Privacy Policy
Last updated 19 October 2026 · Contact us
Who we are
This Privacy Policy explains how the operator of Design YAL ("we") handles personal data. Send privacy questions and requests through our contact page at /contact. Last updated: 19 October 2026.
Data we process and why
We process your account identifier, email, name/avatar when supplied, sign-in information, plan tier, usage counters, time zone and legal acceptance timestamp (lawful basis: performing the service contract). We store your saved projects, walls, openings, room labels, fixtures, furniture, project unit prices, custom lines, contingency and a personal price list by unit and currency (contract). These are used to authenticate you, save your work, enforce plan limits and operate the service. Security and abuse prevention, including temporary hashed network addresses for rate limiting, rely on our legitimate interest in keeping the service safe.
Uploaded images and AI providers
Photos and plans you upload for AI plan scanning or restyle are sent to an AI provider for processing. Your style request or relevant project summary is also sent through our AI gateway to produce your result (basis: your request to use the feature). Avoid personal, confidential or sensitive information in uploads. We do not store uploaded photos beyond processing your request unless you save the result to a project.
First-party analytics
With your consent, we record a small allow-list of product events such as signup, project creation, first edit, quantity viewing, export format, successful AI use, pricing page views, waitlist joins and limit hits. Events include your account identifier, event name, timestamp and limited properties such as project ID, format, tier or limit category—not uploaded images, questions, email addresses or project content. Reporting is restricted to the operator. This is first-party measurement, not advertising tracking or cross-site profiling, and you can accept or reject it in the consent banner; rejecting it does not limit the service.
Cookies and browser storage
The app stores in your browser: your sign-in session (strictly necessary), preferences such as units, drawing mode and view options (strictly necessary to honour your choices), offline project copies you explicitly save (at your request), and your analytics consent choice. Product analytics events are sent only after you accept in the consent banner. We do not use advertising or third-party tracking cookies.
Pro waitlist and contact form
If you join a waitlist for a planned paid tier, we store your email, the tier you chose and the date, and use it only to tell you when that tier launches (basis: your consent). If you use the contact form, we store your optional name, email and message to reply to you. To limit abuse, both forms use a temporary hashed network address for rate limiting.
Sharing and comments
An active unguessable share link gives its holder read-only access to that project and its pinned comments. Signed-in viewers can add and report comments. Revoke the link to stop subsequent access. Comment text, coordinates and reports are stored with an author account identifier; email addresses are not exposed to viewers.
Contractor data
Contractors use individual private invitation links without an account. We process company name, contact email, line prices, notes, availability and estimated duration solely so the requesting homeowner can compare quotes and contact the contractor about that job. Other contractors and share-link viewers cannot see these submissions or contact details. Invitation tokens are stored only as hashes. A temporary hashed network address limits submission abuse. Requests auto-close after 30 days; all request and quote data, including selected bids and contacts, is permanently deleted 30 days after closure by daily cleanup, which may take up to 24 hours, and also when the project or account is deleted. Homeowners may download comparison files; downloaded copies are outside our control. Contact us through /contact for data requests.
Device storage and offline access
Session storage supports sign-in. Installed app resources and any offline project copies you explicitly save are stored on your current device. Offline copies are read-only and are not automatically erased by account deletion. Remove them in Presentation and clear site storage on each device if needed. Downloads and third-party saved copies are outside our control.
Service providers and international transfers
We use these categories of providers to run the service: cloud hosting and database/authentication providers that store account and project data, email delivery providers, and AI model providers that process your AI plan scanning, restyle or Copilot requests. Providers may process data in other countries; where they do, transfers rely on appropriate safeguards such as adequacy decisions or standard contractual clauses. We do not sell or share personal information for cross-context behavioural advertising.
Retention
Account and project data are deleted from the active service when you delete your account, and from backups within 30 days. Error logs and analytics events are kept for 12 months. Waitlist entries are kept until you ask us to remove them or the paid plans launch. Contact messages are kept as long as needed to handle your request.
Your rights and deletion
You can request access, correction, deletion, portability or restriction of your data, object to processing, and withdraw consent (for example analytics consent) at any time through our contact page at /contact. You can delete your account yourself in Profile after typing DELETE; this removes your projects, comments authored by you, share links, waitlist entries, usage/credit records, event records, legal acceptance and account/profile and personal price list. Device copies and downloaded exports remain until you remove them. You may also contact your local data protection authority.
Security and children
We protect data with encryption in transit, access controls, hashed invitation tokens and server-side authorization. No method is perfectly secure; keep your sign-in credentials private. The service is not directed at children under 16, and we do not knowingly collect their data; contact us to remove any such data.
Changes to Terms and Privacy Policy
We may update these Terms and the Privacy Policy at any time. Updates are published on the website and in the app, with the 'Last updated' date shown at the top. We do not send email or other individual notifications about changes. Users are responsible for reviewing the Terms periodically. Continued use after an update is published constitutes acceptance of the updated Terms. We store the accepted Terms version and acceptance timestamp to remember in-app acceptance of material changes.