Privacy Policy

1. About this policy

This policy covers the HomeCompose website and app at homecompose.com. "We" means the team that runs HomeCompose.

2. Information we collect

Account: your email address, your name if you add it, and your password, which our authentication provider stores only in protected form. If you sign in with Google, we receive the name and email address Google shares with us.

Your content: the photos you upload, the choices and descriptions you enter (for example a room type, style, palette or written request), the designs, videos and texts made from them, and how you organize them in projects and favorites.

Plan and payments: your plan, billing period, credit balance and the credits each action used. You enter your payment details with our payment provider, Creem (Armitage Labs OÜ, Estonia), which acts as the merchant of record for all our orders and handles that information as a data controller under its own Privacy Notice; we receive the result of the purchase (plan, amount, currency and status), never your full card number.

Messages: what you send us through the contact or support form, and the optional feedback you give in the product.

Usage and device: technical data such as your IP address, approximate country, browser and device type, pages visited and errors. How you found us, such as an ad campaign or a referring site, is saved in your browser on your first visit and stored with your account when you sign up, together with your cookie choice at that moment.

Sign-in IP address: when you sign in, we write the IP address of your latest sign-in to your account record and use it only for security and to prevent abuse; each sign-in overwrites this value.

3. How we use it

To provide HomeCompose: create your account and sign you in, make the designs you ask for, keep your projects, show your plan and credits, and let you make purchases through our payment provider.

To keep the service secure and working: prevent abuse and fraud, fix errors and answer your messages.

To measure our advertising: where you allow it, to learn which ads lead to sign-ups and purchases (see section 5).

To improve the product, using overall usage figures. HomeCompose does not use your photos or designs to train AI models.

If you are in the European Economic Area or the United Kingdom, we rely on these legal bases: performing our contract with you (providing the service), our legitimate interests (security, fixing errors and improving the product), your consent (advertising measurement where consent is required), and legal obligations (for example tax records).

4. AI processing of your photos

To make a design, the photo you choose and your choices are sent to fal.ai, which runs the AI models we use: for example xAI's Grok image models, video models such as PixVerse and Kling, and other models for upscaling, object detection and Design Critique. The results come back to us and are stored in your account.

These providers process your content on our behalf to produce your result. Avoid uploading photos that show people, documents or other personal details you do not want processed.

5. Cookies and similar technologies

Necessary storage: your browser keeps your sign-in session, theme, interface preferences and cookie choice. The site needs these to work.

Advertising measurement: we use the Google tag for Google Ads to count sign-ups and purchases that come from our ads. When such a conversion is reported, the Google tag turns your email address into a code that cannot be read back (a hash) and sends it to Google to match the conversion.

In the European Economic Area, the United Kingdom and Switzerland, advertising cookies and measurement stay off until you choose "Accept" in the cookie banner; if you choose "Reject", they stay off. Elsewhere they are on by default. Your choice is kept for one year; to change it, clear this site's data in your browser and choose again.

6. Who processes your information

We use these service providers to run HomeCompose: Supabase for accounts, the database and file storage; Cloudflare for hosting, sending emails and telling what kind of image you uploaded (a room, a floor plan, a sketch), to suggest the right tool; fal.ai for AI processing, together with the model providers it runs; Creem (Armitage Labs OÜ, Estonia), the merchant of record for all our orders, for payments, taxes and receipts; and Google for Google sign-in, if you use it, and for Google Ads measurement.

We do not sell your personal information.

We may also disclose information if the law requires it, to protect people's rights and safety, or as part of a merger, acquisition or sale of the business, in which case this policy continues to apply to it.

7. Where it is processed

Our providers may process information in the United States, the European Union and other countries. When information leaves the European Economic Area or the United Kingdom, we rely on the safeguards our providers offer, such as the European Commission's standard contractual clauses.

8. How long we keep it

Your account details, photos, designs and projects are kept until you delete them or your account is closed. Deleting a photo, design or project in the product removes its files from our storage.

Support messages are kept as long as needed to handle them, and technical logs for a short time. Payment records are kept by Creem for as long as its Privacy Notice and the tax and accounting laws require.

When your account is closed, we delete your account data and files within 30 days, except what the law requires us to keep.

9. Your rights and choices

Depending on where you live, for example under the GDPR in the European Union, the LGPD in Brazil or the KVKK in Türkiye, you can ask to access, correct, delete or receive a copy of your personal information, object to or restrict some uses of it, and withdraw your consent at any time.

You can delete your own content in the product. For other requests, including closing your account, write to us through the support form in your account settings (or the contact page if you have no account), or by email at contact@homecompose.com; we may need to confirm that the request comes from the account owner.

You also have the right to complain to your local data protection authority, such as the ANPD in Brazil or the Personal Data Protection Authority (KVKK) in Türkiye.

10. Security

We protect information with access controls, encrypted connections and our providers' security measures. No online service is completely secure, so use a strong password and keep your devices safe.

11. Children

HomeCompose is only for people aged 18 or over, and we do not knowingly collect information from children. If you think a child has given us personal information, tell us and we will delete it.

12. Changes to this policy

We may update this policy as HomeCompose changes. The date at the top shows the latest version, and before important changes take effect we will tell you in the product or by email.