Privacy Policy

1. Introduction

This policy explains what the AI Compoz Design app (also called Compozit Vision) and the aicompoz.it and aicompoz.com websites (together, the "Platform") collect, why, which companies process it for us, how long we keep it, and how you can delete it. "We," "our," and "us" mean the publisher of Compozit Vision.

This policy applies to the AI Compoz Design mobile app (also known as Compozit Vision; Google Play package it.aicompoz.aicompozit.vision, App Store id 6752837860), published by Marcusbey.

By using Compozit Vision, you consent to the practices described in this policy. If you do not agree with this policy, please do not use our services.

2. Information We Collect

2.1 Information You Provide

• Account Information: Your email address and password, or your name and email address if you sign in with Google or Apple
• Profile Data: An optional profile photo and display name
• Photos: Room photos you take or choose, and the images the app generates from them
• Conversations: Messages you write to the design assistant and, in voice mode, your microphone audio
• Typed Addresses: The address or place name you type when you set a project's location
• Support Messages: Emails you send us and in-app bug reports, including any screenshot you attach
• Website Forms: The email address you enter on our websites to get the app link, and what you write in our contact form

2.2 Information Collected Automatically

• Usage Events: Screens you open and actions such as onboarding steps, plan views, purchases and messages sent, with your app version, platform and a random app installation ID. Our own backend records these events; the app does not use a third-party analytics service
• Country: Derived from your IP address when a usage event is recorded. We do not store the IP address with the event
• Network: The name and number of the network your connection comes from (such as your mobile carrier or internet provider), derived from your IP address when a usage event is recorded and kept with the event. We do not store the IP address with the event
• Device or Other IDs: If you allow notifications, your push notification token and your device's time zone; on Android, also the Firebase Cloud Messaging token and Firebase Installation ID that Google uses to deliver notifications
• Crash and Error Reports: Device model, operating system, app version, what the app was doing, and your account ID (not your name or email)
• Server Logs: Our backend logs the requests it handles, with your account ID
• Location: The app does not collect your device's location (GPS). The only location data is the country above and any address you type

2.3 Information from Third Parties

• Sign-In Providers: If you sign in with Google or Apple, we receive your name and email address from them
• App Stores: Apple and Google, through RevenueCat, tell us which plan you subscribed to and whether the subscription is active; your credits come with that plan. We never receive your card details

3. How We Use Your Information

We use your information to:

• Provide Services: Analyze your photos, reply to your messages, generate designs, and estimate their cost
• Manage Your Account: Create and maintain your account, process subscriptions and credits, and authenticate access
• Improve Our Platform: Analyze usage events, fix bugs, and develop new features
• Communicate: Send notifications you allowed, respond to support requests, and send emails about your account
• Ensure Security: Detect fraud, prevent abuse, and protect our users and platform
• Legal Compliance: Meet regulatory requirements and respond to legal requests

4. AI Processing, Chat Memory & Your Images

• Processing: Your photos, messages and voice audio are sent to the AI providers listed in section 5 to analyze rooms, write replies and generate images
• Storage: The current app stores your photos and generated images with Cloudflare until you delete the project or your account. Images that earlier versions of the app saved with Supabase are still stored there (see section 8)
• Chat Memory: So the assistant remembers your project, we store your chat messages and the facts, preferences, summaries and photo analyses it saves from them (for example your style or budget). Saved facts, preferences, summaries and analyses are also turned into embeddings, numeric representations used to search them, with Cloudflare Workers AI. Deleting a project deletes its memory; deleting your account deletes all of it
• AI Training: We do not use your photos, messages or voice to train AI models

5. Who Processes Your Data

These companies process your data on our behalf, only for the purposes below:

5.1 AI and Search

• Google Gemini: Generates and edits design images from your photos and instructions, analyzes room photos, summarizes project history, writes chat replies when the models below are unavailable, and runs voice mode (your microphone audio) when OpenAI's voice service is unavailable
• OpenAI: Voice mode. Your microphone audio is streamed from your device to OpenAI's realtime voice service, which also transcribes speech and speaks replies. It can also analyze room photos
• xAI (Grok): Writes most chat replies, sorts your messages, picks out facts to remember, suggests follow-ups, and checks the name you enter during onboarding
• Anthropic (Claude): Writes chat replies when xAI is unavailable, and can analyze room photos
• Cloudflare Workers AI: Identifies what the first photo of a project shows, and creates the chat memory embeddings
• Tavily: Runs the web searches the assistant makes for you. The search query is written from your conversation

5.2 Hosting, Storage and Sign-In

• Cloudflare: Hosts our backend and stores your account record, projects, photos, generated images and chat memory
• Supabase: Handles sign-in, stores your login credentials and the email address you enter on our websites, and stores images that earlier versions of the app saved
• Vercel: Hosts our websites

