ROOMSUIT-AI — Privacy Policy

Last updated: 16 September 2026

Version: 2026-09-16-v6

1. Purpose and scope

This Policy explains the processing of personal data on roomsuit-ai.com and through related ROOMSUIT-AI features: accounts, AI interior visualization, Builder Mode, payments and support.

The Policy is a privacy notice. Visiting the website, remaining silent or reading this text does not replace consent where consent is required by law. It does not constitute consent to advertising, publication of photographs or model training, and does not replace the terms of service.

2. Who is responsible for your data

The personal data controller is:

• Sole Proprietor GEORGII NASHANIAN LEVON;
• registration number: 20325013;
• country of registration: Republic of Armenia;
• address: Malatia-Sebastia, Isakova 44, Armenia;
• privacy enquiries and support: roomsuit.support@gmail.com.

ROOMSUIT-AI is the service's brand, not a separate legal entity. “We” means the controller identified above. Engaging service providers does not remove our data protection obligations.

3. Data processed and its sources

The data involved depends on the features you use. We receive information directly from you, automatically through website operation, from the payment provider and, where an enquiry is made, from a user's representative or a person reporting an infringement.

• Account: email, supplied name or nickname, internal identifier, password hash, email verification status, sessions and account activity records. A password is submitted for registration or login; a hash is stored in the database for verification.
• Projects and AI: uploaded photographs, filenames and technical file properties, text you enter, preferences, selected styles, analysis results, generated images, job history and status. A photograph of a room can reveal information about people, property, location and private life.
• Builder Mode: dimensions, areas, openings, room purposes, materials, prices and calculations that you provide or generate in connection with a project.
• Payments and credits: order and transaction identifiers, selected plan or package, amount, currency, payment status and dates, credit grants, usage and balances, and payment enquiries.
• Technical information: IP address, browser and device information, request times and parameters, session identifiers, error, security and feature usage logs. The exact information depends on the operation and infrastructure configuration.
• Enquiries and records of acceptance: correspondence and attachments needed for support or a complaint, the date and version of the accepted policy and content rules, and records of handling user requests.

Derived data, including AI descriptions, may be inaccurate. It may also be personal data if it relates to an identifiable person. Removing a name from a file does not by itself anonymize an image.

4. Data minimization

Interior visualization does not require a passport, identity document, medical records, full card details, CVV/CVC, email password or exact home address. Do not submit these through projects or support. The payment provider separately requests the payment information it needs.

Before uploading, remove faces, documents, address signs, identifying numbers, family photographs and other unnecessary identifiers; also check filenames and metadata. Do not assume that the service will automatically detect or remove all of them.

If unnecessary data is nevertheless received, the law and this Policy still apply to its processing. A prohibition on uploading does not remove our obligations concerning data actually received.

5. Faces and sensitive information

The service is intended for images of spaces, not people. We do not use it for facial identification, biometric authentication or determining a person's health status.

Do not upload material containing sensitive information about people or intended to identify them. A person's incidental appearance in a photograph does not remove applicable requirements concerning personal, special-category or biometric data.

If prohibited or excessive data is identified, we may restrict processing, request a replacement without identifying information or delete the data as required by law. Detection of every such case is not guaranteed.

6. User content rules

Upload only material that you are entitled to use and provide for the processing described here, including processing by the AI provider. Rights in a photograph and a lawful basis for processing information about people shown in it are separate matters.

If you act for a client, property owner or another person, ensure that the necessary authority, notices and consents are in place where required by law. A contract with a client does not automatically provide the consent of all occupants or other individuals.

Uploading other people's confidential documents, unlawfully obtained material, unnecessary sensitive data or content infringing third-party rights is prohibited. Remove unnecessary identifiers before uploading.

We use material for the requested features and related lawful purposes described below. This Policy does not transfer ownership of content to us or grant unconditional permission to advertise, sell or use it for model training.

