Privacy policy

References to the GDPR and European data-protection rules below apply where those laws govern the relevant processing. Applicable U.S. and other mandatory privacy rights remain available.

Data Controller

Roomalune, Inc.
14021 GARBER ST, ARLETA, CA 91331, United States
Email: ceo@roomalune.com

This Website

Hosting

This website (roomalune.com) is a static site served by Cloudflare Workers, a service of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. When you visit, Cloudflare's network automatically logs standard access data including your IP address, browser type, operating system, referring URL, and the date and time of your visit. Cloudflare also processes this data to terminate the encrypted connection and to detect and block attacks and other malicious traffic.

This is processed on the basis of Art. 6 para. 1 lit. f GDPR (our legitimate interest in secure and reliable website operation). Log files are retained for a limited period and then deleted. Cloudflare acts as our processor under a data processing agreement.

Unlike a single-location host, Cloudflare serves this site from whichever of its data centres is closest to you, which may be outside the EEA. See Transfers Outside the EEA below.

Analytics

This website uses Cloudflare Web Analytics, provided by Cloudflare, Inc., to understand how visitors use the site so we can improve it.

Cloudflare Web Analytics does not set cookies, does not use localStorage or any other client-side storage, and does not use fingerprinting. It does not track you across other websites or over time. Rather than identifying individual visitors, it counts page views whose referrer is a different site, and collects page performance measurements through your browser's standard Performance API.

Because it stores no information on, and reads no information from, your device, this service does not require consent under § 25 TDDDG — which is why this site shows no cookie banner. The processing is based on Art. 6 para. 1 lit. f GDPR (our legitimate interest in understanding and improving our website).

Cookies

This website does not set cookies.

No other tracking

Beyond the hosting logs and Cloudflare Web Analytics described above, this website does not run advertising networks, social-media trackers, or cross-site profiling. Fonts are served from our own servers rather than loaded from a third party, so visiting this site does not transmit your IP address to a font provider. The one exception on this website is the free web trial at /try, described in its own section below.

The Web Trial (/try)

The page at roomalune.com/try lets you generate one free room design and see matching furniture without creating an account. It works differently from the rest of this website in a few specific ways, so it is described separately here. Nothing in this section applies to any other page.

Your photo and your design

When you press Generate, the photo you selected is transmitted once to our backend on Amazon Web Services (region Frankfurt, eu-central-1) and passed to Google's Gemini API to generate the redesign. The generated image is placed in a private storage area, downloaded by your browser, and then deleted from cloud storage. We do not keep a copy of your photo or your design, and neither appears in any library or account on our side. The processing is based on Art. 6 para. 1 lit. b GDPR — it is the service you are requesting. For Google's role, see Processors below.

Storage in your browser

Your uploaded photo, the generated design and any product matches are stored in your browser's local storage (IndexedDB and localStorage) so they survive a page reload. They remain on your device, are not synchronised anywhere, and disappear when you clear the site's data. This storage is strictly necessary for the service you explicitly request and therefore requires no consent under § 25 para. 2 TDDDG. The trial also creates a technical anonymous account (a random identifier, no email, no name) that exists only to authorise your single free design; its credentials are held in the same local storage.

Bot protection (Cloudflare Turnstile)

The trial is protected against automated abuse by Cloudflare Turnstile, provided by Cloudflare, Inc. The Turnstile script is loaded only on the /try page and only at the moment you press Generate — merely visiting the page loads nothing from Cloudflare beyond the hosting described above. Turnstile does not set cookies and does not track you across sites; it evaluates technical browser signals to distinguish people from scripts, which may involve transmitting your IP address to Cloudflare. This processing is based on Art. 6 para. 1 lit. f GDPR (our legitimate interest in preventing automated abuse of a free, unauthenticated service); the associated access to device information is strictly necessary to provide the fraud-protected service you request (§ 25 para. 2 TDDDG).

Abuse limits

To keep the trial to one design per person, our backend keeps short-lived, salted hashes derived from your IP address for rate limiting, and the random trial identifier described above. These records contain no photos, no names and no email addresses.

The Roomalune App

The Roomalune mobile app processes the photographs and sketches you submit in order to generate redesigns, and the account data required to operate your credit balance.

Account and authentication

We process your email address so that you can create an account, sign in, and access the designs and credits associated with it. Legal basis: Art. 6 para. 1 lit. b GDPR (performance of our contract with you).

Trying the app without an account

You can try the app before creating an account. To make this possible, the app creates a technical anonymous account — a random identifier, no email, no name — that exists only to authorise your free trial designs. Its credentials are stored on your device. If you later sign up, this anonymous account is converted into your real account and any remaining trial credits are kept.

To keep the free trial to one per device, the app asks your device's operating system to attest that it is a genuine, unmodified device — Apple App Attest on iOS, Google Play Integrity on Android. Producing this attestation involves Apple or Google processing technical device data under their own terms; on Android, our backend additionally sends the resulting attestation token to Google Play for verification. Our backend keeps a hashed record derived from this device identity, so that a device which has used its free trial cannot request another, and short-lived, salted hashes derived from your IP address for rate limiting. These records contain no photos, no names and no email addresses. Legal bases: Art. 6 para. 1 lit. b GDPR (providing the trial you request) and Art. 6 para. 1 lit. f GDPR (our legitimate interest in preventing automated abuse and repeat use of a free service).