5.3 Payments

• Apple App Store and Google Play: Take payment for subscription plans
• RevenueCat: Manages your subscription, including the credits your plan includes. It receives your account ID, the store's purchase records, and device and app details (such as platform, operating system and app version) with your IP address

5.4 Notifications, Email, Diagnostics and Maps

• Expo, Apple Push Notification service and Firebase Cloud Messaging (Google): Deliver notifications. They receive your push notification token and the notification text
• Expo Updates: The app checks Expo's update service for new versions. Each check sends your IP address, platform, app and runtime version, and a random installation ID
• Sentry: Receives the crash and error reports described in section 2.2
• Resend: Sends our emails: the app link and contact messages from our websites, bug reports you submit, emails about your account (your email address and name), and internal error alerts that can include your account ID
• Mapbox: Turns an address you type into a map location. It receives the text you type
• DataFast: Measures visits to our websites: pages viewed, referring site, screen size, and the browser, device type and country it derives from your IP address

5.5 Other Disclosures

• Legal Requirements: When required by law, court order, or to protect our rights
• Business Transfers: In connection with a merger, acquisition, or sale of assets

We do not sell your personal information to third parties for their marketing purposes.

6. Cookies & Tracking Technologies

The app does not use cookies. It keeps your sign-in session and settings on your device. Our websites use DataFast analytics, which sets first-party cookies (a random visitor ID kept for one year and a session ID kept for 30 minutes) to count visits and pages viewed. We do not use advertising cookies. Our website forms use Cloudflare Turnstile, which checks your browser and IP address to block bots.

7. Data Retention

• Account, projects, photos, generated images and chat memory: Kept until you delete them or your account
• Usage events recorded before you sign in: Deleted after 30 days. Events linked to your account are deleted with it
• History of memories the assistant added: Deleted after 180 days, or sooner when the memory itself is deleted
• Database backups: We keep the last 14 daily backups. A deleted record stays in older backups until newer ones replace them. Backups hold account records and chat memory, not images
• Crash reports and server logs: Kept by Sentry and Cloudflare under their retention settings
• Support emails and bug reports: Kept in our support mailbox, including after you delete your account

8. Deleting Your Account

In the app, go to Profile → Security → Delete Account. You can also follow the steps at our account deletion page or email contact@aicompoz.it from the address on your account.

Deleting your account removes your sign-in, profile, projects, chat memory and its embeddings, notification tokens and usage events, and the photos and generated images the current app stores. Images that earlier versions of the app saved with Supabase are not yet removed by account deletion; email us to have them removed. We keep a record of credits granted for each purchase with your account ID removed, and Apple, Google and RevenueCat keep their own purchase records. Bug reports and emails you sent us stay in our support mailbox. Deleted records remain in our last 14 daily backups until newer ones replace them.

9. Data Security

We implement industry-standard security measures including:

• Encryption of data in transit (TLS/SSL) and at rest
• Secure authentication and access controls
• Regular security assessments
• Limited employee access to personal data

While we strive to protect your data, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your own, including the United States, where our servers and service providers are located. We ensure appropriate safeguards are in place for such transfers in compliance with applicable data protection laws.

11. Your Privacy Rights

Depending on your location, you may have the right to:

• Access: Request a copy of your personal data
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your personal data
• Portability: Receive your data in a portable format
• Objection: Object to certain processing activities
• Withdraw Consent: Withdraw consent for optional processing

To exercise these rights, contact us at contact@aicompoz.it

12. California Privacy Rights (CCPA)

California residents have additional rights under the California Consumer Privacy Act:

• Right to Know: What personal information we collect and how it's used
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: We do not sell personal information
• Non-Discrimination: We will not discriminate against you for exercising your rights

13. European Privacy Rights (GDPR)

If you are in the European Economic Area (EEA), UK, or Switzerland, you have additional rights under the General Data Protection Regulation:

• Right to access, rectify, or erase your personal data
• Right to restrict or object to processing
• Right to data portability
• Right to lodge a complaint with a supervisory authority

Our legal bases for processing include: contract performance, legitimate interests, legal obligations, and consent.

14. Children's Privacy

Compozit Vision is not intended for users under 13 years of age (or 16 in the EEA). We do not knowingly collect personal information from children. If we learn we have collected data from a child, we will delete it promptly.

15. Changes to This Policy

We may update this privacy policy periodically. We will notify you of material changes by email or through the app. The "Last updated" date at the top indicates when the policy was last revised. Continued use of our services after changes constitutes acceptance of the updated policy.

16. Contact Us

For questions about this Privacy Policy or to exercise your rights: