Privacy Policy

Who the data controller is

[POR PREENCHER: legal name of the data controller], of [POR PREENCHER: full postal address], tax identification number [POR PREENCHER: tax identification number], is the controller of the personal data described in this policy.

For any privacy question, or to exercise your rights, write to [POR PREENCHER: endereço de email de privacidade que controlamos].

No data protection officer has been appointed, as one is not required under Article 37 GDPR.

What we collect

Only what is needed to give you an account and keep your plans:

• Account: your name, your email address, and whether that address has been confirmed.
• Authentication: your password stored as a hash (never in plain text) and, if you turn them on, your two-factor secret and passkey credentials.
• Sessions: a session identifier, the IP address and the browser user agent, kept so you can see and end sessions on other devices and so we can detect misuse.
• Your plans: the floor plans, materials and furniture you place, and the name you give each project.
• Collaboration: when you share a project, your name and cursor position are visible to anyone editing with you, for as long as they are in that session.
• Language: your choice of Portuguese or English, stored in your browser.

We collect no location data, run no analytics, and carry out no profiling or automated decision-making about you.

Our lawful basis

Each purpose has its own basis under Article 6 GDPR:

• Performance of a contract (Art. 6(1)(b)): creating and maintaining your account, storing and syncing your plans, and sending the emails the service requires — confirmation, password reset and invitations.
• Legitimate interests (Art. 6(1)(f)): recording session IP addresses and user agents, and rate-limiting repeated sign-in attempts, to protect accounts against misuse. We balanced that interest against your privacy and limited both the data and the retention period accordingly.
• Legal obligation (Art. 6(1)(c)): retaining billing records where billing exists.
• Consent (Art. 6(1)(a)): any message not required to run the service is sent only if you ask for it, and you may withdraw consent at any time without affecting processing already carried out.

Who else processes your data

We use the following processors, and only these:

• Hosting: the application servers and the database are hosted in [POR PREENCHER: country where the server is hosted]. Your plans are not stored with any third-party service.
• Resend (United States): sends transactional email. It receives your name and email address.
• Google (gstatic.com) and jsDelivr: serve two decoders used to open 3D models. Your IP address is disclosed to them when you open the editor. We are moving these files onto our own server.

We do not sell personal data and do not share it for advertising.

Transfers outside the European Economic Area

Sending email through Resend involves a transfer to the United States, made under the Standard Contractual Clauses adopted by the European Commission. The same applies to the decoders above, which receive your IP address.

How long we keep it

• Account and plans: for as long as the account exists. If you delete it, we erase the account and the plans within 30 days.
• Sessions: until they expire or you sign out.
• Confirmation and password-reset links: one hour.
• Backups: daily backups are kept for 7 days, so deleted data may persist in them for that period.
• Email delivery logs at Resend: for that service’s own retention period.
• Records with tax significance, where they exist: 10 years, as required by law.

If you delete your account, drafts held only in your browser are not erased by us — they never left your device. You can clear them in your browser settings.

What we store on your device

We use no advertising or analytics cookies. What we store is either strictly necessary or a preference you chose yourself:

• Session cookie: keeps you signed in. Necessary.
• Authentication security cookies: protect against forged requests and support two-factor and passkeys. Necessary.
• Language: remembers whether you prefer Portuguese or English, for one year.
• Editor preferences: sidebar state, viewer options, whether you have seen the tour, and the floor-plan layout.
• Local drafts: a copy of the project you are editing, kept in your browser so you do not lose work.

Your rights

You have the right to access your data, to correct it, to erase it, to restrict processing, to object to processing based on legitimate interests, and to receive it in a structured, machine-readable format to move it to another service.

You can download all of your data and delete your account directly in Settings, without writing to us. For anything else, write to [POR PREENCHER: endereço de email de privacidade que controlamos]. We reply within one month.

If you believe the processing breaks the law, you may complain to the supervisory authority. In Portugal that is the Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134 — 1.º, 1200-651 Lisbon, www.cnpd.pt. You may also complain to the authority where you live.

Children

The service is not intended for children under 16 and we do not knowingly collect their data. If you believe a child has given us data, write to us and we will erase it.

Changes to this policy

If we change this policy in a way that affects you, we will tell you by email before the change takes effect. The date at the top is the last revision.