Legal
Privacy Policy
What this covers
Designifyy turns a photograph of your room into a redesign. To do that we have to receive and process your photographs, which are personal data under India's Digital Personal Data Protection Act, 2023. This page says what we collect, why, how long we keep it, and how to make us delete it.
What we collect
- Your email address, to create and secure your account.
- Photographs you upload, and the room details you tell us about them.
- The designs we generate from those photographs.
- Payment records: what you bought, when, and the amount. Card and UPI details are handled entirely by Razorpay and never reach our servers.
Location data is removed on upload
Phone photographs usually carry hidden EXIF metadata, including GPS coordinates of where the picture was taken. We strip that metadata the moment a photograph arrives, before it is stored anywhere. Only the image itself is retained. The orientation tag is applied to the pixels first so the picture is not saved sideways, then the metadata block is discarded.
Who else sees your photographs
Designing a room needs your photographs read by two specialist models: one that surveys the room, and one that draws it. Both run on paid tiers, and we have checked the wording rather than assuming it.
Google's Gemini API terms state that on a paid service Google does not use your prompts — including files such as images — or the responses to improve its products, and processes them as a data processor acting on our instructions. We are the data fiduciary; they act on our behalf.
Two things about that arrangement you should know, because they are true and we would rather you heard them from us:
- Your photographs are logged briefly for abuse detection. Google's terms say prompts and responses are logged “for a limited period of time”, solely to detect and prevent violations of their acceptable-use policy and to meet legal disclosure obligations. Their terms do not state a number of days, so we are not going to invent one — if you need a figure for a compliance review, ask us and we will get it in writing from Google rather than guess.
- That processing may happen outside India. Google's terms say the data may be “stored transiently or cached in any country in which Google or its agents maintain facilities”. Your photographs therefore cross borders while a design is being made.
We do not sell your data, and we do not share it with advertisers.
If you ask to be introduced to a designer or contractor, we share only what you agree to share at that point. Nothing is passed on without you asking for it.
How long we keep things
[RETENTION PERIOD — decide and state a number, e.g. "24 months after your last activity"]. This is the period we hold your photographs for. It is a decision we owe you a straight number on, and it is not yet filled in.
Separately, our vision provider logs prompts and responses briefly for abuse detection — see “Who else sees your photographs” above. That window is theirs, not ours, and deleting your account does not shorten it.
Payment records are kept for as long as Indian tax law requires, which is currently eight years, because we are obliged to. Those records identify the purchase, not your photographs.
Your rights
Under the DPDP Act you may ask us to show you what we hold, correct it, or delete it. Write to [SUPPORT EMAIL] and we will respond within 30 days. Deleting your account removes your photographs and generated designs. It does not remove payment records we are legally required to retain.
Security
Photographs are stored in a private bucket that is not publicly readable; access is granted through short-lived signed links only. Account access requires your password. We are a small team and we do not claim to be unbreakable, but we do not store what we do not need.
Children
Designifyy is not intended for anyone under 18, and we do not knowingly create accounts for children.
Changes
If this policy changes materially we will say so on this page and date it. Continuing to use the service after that means you accept the revised terms.
Contact
Grievance Officer: [NAME], [SUPPORT EMAIL], [POSTAL ADDRESS]. The DPDP Act requires a named contact; this must be a real person.