Report an infringement of your rights to roomsuit.support@gmail.com, identifying the project or material and explaining the issue. We consider reports whether or not the reporting person has an account. Users' responsibility for their own actions is determined by law and valid contractual terms; it does not cancel the controller's responsibility for its actions.

7. Purposes and legal bases

We limit processing to specific purposes and an applicable lawful basis:

• account creation, login, email verification, storage of selected projects and generation requests — providing the requested service, relying on consent and the legally permitted basis for contractual actions involving data obtained in connection with a contract;
• Builder Mode calculations — performing the requested calculation using the information you provide;
• payment processing and records, and allocation of credits — fulfilling an order and statutory accounting obligations;
• support, troubleshooting, prevention of misuse and dispute resolution — operating the requested service and protecting rights within the legal bases permitted by law;
• data rights requests, lawful requests from authorities and mandatory record retention — complying with the relevant legal obligation;
• project publication, marketing emails or other optional uses — a separate basis and separate consent where necessary. Registration consent does not cover these purposes.

In Armenia, we follow the Law on Protection of Personal Data, including its requirements for consent and contractual processing. We do not treat an abstract “business interest” as blanket authorization for all processing. Where the GDPR applies, relevant bases may include consent, contractual necessity, a legal obligation or legitimate interests following an assessment of necessity and individuals' rights; this does not override Armenian legal requirements.

Without necessary information, we cannot create an account, perform a generation or process an order. Declining optional uses should not remove access to core features. Withdrawing consent may stop a feature for which no other lawful basis exists, but does not invalidate processing carried out lawfully before withdrawal.

Consent is limited to the notified purpose and the period necessary to achieve it, or a shorter period if separately specified; it can be withdrawn earlier. It does not authorize processing after that purpose ends. Legally required retention of particular records is assessed separately, as described in section 10.

8. Processing through OpenAI

For analysis and generation, the service sends images and related instructions to the OpenAI API. A request may include the original filename. Email and payment details are not needed for this operation, although content itself may contain personal information.

OpenAI's published rules state that API data is not used for model training by default. Security logs may be retained for up to 30 days, or longer under specified exceptions. Zero retention is not guaranteed.

We do not use user content to train our own models or authorize voluntary sharing of that content for provider model training without a separate lawful basis and any necessary consent. This does not exclude processing the provider needs for security and legal compliance.

9. Who may receive data

The controller and authorized service providers may access data as necessary for their tasks. The service uses the following categories of recipients:

• Kamatera and network infrastructure providers: hosting the application, database and files, traffic transmission and technical maintenance;
• OpenAI: images, instructions and related information for the AI operations described in section 8;
• Resend: recipient address, service email content, verification links and delivery information;
• Paynet, servicing banks and payment participants: information necessary to process, verify and record payments;
• Google/Gmail: enquiries and attachments sent to our support email address;
• advisers and competent authorities — where necessary for a specific legal obligation, dispute or protection of rights, and permitted by law.

A provider processing data on our instructions must act within the relevant instructions and confidentiality requirements. Some recipients, such as banks, independently determine processing to discharge their own obligations; their privacy notices also apply to that processing. This does not exclude our responsibility for our own selection of recipients and the lawfulness of disclosure.

We do not sell personal data or provide private project content to advertisers. Publishing a project or using it in a portfolio requires separate permission and respect for the rights of everyone concerned.

10. Storage locations and retention

The main VPS hosting the application and primary storage is physically located in Armenia, using Kamatera. This does not mean all processing occurs exclusively in Armenia: external services are described in sections 8, 9 and 14.

Retention is determined by purpose, necessity and mandatory requirements:

• accounts and saved projects — while needed to provide the requested account and project access; when that purpose ends or a valid request is made, data must be deleted unless a separate lawful retention basis exists;
• temporary files, failed jobs and technical records — only for the period needed to carry out the operation, diagnose a problem or conduct a specific investigation;
• support information — while resolving the enquiry and keeping necessary evidence of its outcome;
• payment and accounting information — for the period required by applicable law and, in a specific dispute, to the extent necessary for its resolution;
• evidence of consent, requests and performance of obligations — for the period needed to demonstrate the relevant action and protect rights within applicable limitation periods.

