Draft Privacy Notice

Draft for owner and counsel review - not yet effective or legal clearance.

Account identity

If enabled, Google provides a provider-specific account identifier, verified email and basic profile name using identity-only scopes. The service does not request contacts, social graph, posts or advertising permissions. Email OTP is not active until an approved delivery provider exists. Accounts from different providers are not automatically linked merely because email addresses match.

Project and AI data

The service processes project names, uploaded product photographs and swatches, prompts, generated images, size diagrams, downloads, credit events and security logs. Before upload or generation, customers must understand that enabled AI providers receive only the inputs needed for that requested operation. Demo mode sends nothing and creates no fake output.

Payments

An approved hosted-checkout provider would process payment details. The application retains provider references and verified event outcomes, not complete card or bank credentials. Checkout and credit conversion remain disabled.

Usage information and sharing

Operational usage is used for security, credit accounting, reliability and support. No third-party analytics SDK, advertising pixel or marketing tracker is installed. Optional analytics and marketing consent are separate and off by default; enabling either requires a later approved implementation and updated notice.

Storage, retention and rights

The intended AWS VPS deployment requires approved private PostgreSQL and object storage. Retention and deletion durations, subprocessors, international transfers, legal bases, controller contacts and jurisdiction-specific rights remain decisions for the owner and legal counsel before launch.