Consent records. When you allowed or withdrew AI processing, and which version of the request you saw.
• Support messages you send us.

Photo metadata. Before a photo leaves your device, the app removes personal metadata from it, such as location, capture time and device serial numbers.

4Device permissions

The app may ask for access to your camera (to photograph a room), your photo library (to choose and save images) and notifications (to tell you when a design is ready). You can change these in your device settings at any time.

5Why we use your data, and on what legal basis

• To provide the Service: your account, storing your rooms and designs, generating and editing designs, Design Chat, notifications you asked for. Basis: our contract with you (GDPR Art. 6(1)(b)). Without your photo and instructions we cannot create a design.
• Sending your content to AI providers (section 6): necessary for our contract with you; we also ask your explicit permission in the app before the first AI request.
• Subscriptions and billing: contract, and our legal obligations for accounting and tax (Art. 6(1)(c)).
• Analytics and crash reports (section 8): our legitimate interest in understanding how the app is used and fixing errors (Art. 6(1)(f)). You can object at any time by emailing us.
• Security, fraud and abuse prevention, including billing reconciliation after an account is deleted: our legitimate interest in protecting the Service and its users.
• Support and legal requests: contract, legal obligations and our legitimate interest in answering you.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. AI models generate images and replies, but they do not decide anything about you.

6AI processing

Before the first AI request we ask your permission to send the relevant room, reference and product images, descriptions, design choices and instructions to our AI providers. You can withdraw that permission in Settings to stop future AI requests; this does not recall requests already sent, and your saved designs stay available. A material change to which providers we use, or why, requires your permission again.

Our AI providers are Google, OpenAI and Anthropic, reached directly or through our AI service provider OpenRouter. Their models generate and edit your designs and read your Design Chat messages. Anthropic receives text only, never images. So that you can keep editing a design, a provider may store the relevant images and instructions for a limited time (section 11).

We use these providers' paid business services. Under their terms they process this content to return results to us and do not use it to train their models; they may keep it for a limited time for abuse monitoring and security. We do not use your content to train AI models either.

Images the Service generates are made by AI. Images created during a trial carry a visible "Instaroom AI" badge, and providers may add their own invisible marks that identify images as AI-generated.

7What we don't do

We do not sell your images or personal data, and we do not use them for advertising. We do not use your photos for facial recognition, biometric identification, profiling or surveillance. We do not intend to process special categories of data (such as health or religion), even if something in a room photo might reveal them; please avoid uploading photos of people or sensitive documents.

8Analytics and crash reports

We use PostHog to understand how the app is used so we can improve it: product events (such as which screens and features are used), your account identifier and device information. AI usage events do not include your prompts or images. We use Sentry to receive crash reports: the error, device and app version and your account identifier, without photos, messages or your IP address.

9Who receives your data

We share only the data each service provider needs to run its part of the Service, under contracts that require them to protect it:

• Google, OpenRouter, OpenAI and Anthropic: AI processing (section 6).
• Convex: hosting, database, file storage and sign-in.
• RevenueCat: subscription status and purchase events.
• PostHog: analytics. Sentry: crash reports.
• Expo: delivering push notifications.
• Apple: Sign in with Apple, App Store billing and notification delivery.

We may also disclose data where the law requires it, to protect rights and safety, or to a buyer of the business, who would remain bound by this policy.

10International data transfers

Some providers process data outside the European Economic Area, mainly in the United States. Where they do, we rely on an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework, for providers certified under it) or on the European Commission's standard contractual clauses. You can ask us for details of the safeguard used for a provider.

11How long we keep data

• Your rooms, photos, designs and chats: while your account is active, until you delete them or your account.
• Editing context stored by an AI provider: up to 55 days (section 6).
• Analytics and diagnostic logs: for a limited period, around 30 days for logs.
• Subscription event records: about 90 days.
• After you delete your account: the minimum records needed for billing, refunds, abuse prevention and accounting law, including a hashed identifier of your account. These records contain no room photos or instructions and are kept only as long as the applicable accounting and security requirements need.

12Deleting your data

You can delete individual design projects in the app, and you can delete your account and its data in Settings or by emailing us. Deletion removes your rooms, photos, designs and chats, asks Apple to revoke your Sign in with Apple credentials, and asks the AI provider that stores editing context to delete it. Provider backups and security logs may remain for the limited periods their own policies set. Subscriptions are cancelled separately in your Apple account.

13Your rights

Under the GDPR you have the right to access your data, correct it, delete it, receive it in a portable format, restrict its processing, and object to processing based on our legitimate interests, including analytics. Where we rely on your permission, you can withdraw it at any time without affecting earlier processing. To exercise these rights, email us; we answer within one month.

You may also complain to a supervisory authority, in particular in the country where you live or work. In the Czech Republic it is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz.

14US privacy rights

We do not sell personal information or share it for cross-context behavioural advertising, and we do not use sensitive personal information to infer characteristics about you. Wherever you live, you can ask us to access, correct or delete your data at the email below, and we will not treat you differently for doing so.

15Security

We apply reasonable technical and organizational measures to protect your data, including encrypted connections, access controls and encrypted storage of sign-in credentials. No method of transmission or storage is completely secure, but we work to safeguard your information.

16Third-party services

Links and searches that open third-party websites, such as stores, are governed by those sites' own privacy policies.

17Children

The Service is for adults aged 18 and over and is not directed to children. We do not knowingly collect children's data. If you believe a child has given us data, contact us and we will delete it.

18Changes to this policy

We may update this policy, for example when we add a provider or a feature. We will tell you about material changes in the app or by email before they take effect, and ask your permission again where the law or our AI permission requires it. The "Last updated" date above shows the current version.