Privacy policy

1. Data controller

The controller of your personal data is Paweł Kazubski, trading as Prosciej (prosciej.com), with a registered address at ul. Leona Babińskiego 1, 71-051 Szczecin, Poland, tax ID (NIP) 955-215-93-41, REGON 321206492. Contact for data-protection matters: our contact form at prosciej.com/kontakt.

We have not appointed a Data Protection Officer (DPO). For all matters concerning personal data, please use the contact details above.

2. Scope of collected data

We process only the data necessary to provide the service and handle payments:

• account data: your email address and (when signing in with Google) the name from your Google profile,
• project data: room dimensions, panels, materials and files saved in the editor,
• billing data: subscription status and invoice details (name, address, tax ID) if you provide them,
• technical data: IP address, browser type and event logs required for security and diagnostics.

3. Purpose and legal basis of processing

We process your data for the following purposes and on the following GDPR legal bases:

• providing the service and maintaining your account — Art. 6(1)(b) GDPR (performance of a contract),
• handling payments and issuing invoices — Art. 6(1)(b) and (c) GDPR (legal obligation, including tax law),
• security, abuse prevention and diagnostics — Art. 6(1)(f) GDPR (legitimate interest),
• marketing communication (if you consent) — Art. 6(1)(a) GDPR (consent, which you may withdraw).

4. Data recipients and processors

We use trusted providers that process data on our behalf: hosting and infrastructure providers (Railway, Vercel), the payment operator (Stripe), a file-storage service (Cloudflare R2), a transactional-email provider (ZeptoMail), and an AI model provider (OpenRouter), used by the assistant, by furniture-description recognition and by visualisation generation. We do not sell your data.

If you use photorealistic visualisation, images of your designed scene (the editor view together with its depth map) are transmitted to the image-generation model provider (OpenRouter) to be processed there and returned as a finished visualisation. We send only the scene images and a description of the materials used — no account data and no billing data.

Some providers may process data outside the European Economic Area — this applies in particular to OpenRouter, which processes it in the United States. In such cases, the transfer relies on Standard Contractual Clauses approved by the European Commission.

5. Data retention period

We keep account and project data for the duration of the contract (while your account exists). After you delete your account, we delete or anonymise the project data. Billing data and invoices are retained for the period required by tax law (generally 5 years).

6. Your rights

Under the GDPR you have the following rights, which you can exercise by contacting us:

• the right to access your data and obtain a copy of it,
• the right to rectify inaccurate data,
• the right to erasure (“right to be forgotten”),
• the right to restrict processing,
• the right to data portability,
• the right to object to processing based on legitimate interest,
• the right to withdraw consent at any time (without affecting the lawfulness of earlier processing),
• the right to lodge a complaint with the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland.

7. Cookies and similar technologies

We use cookies and browser storage (localStorage) for purposes essential to the service — among others, keeping your login session and remembering your chosen interface language. This data stays on your device and is not used for profiling.

In the demo version of the editor we additionally keep the project you build there in your browser's storage, so that your work is not lost when the page reloads. Only project data is stored — furniture dimensions and layout. It contains no identifying data, stays on your device and is not sent to us. We delete it automatically 1 day after your last change; you can also remove it yourself by clearing the site data in your browser. The project reaches our servers only if you choose to save it to an account.

For analytics we use a two-level model. Without your consent we rely solely on cookieless analytics: PostHog (servers in the European Union) for product-funnel analysis, and Vercel Analytics and Speed Insights for traffic and page-performance metrics. In this mode these tools set no cookies or other identifiers on your device and are not used for profiling or advertising. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in maintaining and improving the service.

If you consent via the banner (Art. 6(1)(a) GDPR), PostHog will store a persistent, anonymous identifier on your device (in localStorage and a cookie) and automatically record page interactions (autocapture, excluding the 3D editor). This lets us recognise you on return visits and better understand how the service is used. You can withdraw consent at any time — via the “Change privacy settings” button at the bottom of this page or in the site footer — and withdrawing consent removes the identifier from your device.

PostHog and Vercel act as our processors and process this data on our behalf. If you would rather not be included in this analytics, enable the “Do Not Track” (DNT) signal in your browser — we respect it and then collect no analytics data; you can also use a script-blocking extension.

We also run advertising campaigns on Google Ads, so we load the Google tag (gtag.js) provided by Google Ireland Limited, operating in Google Consent Mode v2. Without your consent, every storage type in that tag (ad_storage, ad_user_data, ad_personalization, analytics_storage) stays disabled: the tag writes no cookies or advertising identifiers to your device, reads none, and is not used for profiling — Google receives only a cookieless, identifier-free signal that an account was created, from which it estimates campaign performance statistically. Only after you consent via the banner (Art. 6(1)(a) GDPR) may the tag store Google cookies (including _gcl_*) and link the sign-up to a specific ad click. You can withdraw consent the same way as above. Google Ireland Limited is a recipient of this data and acts as a separate controller; transfers to the United States rely on the European Commission's adequacy decision (EU–US Data Privacy Framework).

8. Contact

For matters related to personal-data protection, contact us through our contact form at prosciej.com/kontakt. We will respond without undue delay and no later than the period required by the GDPR.