Images you upload

Photographs and sketches you submit are processed in order to produce the redesign you requested. To do this they are transmitted to the AI providers named below: to Google, which generates the redesigned images, and to Microsoft, which produces the written design suggestions that accompany them. Legal basis: Art. 6 para. 1 lit. b GDPR (performance of our contract with you).

Google processes inputs and outputs under the terms applicable to the Gemini API service used by Roomalune, Inc.. The applicable provider terms govern the handling of those inputs and outputs.

To suggest furniture that matches a generated design, the app first detects the furniture in the image locally, on your device. Small image crops of the detected furniture are then sent to our backend, which turns them into a numerical representation and uses it to search our own furniture catalogue; the crops are processed to answer the request and are not retained. The catalogue is held in a hosted vector database operated by Chroma Inc. in the United States. That database contains product data only, and the query it receives is the numerical representation — it contains no image, no account identifier and nothing that identifies you.

Feedback you choose to share

If you are unhappy with a generated design, the app offers to share it with us so we can improve the service. This is entirely voluntary: nothing is sent unless you confirm the request, and the app tells you beforehand what will be shared — the original photo you submitted and the design generated from it. Both images are then stored on our backend, where we use them to analyse what went wrong and to improve design generation. They are not published and not used for anything else. Legal basis: Art. 6 para. 1 lit. a GDPR (your consent).

Shared feedback is stored under a random identifier together with the room and style type, not under your account. This protects your identity, but it also means we generally cannot find the specific images you shared afterwards — so we cannot selectively delete an individual submission on request. Please consider this before sharing. Feedback images are deleted once they are no longer needed for improvement work.

Designs stored on your device

The designs generated for you are stored in the app on your own device rather than in an account library on our servers. Uninstalling the app or moving to a new device therefore removes them. Your account and credit balance are held server-side and are unaffected.

Purchases and credits

Purchases are made through the Apple App Store or Google Play. We do not receive or store your payment card details. We receive confirmation of a completed purchase and the identifiers needed to credit your account. Legal basis: Art. 6 para. 1 lit. b GDPR.

Deleting your account

You can delete your account at any time via roomalune.com/deleteaccount/.

Service Providers

We use the following processors. Each is bound by a data processing agreement and processes personal data only on our instructions.

• Cloudflare, Inc. (USA) — website hosting, content delivery, security and web analytics. Privacy policy
• Amazon Web Services, Inc. — our app backend and storage. Place of processing: Europe. Privacy policy
• Google LLC — the Gemini API, used to generate redesigned images from the room photos you submit. Place of processing: USA. Privacy policy
• Microsoft Corporation — Azure OpenAI Service, used to produce written design suggestions from the room photos you submit. Place of processing: Europe. Privacy policy
• RevenueCat, Inc. — subscription and purchase management. Place of processing: USA. Privacy policy

Transfers Outside the EEA

Some of our processors are established in the United States, so personal data is transferred outside the EEA.

Cloudflare, Inc. and Google LLC are certified under the EU–U.S. Data Privacy Framework. Cloudflare's data processing addendum additionally incorporates the EU Standard Contractual Clauses. We rely on both mechanisms wherever they are available, so that a valid basis for the transfer remains in place even if the adequacy decision underlying the Framework were to change. Where a processor is not covered by an adequacy decision, transfers are made on the basis of the EU Standard Contractual Clauses.

Data Retention

Server log files are retained for a limited period and then deleted. Account data is retained for as long as your account exists, and is deleted when you delete your account. Data we are required to keep for statutory retention periods, such as records relating to purchases, is kept for as long as those periods require and is then deleted.

Delaware and other U.S. privacy rights

Where applicable, you may request access, correction, deletion, a portable copy of your personal data, and information about categories of recipients, and opt out of certain processing. Send requests and opt-outs to ceo@roomalune.com. We verify identity where legally required and do not discriminate against you for exercising your rights.

Under applicable Delaware privacy law, we generally respond within 45 days and notify you of any legally permitted extension. You may appeal a denial by emailing us. We respond to appeals within 60 days. If an appeal is denied, you may contact the Delaware Department of Justice. Mandatory rights in your place of residence remain available.

EEA rights, where applicable

You have the right to access your data, to have it corrected or erased, to restrict or object to its processing, and to receive it in a portable format (Art. 15–21 GDPR). Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Where we process data on the basis of our legitimate interests, you may object on grounds relating to your particular situation. To exercise any of these rights, contact us at ceo@roomalune.com. We will respond within one month.

You also have the right to lodge a complaint with a supervisory authority. You may contact the authority responsible for your place of residence where applicable.

Changes to This Policy

We update this policy when our processing changes. The current version always appears on this page.

Last updated: 28 September 2026