Privacy Policy

This policy explains what we do with your personal data when you use RoomSet at www.roomset.co.uk(the “Service”). We have written it in plain English rather than legalese. It is written to meet the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

The Service is operated by RoomSet Ltd (company number 17364274), registered in England and Wales at 20 Laurel Way, London, England. We are the “data controller” for the personal data described in this policy.

For any privacy question, or to exercise any of the rights in section 8, email hello@roomset.co.uk.

2. What we collect

Account information

When you create an account we collect your name and email address, and (if you sign in with Google) the basic profile information Google provides. Accounts are handled for us by Clerk. We also store your plan and remaining credit balance against your account.

Photographs you upload

The photographs you upload are processed in memory and are not stored on our servers. They are sent to our AI providers to produce your render and are not retained by us afterwards. Please note that our AI providers may process them transiently on their own systems as part of generating your image (see section 4).

Renders you generate

The finished images we produce for you are stored, privately, against your account, so that you can return to them, download them, edit them or delete them. Alongside each render we store the settings used to create it (room type, style, wall colour, flooring, lighting, headcount and any notes you typed), the plan you were on and the output resolution. Only you can access your renders through the Service, and you can delete any of them at any time from the History page.

Payment information

Subscriptions are processed by Stripe. We never see or store your full card details. We receive only your subscription status, plan and the identifiers Stripe gives us to link a payment to your account.

Support and assistant messages

If you use the assistant on our website, the message you send is processed to generate a reply. If you email us, we keep that correspondence so we can deal with your query.

Technical information

We log your IP address and basic request information. We use this to apply rate limits, to keep the Service secure and available, and to diagnose faults. We do not use any third-party analytics, advertising or tracking pixels.

3. Why we use it, and our legal basis

We do not sell your personal data, and we do not use your uploaded photographs or your renders to train our own AI models.

4. Who we share it with

We use a small number of established suppliers (“processors”) to run the Service. Each only receives what it needs to do its job:

We may also disclose personal data if we are legally required to, or to establish or defend legal claims. If the business is ever sold or transferred, data may pass to the buyer, and we will tell you if that happens.

5. Transfers outside the UK

Several of the providers above are based in the United States, so your data (including the photographs you upload, while they are being processed) is transferred outside the UK. Where that happens we rely on the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, or an applicable adequacy decision, together with the provider’s own security commitments. You can ask us for more detail at hello@roomset.co.uk.

6. How long we keep it

• Uploaded photographs — not stored by us at all.
• Renders and their settings — until you delete them, or until your account is closed.
• Account data — for as long as your account is open. If you close it, we delete or anonymise your data within 90 days, except where we must keep records for legal reasons.
• Billing and accounting records — six years, as UK tax law requires.
• Technical logs — typically 30 days.

7. Security

We take security seriously and have documented our approach internally. In practice that means: all traffic is encrypted in transit (HTTPS); credentials are held as environment secrets and never shipped to the browser; every request for your renders is checked against your signed-in account, so no one can read another user’s data; we apply rate limits and input validation on all endpoints; and we set strict browser security headers. No system is ever perfectly secure, but we work to protect your data and will tell you and the ICO without undue delay if a breach occurs that puts your rights at risk.

8. Your rights

Under UK GDPR you have the right to:

• Ask for a copy of the personal data we hold about you
• Have inaccurate data corrected
• Have your data deleted (you can delete individual renders yourself at any time)
• Restrict or object to how we use it, including objecting to our legitimate interests
• Receive your data in a portable, machine-readable format
• Withdraw consent at any time, where we relied on consent

Email hello@roomset.co.uk and we will respond within one month. There is no charge for this.

9. Cookies

We only use cookies that are necessary for the Service to work, so we do not show a cookie banner asking for consent. Specifically:

• Clerk sets cookies to keep you signed in securely.
• Stripe sets cookies during checkout to process payment and prevent fraud.
• We store a small flag in your browser to remember that you have seen the tutorial.

We do not use advertising, profiling or analytics cookies. If that ever changes we will ask for your consent first.

10. Children

The Service is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children.

11. Changes to this policy

If we make a material change we will update the date at the top of this page and, where the change significantly affects you, tell you by email.

12. Contact

Any question about this policy or your data: hello@roomset.co.uk.