1. Who we are and how to contact us
CodeBucks, a sole proprietorship based in Gujarat, India, operates AI Room Designer at airoomdesignapp.com. This policy explains how we handle personal information when you visit, create an account, upload content, generate designs, buy a subscription or contact us.
We decide why and how information is processed for account administration, billing records, security, support and communications. Where relevant law applies, we are the data controller or Data Fiduciary for those activities.
Where a business customer decides how personal information in its project content is processed and we follow its instructions, we may act as its processor. That customer's privacy notice and any applicable data-processing agreement also apply; contact that business or contact us to direct a request appropriately.
Mandatory consumer rights take priority over anything inconsistent in this policy.
2. Information we collect and where it comes from
| Category | Information and source | Main purposes |
|---|---|---|
| Account and identity | Name, email, account identifier, verification status, team membership, role and invitation information supplied by you or your team | Create and manage accounts, authenticate users, administer teams and contact you |
| Authentication and sessions | Sign-in and verification records, session identifiers, IP address, browser/user-agent information, and credentials required by the sign-in method used | Secure sign-in, prevent misuse and maintain sessions |
| Uploaded and generated content | Photos, sketches, plans, CAD files, reference images, instructions, filenames, file metadata, generated images and workflow results that you or your team submit or create | Run requested tools, store projects, deliver results and investigate reported problems |
| Service activity | Project identifiers, selected options, run history and status, usage and credit records, errors and related operational records | Provide features, account for credits, diagnose failures, secure and maintain the Service |
| Subscription and transaction information | Plan, purchase and renewal dates, payment status, amounts, currency, transaction/subscription references and billing-related communications received from you or the payment service | Activate paid features, reconcile payments, manage cancellations, refunds, taxes and disputes |
| Support and preferences | Messages, feedback, issue reports, contact details and communication preferences you provide | Respond to you, resolve complaints and honour your choices |
Photos and plans can contain personal information about other people, such as faces, addresses or details of a private home. We receive that information from the uploader, not necessarily from the person concerned. If you upload another person's information, ensure you have authority and a lawful basis to do so, provide any required notices, and minimise what you include.
We do not ask you to provide government identity documents, health information, biometric identification data, intimate images or other sensitive information for room design. Do not include them in uploads or support messages. We do not use room images to identify people through facial recognition. An ordinary photo may still reveal sensitive information, so check it before uploading.
When you choose Google sign-in, where available, we receive the account information authorised for sign-in, such as your name, email, Google account identifier and profile image if supplied. When you choose email magic-link sign-in, we use your email and time-limited verification information to authenticate you. Keep sign-in links private.
Providing information needed for authentication, processing a requested image or completing a purchase is necessary to supply that feature. Optional marketing permission is not necessary to use the Service.
3. How we use information
We use information to provide the features you request; manage accounts and shared projects; process images and deliver results; track credits; administer subscriptions, cancellations and refunds; respond to support and rights requests; prevent abuse and unauthorised access; investigate technical failures; and comply with legal obligations or establish, exercise or defend legal claims.
We may use operational usage and error records to understand reliability and improve the Service. Our handling of images is described in section 4.
We do not sell personal information, use it for cross-context behavioural advertising, or run third-party advertising or audience-analytics tools on the Service at present. We do not make decisions based solely on automated processing that produce legal or similarly significant effects about you.
4. AI processing and your images
We send the content needed for your request to third-party AI services through their commercial APIs. We do not sell it or give it to them for any other purpose. They handle it under their own terms, which may include keeping it for a limited time for safety, abuse monitoring and legal compliance. Some workflows involve more than one processing stage or provider.
CodeBucks does not use your uploaded or generated images to train its own AI models. We do not publish or use them in advertising, public galleries, testimonials or our portfolio without separate permission. If you give permission, we explain its scope and how to withdraw it.
