Privacy Policy

ASpaceAI is operated from United States and provides an AI home design visualization service. The ASpaceAI operator is the controller of the personal data described below.

For any question about this policy or about your data, contact support@aspaceai.com.

Account data: your email address, your name if you provide one, your authentication method, and — if you enable two-factor authentication — the fact that it is enabled. We never store your password in readable form.

Organisation data: the workspaces you belong to, your role in each, and invitations you send or receive.

Billing data: your subscription tier, plan history, orders, and credit ledger. Card details are handled by our payment processor and never reach our servers.

Design content: room photos, furniture reference images, generated images, prompts, and any text you submit to describe a home design change. These are private to your organisation by default.

Technical data: IP address, user agent, and authentication events such as sign-ins and password resets. We keep these to detect abuse and to answer 'was this me?'

Marketing-site request data: when your browser loads externally hosted inspiration imagery, the image host receives ordinary request information such as your IP address and user agent.

Cookies and similar technologies: see the cookies section below.

To provide the service you asked for, including authentication, uploads, AI room edits, generated results, and downloads — performance of our contract with you.

To take payment and keep financial records — performance of our contract, and compliance with a legal obligation for records we must retain.

To keep the service secure and to investigate abuse — our legitimate interest in a service that is not being attacked.

To send transactional email such as verification, password resets, and receipts — performance of our contract.

For analytics or advertising, where enabled — your consent, which you may give or withdraw at any time.

Strictly necessary cookies keep you signed in, protect forms against cross-site request forgery, and remember your cookie choice. These are required for the service to function and are set without consent.

Analytics and advertising technologies, where enabled, are set only after you accept them. Nothing in those categories loads before you make a choice, and rejecting them is a single click with the same prominence as accepting.

You can change your decision at any time from the cookie settings link in the site footer. Withdrawing consent stops future collection; it does not undo processing that already, lawfully, happened.

We do not sell personal data.

Depending on the features you use and the services enabled on the deployment, we use these providers to operate ASpaceAI: Vercel — Application hosting, content delivery, and request logs; Managed PostgreSQL infrastructure — Account, organisation, billing, task, and audit records; Managed Redis infrastructure — Abuse prevention and distributed request rate limiting; Stripe — Payment processing, subscription billing, and receipts; Resend — Account verification, password reset, and transactional email; Kie.ai and its model providers — AI image editing and generation requested in Studio; Configured private object-storage provider (Amazon S3, Cloudflare R2, or compatible) — Storage and delivery of uploaded and generated files; Cloudflare Turnstile — Bot and abuse prevention on authentication forms; Google — Optional Google account sign-in; consent-gated Google Analytics and AdSense when configured; Unsplash — Delivery of public marketing imagery, which exposes ordinary request data such as IP address and user agent.

When you ask ASpaceAI to generate or edit an image, the uploaded images and prompt needed for that request are sent to the AI provider so it can produce the result.

When you choose Google sign-in, Google receives the information necessary to authenticate you. Google Analytics and advertising services are contacted only after the relevant consent is given and only when those services are configured.

We may disclose data where we are legally required to, or to establish or defend legal claims.

Our providers may process data outside your country, including outside the EEA or the UK. Where that happens, we rely on legally recognized transfer safeguards such as standard contractual clauses or equivalent measures provided by the relevant vendor.

Account and organisation data: while the account is active and afterward only for as long as reasonably needed to handle a closure request, prevent fraud, resolve disputes, or meet legal obligations.

Financial records, including orders and subscription history: retained after account closure for the period our tax and accounting obligations require.

Authentication, credit-ledger, task, and administrative audit records: these records are append-only or retained as service and security history. We keep them while needed for account security, fraud prevention, support, accounting, dispute resolution, and legal compliance.

Uploaded source files: active files remain available to your account until you delete them. Deletion removes the stored object, while limited database metadata and audit references may remain for security, accounting, or dispute-resolution purposes.

Generated outputs and Studio task records: task and result references remain in account history unless we delete or de-identify them in response to a valid request. Copies held temporarily by AI or infrastructure providers follow those providers' operational deletion cycles.

Backups and deletion processing: deleted data may persist temporarily in restricted backups or queues until the normal backup rotation or deletion process completes.

Depending on where you live, you may have the right to access your data, correct it, delete it, receive a portable copy, object to processing based on legitimate interests, or withdraw consent you have given.

There is currently no in-product control for closing an account or deleting all personal data. To close an account, request deletion, or exercise another privacy right, contact support@aspaceai.com. We will verify the request and respond within the period the applicable law requires.

If you believe we have handled your data improperly, you may complain to your local supervisory authority. We would rather you told us first.

Access to your data is scoped to your organisation, uploaded files are private by default and served through expiring links, and administrative accounts require two-factor authentication.

No service is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authority where the law requires it.

The service is not directed to children under 13, and we do not knowingly collect their personal data.

We will post any change here and update the effective date above. If a change materially affects your rights, we will tell you before it takes effect.