Retaining payment or dispute records does not mean that all photographs and the entire account must be retained. Once the basis ends, data must be deleted or irreversibly anonymized; simply replacing an identifier does not constitute anonymization.

ROOMSUIT-AI has not currently configured automatic deletion based on elapsed time or backups. Deletion is arranged by contacting the controller. This does not authorize indefinite retention or override statutory deadlines. The Policy does not promise automatic deletion after 12 months, backup erasure within 30 days or recovery of a lost project. External providers may operate their own copy-retention arrangements; you can ask us for information about processing relating to you.

11. Deleting an account or individual material

Write to roomsuit.support@gmail.com, preferably from your account email address. Specify whether you want to delete the entire account, a particular project or image, or correct individual data. Losing access to your email or having no account does not prevent you from making a request.

We may request proportionate information to verify identity or authority so that we do not disclose or delete someone else's data. Do not send a passport or bank card unnecessarily; first agree on an appropriate verification method. Verification must not unjustifiably obstruct rights or arbitrarily extend statutory deadlines.

Deletion may make projects and results unavailable; save any copies you need beforehand. Related jobs and account access are stopped to the extent necessary. Account deletion alone does not determine entitlement to a payment refund or cancel mandatory consumer rights.

Where a legal obligation or specific lawful basis requires retaining certain records, we explain the categories, reason and criteria for the period. Those records must not be used for unrelated purposes. Where data was provided to a processor, we issue the necessary deletion or restriction instructions. We cannot promise erasure of information that an independent recipient must retain by law; we will explain the relevant limitation.

12. Payment information

Payments are handled through Paynet and the relevant payment participants. The service needs transaction confirmation and order information to allocate a plan or credits. The ROOMSUIT-AI interface is not designed to collect or store full card numbers or CVV/CVC; enter these only in the payment participant's secure form.

We may retain an order number, transaction identifier, amount, currency, dates, status and refund or dispute information. Interior images are not needed for an ordinary payment. Do not send full card details to support; redact unnecessary information from supporting documents.

13. Cookies and browser storage

The website uses technical storage for login, language selection, recording cookie choices and preventing duplicate order submissions:

• spacelab_sid — session cookie, up to 30 days from setting unless removed earlier;
• roomsuit_lang — interface language, up to 365 days from setting;
• roomsuit_cookie_consent — cookie choice, up to 365 days from setting;
• roomsuit.cookie-consent in localStorage — the choice, version and date saved; retained by the browser until cleared or replaced, with no separate automatic expiry configured in the application;
• roomsuit-checkout-request: entries in sessionStorage — payment attempt identifier, until removed by the application or the relevant tab session ends.

Setting a cookie again may restart its duration. The current application has no advertising or optional analytics trackers connected. If introduced, separate information and any required consent will precede their use. An earlier “all” choice is not authorization for any future technology.

You can remove cookies and local data through your browser settings; this may sign you out and reset preferences. To change a saved cookie choice, remove both corresponding values — the cookie and localStorage entry — or contact support. Clearing browser data does not delete the server-side account.

13A. Plans and credits: limits of this Policy

To administer access, we distinguish free credits, credits allocated for a plan period and separately purchased packages. Their balances and transactions form part of account and order information.

This Policy does not set prices, credit expiry, renewal, refund or currency conversion terms and does not change rights already purchased. Relevant information must be provided when selecting and paying for a product. Acceptance of this Policy does not authorize automatic renewal or payment charges.

13B. AI visualizations and construction calculations

Images are illustrative concepts. Builder Mode processes supplied dimensions, materials and prices to produce preliminary calculations. Results may contain errors and do not replace measurements, working drawings, engineering advice or a verified cost estimate.

Check results with a qualified specialist before purchasing materials or carrying out work. This describes the features' purpose; it does not waive mandatory service liability, guarantee accuracy or restrict the right to bring a lawful claim.

