Privacy Policy

Who is responsible

The controller for your personal data is zebra nine studio inc., 7 Brock Ave, Markham, Ontario L6E 0E4, Canada. Email: aitaylorfan@gmail.com.

[

Owner: if the business is not established in the EU, appoint an EU representative (Art. 27 GDPR) and add it here: [to be filled by owner]. Delete this note if the business is in the EU.

]

What we collect and why

• Plans you draw before signing in. You can draw without an account. Until you sign in, your plan is kept in your browser's local storage on your device and is not sent to us. Exports you make without an account are created for you and not stored with any account.
• Your account. Your email address and, if you use a password, a securely hashed version of it. If you sign in with a third-party provider (for example Google), we receive your email address and basic profile name from that provider. We use this to create your account, let you sign in, send receipts and answer your questions. Legal basis: performing our contract with you (Art. 6(1)(b) GDPR).
• Your saved plans. When you save a plan to your account, we store its drawing data (walls, doors, windows, furniture, dimensions, room names and labels), its title and when it was changed. We use it to show the plan to you again and to create your exports. Legal basis: contract (Art. 6(1)(b) GDPR).
• Reference images (optional). If you upload an image to trace over, such as a photo or scan of an existing plan, we store it with that plan. Please only upload images you are allowed to use, and avoid images that show people or personal documents. Legal basis: contract (Art. 6(1)(b) GDPR).
• Exports. Clean PDFs and materials lists you buy are generated on our servers and stored so you can download them again. Legal basis: contract (Art. 6(1)(b) GDPR).
• Purchases. What you bought, the amount, the date, the order number, any credits and any refund. Card details go directly to Stripe; we never see or store them. Legal basis: contract, and our legal duty to keep accounting records (Art. 6(1)(c) GDPR).
• Technical data. IP address, browser and device type, and the pages requested, in server logs to keep the service secure and working. Legal basis: our legitimate interest in a secure service (Art. 6(1)(f) GDPR).

Emails we send

• Service emails: account and password emails, receipts and answers to your questions. These are part of the service and have no unsubscribe link.

[

Owner: if you later send newsletters, export reminders or other marketing emails, add them here with their legal basis and an unsubscribe link before the first one goes out.

]

Who processes your data for us

We use these service providers. They process data on our behalf and only for the purpose given:

• Stripe (Stripe Payments Europe Ltd., Ireland, and Stripe, Inc., USA): payments.
• Resend (Resend, Inc., USA): sending our emails.
• Hosting, database and file storage: [to be filled by owner].
• Sign-in providers you choose to use (for example Google): only when you sign in with them.
• Google Analytics 4 (Google Ireland Ltd. and Google LLC, USA) and Microsoft Clarity (Microsoft Ireland Operations Ltd. and Microsoft Corporation, USA): only with your consent; see Cookies and analytics below.

[

Owner: confirm a data processing agreement (DPA) is in place with each provider above, and name the storage provider for exports (for example Cloudflare R2 or AWS S3) if it differs from the hosting provider. If AI renders are offered, name the AI provider here, what it receives (the plan image) and where it processes data, before the feature launches.

]

Some of these providers are outside the EU, mainly in the USA. Where a provider is certified under the EU-US Data Privacy Framework, transfers rely on that; otherwise they rely on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can ask us for a copy of the safeguards. [Owner: confirm the basis for each provider.]

We do not sell your data, and we do not use your plans or images to train AI models. [Owner: if an AI provider is added, confirm it does not train on our inputs; otherwise remove the second half of this sentence.]

How long we keep it

• Account and saved plans: for as long as your account exists, so you can come back to your plans. You can delete a plan in the editor at any time. When you ask us to delete your account, we delete your account, plans, reference images and exports within one month. [Owner: if there is no account delete button yet, say "email us (see Your rights)".]
• Plans kept in your browser: stay on your device until you clear your browser storage. We have no copy.
• Exports: for as long as the plan they belong to exists in your account. If a purchase is refunded, the clean PDF and materials list for it are deleted.
• Purchase records: for as long as tax and commercial law requires us to keep them (in Germany up to 10 years), even after your account is deleted.
• Server logs: for a short period needed for security. [Owner: state the log retention period of the hosting provider.]

Cookies and analytics

We use cookies and similar storage that are needed for the site to work: your sign-in session, your language, your cookie choice (kept for 365 days) and, before you sign in, your current plan in local storage. These need no consent.

Google Analytics 4 and Microsoft Clarity (which records how pages are used) load only after you click "Accept" in the cookie banner; before that, the site sends them nothing and sets none of their cookies. Legal basis: your consent (Art. 6(1)(a) GDPR and the rules on storing information on your device, such as § 25 TDDDG in Germany). You can change your choice at any time with "Cookie settings" in the footer.

[

Owner: AdSense and Plausible are off (nothing is set for them). If you turn either on, name it in this section first.

]

We also count how many visitors reach each step of drawing and exporting a plan, in a first-party tally without cookies: we store only the day, the page, the language and the step, with no identifier, IP address or device data. Legal basis: our legitimate interest in improving the site (Art. 6(1)(f) GDPR).

AI-generated content

If we offer AI renders, the images they produce are made by an AI model from your plan. No decision with legal or similarly significant effects is made about you by automated means (Art. 22 GDPR). Plans, exports and materials lists themselves are calculated from what you draw; they are schematic and not checked by a professional.

Children

Room Meadow is for adults. You must be at least 18 to create an account or buy. We do not knowingly collect personal data from children under 16 (under 13 in the USA); if we learn that we have, we delete it.

Your rights

You have the right to access your data, to have it corrected or deleted, to restrict processing, and to receive your data in a portable format (Art. 15 to 20 GDPR). Where we rely on your consent, you can withdraw it at any time with effect for the future (Art. 7(3) GDPR).

Right to object: where we process your data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time for reasons arising from your particular situation (Art. 21 GDPR).

To use any of these rights, including deleting your account and plans, email aitaylorfan@gmail.com from the address on your account. We answer within one month.

You also have the right to complain to a data protection supervisory authority, in particular in the EU country where you live or work.

California and other US states

We do not sell personal information and do not share it for cross-context behavioral advertising. California residents can ask to know, correct or delete the personal information we hold about them by emailing aitaylorfan@gmail.com, and we will not treat you differently for doing so. The categories we collect and why are listed above.

Changes

We will update this page when what we do with your data changes, and change the date at the top.