Authorised personnel may access content to resolve support requests, investigate security or misuse, operate the requested Service or comply with law. Uploading or generating content does not make it public. Team members may access it according to their permissions; copies you share outside the Service are subject to the recipient's handling.
5. Who receives information
We disclose relevant information to the following categories of recipients for the purposes described in this policy:
- Hosting, storage and database providers: store and serve account records, project content and results.
- AI processing providers and routing services: process the content needed for requested generation or analysis.
- Authentication, security and operational service providers: support sign-in, email verification, abuse prevention and technical operation.
- Email and customer-support service providers: deliver necessary messages and help us respond to requests.
- Payment and billing services: handle purchases, payment security, subscriptions, tax, refunds and disputes.
- Your team and people you choose to share with: access information according to the product's permissions and your actions.
- Professional advisers, authorities and other necessary recipients: receive information where required by law, needed for legal claims or reasonably necessary to protect rights and security, subject to applicable safeguards.
If the business is reorganised, financed, sold or transferred, relevant information may be disclosed during due diligence and transferred as part of that transaction under appropriate confidentiality and privacy protections. We will provide notices required by law.
Dodo Payments is our merchant of record. It collects payment and checkout information directly and acts as an independent controller for activities such as processing payments, fraud prevention, tax compliance and disputes. We receive the transaction and subscription information needed to operate your account; we do not store your complete payment-card number or security code in our application. Dodo's own Privacy Policy explains its handling of checkout information.
If you use Google sign-in when available, Google's own privacy terms also apply to its account and authentication services. Other providers' roles depend on their processing arrangements.
To request information about relevant recipients, contact us. We provide recipient identities where required by law.
6. Cookies and similar browser storage
We use cookies and similar browser storage only for sign-in, security and remembering interface preferences. We do not use advertising or analytics cookies. Authentication and payment providers describe their own cookies and security technology in their notices.
You can manage storage through your browser settings. Blocking essential storage may prevent sign-in or other requested features.
7. Service messages and promotional emails
We send messages needed for sign-in, security, billing, requested support and important Service changes.
Promotional emails are sent only if you opt in. You can unsubscribe at any time through the email link or by contacting us.
8. International processing
CodeBucks operates from India. Information may be processed in the United States, India and other countries where our service providers operate. Their data-protection laws may differ from those where you live.
Where the law requires a transfer safeguard, we rely on the data-protection terms our providers include in their standard service terms.
9. Retention, archiving and deletion
Account information, uploaded photos, results and projects are kept until you ask us to delete them or the account is deleted, subject to the periods below. Archiving a project does not delete it. Cancelling a subscription does not delete the account or its content.
- Deletion or closure requests: completed within 30 days of a verified request, subject to legally required retention. We email you when deletion is complete.
- Inactive accounts: we may delete an account and its content after 6 months with no sign-in or other activity in the account or its team and no active subscription, following 30 days' email notice. Signing in during the notice period cancels the deletion.
- Sign-in sessions and tokens: expired sessions, which hold your IP address and browser details, and expired sign-in links are deleted 7 days after they expire. Team invitations are deleted 30 days after they are accepted or expire.
- Temporary files: intermediate files created while processing a run are deleted about 7 days after the run ends; unfinished uploads are deleted within about 2 days.
- Support messages: kept for up to 24 months after the request is closed.
- Activity records: read notifications and webhook delivery history are deleted after 90 days, and email addresses in team-invitation records are removed after 12 months. We keep the record that you agreed to our terms until your account is deleted. If a sign-in link is never used and no account is created, that record is deleted after about 7 days.
Deleting a team owner's account deletes the whole team: all its projects, uploads and results, and every member's access to that team. Any subscription is cancelled first, and the deletion cannot be undone. A member who is not the owner can have their own account deleted without affecting the team's content.
When we delete a team, we also delete our own billing records for it; our payment provider, as merchant of record, keeps invoices and tax records as long as the law requires. Copies in backups may remain for a limited time until they are overwritten.