14. International transfers

Foreign technology providers may process data in other countries, including the United States. The location of the main VPS does not determine the location of OpenAI, email delivery, support systems or every payment participant. Countries' laws may differ.

Each transfer must meet applicable requirements concerning its legal basis, necessary scope, recipient and safeguards. Armenian law sets conditions for transfers to countries with adequate protection and an authorization procedure for other cases. Where authorization from the competent authority, contractual safeguards or another mandatory condition is required, acceptance of this Policy does not replace it.

Where the GDPR applies, its international transfer requirements also apply; using a provider abroad does not by itself establish that adequate safeguards are in place. This Policy is not, by itself, confirmation that every external requirement has already been satisfied.

15. Security and access

The controller must apply proportionate technical and organizational safeguards: access restrictions, credential protection, activity controls and secure transmission as required by law. Human access to content may be necessary for a specific support request, troubleshooting, infringement review or legal obligation; it must be limited to that task.

Absolute security of internet systems cannot be guaranteed. This does not release the controller from mandatory safeguards, incident investigation or legally required notifications to authorities and affected individuals. Do not share your password or account access; contact support if you suspect compromise.

16. Personal data requests

Requests relating to personal data should be sent to roomsuit.support@gmail.com. The request should identify the account, project or other material concerned and describe the requested action.

Before acting on a request, ROOMSUIT-AI may verify the requester's identity, authority and connection to the relevant account or material. If a request affects another person's rights, trade secrets, service security, mandatory accounting records, disputed circumstances, processing already performed or data that cannot be deleted or disclosed by law, ROOMSUIT-AI may limit or refuse the request within the limits of applicable law.

The timing, form and scope of a response depend on the nature of the request, applicable law, the sufficiency of the information provided and the technical ability to separate the requested data from other information. This Policy does not create additional rights, guarantees, deadlines or compensation beyond those expressly provided by applicable law.

17. User age

The service is intended for users aged 18 or over, and is not intended to collect children's data deliberately. This rule does not mean every visitor's age has been technically verified.

If you believe a child has provided data to us or someone has unlawfully uploaded a child's data, tell us. We will investigate and take the restriction or deletion measures required by law without requesting unnecessary information about the child.

18. Checks and optional uses

Technical session, quota, payment and request eligibility checks may run automatically. If you believe a check wrongly restricted access, payment or generation, request a support review; a person will review the matter where necessary.

Diagnostics and error correction do not authorize arbitrary new uses of private photographs. Aggregated or irreversibly anonymized information is preferable for statistics. Marketing emails, project publication and model training do not become authorized merely because a user accepted the general Policy.

19. Changes to this Policy

The current Policy is published on the privacy page with its date and version identifier. We communicate material changes to purposes, recipients or processing conditions through an available channel, such as the interface or email, before applying changes where the law requires it.

For new uses requiring consent, we obtain it separately before processing begins. Updating a page, continued use or silence does not create retroactive consent. Records of previous consent remain associated with the relevant version.

A new version does not cancel obligations already owed to a user or retrospectively legalize processing that lacked a necessary legal basis.

20. Applicable law and limits of this document

The controller operates in the Republic of Armenia. Armenian law and other mandatory rules apply within their territorial and material scope. Availability of the website abroad does not by itself determine the applicability of every foreign law.

Nothing in this Policy limits mandatory rules of applicable law where such rules cannot be varied by agreement of the parties. Using providers or a user's breach of the rules does not unconditionally release the controller from liability.

The Russian, English and Armenian versions are intended to convey the same meaning. If they diverge, the interpretation most consistent with applicable law and the service's actual operation applies.

21. Contact

For questions about processing, deletion, consent, content rights or complaints: roomsuit.support@gmail.com.

Controller: Sole Proprietor GEORGII NASHANIAN LEVON, registration number 20325013, Malatia-Sebastia, Isakova 44, Armenia.