To request deletion, account closure or a copy of your personal information, contact us. Individual image downloads are available, but are not a full account-data export.
We may need to verify your identity, authority over a team and whether information also belongs to other users. We explain any information that cannot lawfully be deleted and why. Shared-team records and another customer's independent records may require separate handling.
10. Security
We use account authentication, team-based access restrictions and controlled access to stored files to reduce unauthorised access. We also use service providers to support security and reliable delivery. No online system can guarantee absolute security.
Keep sign-in links and credentials private and contact us promptly if you suspect misuse. We assess security incidents and make notifications to affected people and authorities where required by applicable law.
11. Your choices and requests
Depending on applicable law, you may ask to access or obtain a copy of personal information; correct it; delete it; restrict or object to processing; transfer information to another provider; withdraw consent; or complain about our handling. Some rights have exceptions, and a request may affect a feature that requires the information.
To make a request, contact us. We may ask for proportionate verification and, where relevant, evidence that an authorised agent can act for you. We will not require more information than reasonably necessary. We respond within the deadlines applicable to your request, explain any lawful refusal or extension, and do not discriminate against you for exercising a protected right.
You can ask us to review a refusal by replying and identifying the decision you are appealing. Where a statutory appeal right applies, we follow its deadlines and tell you how to contact the relevant authority.
12. European Economic Area and United Kingdom
This section applies where the EU GDPR or UK GDPR governs our processing.
Our legal bases depend on the activity:
| Activity | Legal basis |
|---|---|
| Creating your account and providing a feature you request under your contract | Necessity for performing the contract or taking requested steps before entering it |
| Managing business-user accounts, securing the Service, preventing abuse, resolving support issues and improving technical reliability | Legitimate interests in operating a safe and reliable service and managing customer relationships, balanced against your rights |
| Maintaining legally required records, responding to binding legal demands and required notifications | Compliance with applicable legal obligations |
| Optional promotional emails, optional storage where consent is required, and separately agreed publicity use of images | Consent |
| Establishing, exercising or defending legal claims | Legitimate interests or applicable legal obligations, as appropriate |
Where we act only as a business customer's processor, the customer determines the legal basis for the instructed processing; our contract with you is not automatically a legal basis for processing every person shown in an uploaded image.
You may have rights to access, rectification, erasure, restriction, portability and objection. You can withdraw consent at any time without affecting the lawfulness of earlier processing. You have an unconditional right to object to direct marketing. We normally respond to rights requests within one month; lawful extensions require notice and reasons.
You may complain to your local supervisory authority, including the UK Information Commissioner's Office or the appropriate EEA authority.
International processing and the safeguards actually used are described in section 8.
13. California and other United States residents
We do not sell personal information, share it for cross-context behavioural advertising or use it for targeted advertising. Where a state privacy law applies, you may request access, correction, deletion or a copy of your information by contacting us. We respond within the applicable legal deadline.
14. India
We handle personal information under applicable Indian law, including relevant provisions of the Information Technology Act and its rules and the Digital Personal Data Protection Act and Rules as they take effect. To request access, correction, deletion, withdrawal of consent or grievance redressal, contact us; withdrawing consent may affect features that need the information. As the relevant DPDP provisions apply, you may also nominate another person to exercise rights in the circumstances specified by law and approach the competent authority, including the Data Protection Board where applicable, subject to any requirement to first use our grievance mechanism.
15. Children and changes to this policy
Accounts and subscriptions are intended for people aged 18 or older. We do not knowingly offer accounts to children. If you believe a child has provided information or holds an account, contact us so we can investigate, restrict access and delete or otherwise handle the information as required by law.
We will update this policy as practices change and show the revised date. For material changes, we will provide an appropriate notice and obtain fresh consent where required before beginning the new processing.
Operator: CodeBucks, sole proprietorship, Gujarat, India.
Privacy and grievance contact: the Proprietor, CodeBucks — support@airoomdesignapp.com.