Privacy policy · redsgn

In short

No account, no ads and no trackers. Only if we switch it on, we count visits with Umami Cloud (EU servers), without cookies.
Your photo goes to us and to a third-party AI provider, which makes the new image. For Furnish and Pinterest, a third-party AI language-model provider also looks at your photos. We don't store your photo. At the image provider, your photo is deleted after 1 day and the new image after 7 days.
Three first-party, functional cookies: one keeps count of your free images and limits abuse, one remembers which country's shops you want and one the language you view the site in. That's why there's no cookie banner. More about cookies.
We only have your email address if you leave it yourself, and we only use it to tell you when redsgn launches.
Questions, a copy of your data or deleting something: email [email protected].

Who we are

redsgn (redsgn.me) is a website run by Milan Vilov, in the Netherlands, who is the data controller under the General Data Protection Regulation (GDPR).

Privacy contact: [email protected].

What data, why, and on what legal basis

Photos of your room

What: The photo you choose, and what you add to it: what needs to go or where the piece goes, a style or your own description. For Furnish this can be several photos; for Pinterest also the image of a pin or your own inspiration photo. Your browser first turns it into a JPEG of at most 2048 pixels and strips all metadata, including the location phones write into photos.
Why: To make the image you ask for. For Furnish and Pinterest, an AI language model also looks at your photos and the inspiration: to choose pieces from the catalogue or make a plan, sort your photos, and check that the new image still shows your own room.
Legal basis: Needed to provide the service you use (GDPR art. 6(1)(b)).

A photo of your home can say something about you. It's best to keep people, photos of people and documents with personal details out of the frame.

Product links

What: The shop link you paste (IKEA or Sklum). Our server fetches that product page for the name, measurements and photos. Nothing about you is sent with it.
Legal basis: Needed for the service you use (GDPR art. 6(1)(b)).

Pinterest links

What: The link to a public pin that you paste. Our server fetches that pin's image and title from Pinterest, the way Pinterest itself offers for showing pins. We send nothing about you with it, and we don't keep the pin.
Legal basis: Needed for the service you use (GDPR art. 6(1)(b)).

Visitor code and free images

What: A random code in the cookie redsgn_vid, with no name or email address. With it we count how many free images you've made. If you share redsgn with a friend, we also keep your share code and whether a friend made their first image through your link, so you both get extra images.
Why: Every image costs us money. The code gives everyone a few free images and stops anyone from using the tool endlessly.
Legal basis: Legitimate interest (GDPR art. 6(1)(f)): keeping the free tool affordable and preventing abuse.

Measuring the price offer

What: When your free images are used up, you see what more images would cost. We record that the offer was shown, which pack you clicked or that you closed it, with your visitor code, the tool, the language and the time. No IP address, no browser details, no photos. For Furnish, each record also stores the chosen country (the Netherlands or Croatia). When you tick or untick shops, we store which shops are ticked (only which shops, never what you type), with a code for that chat and whether an image followed, so we learn which shops people want.
Why: To learn whether people would pay for redsgn. We only look at totals, such as how many visitors clicked a pack. Nothing is charged, and we don't use this to treat you differently.
Legal basis: Legitimate interest (GDPR art. 6(1)(f)).

Country (which shops)

What: For Furnish we choose pieces from shops that deliver to your country. On your first visit we guess the country from the one Cloudflare sees for your connection (the CF-IPCountry header). We don't store that country. Only the result, the Netherlands or Croatia, goes into the redsgn_market cookie in your browser. If you choose another country yourself, that choice goes in instead. On your first visit we choose the site's language the same way: from the language your browser asks for (the Accept-Language header) or your connection's country. We don't store those either: only the language goes into the redsgn_lang cookie.
Why: To show you pieces from shops that deliver to you.
Legal basis: Needed for the service you use (GDPR art. 6(1)(b)).

IP address

What: Your IP address comes with every request to every website. Our server keeps it only in memory, for a daily limit per connection. For counting free images per connection we store only a hash made with a secret key: a code your IP address can't simply be worked back from. It's still personal data.
Why: To limit abuse and cost, also when someone keeps clearing their cookies.
Legal basis: Legitimate interest (GDPR art. 6(1)(f)).

Email address (waitlist)

What: Only if you enter it yourself at the price offer. We store it with the pack you chose, your language, the tool, the time, your visitor code and the channel you came from.
Why: To tell you once that redsgn has launched. Nothing else: no newsletter, and we don't pass it on to anyone to email you.
Legal basis: Your consent (GDPR art. 6(1)(a)). You can withdraw it at any time by emailing [email protected], and we'll delete your address.

In your own browser

What: So you don't lose your work when you reload or switch language, the tool keeps your choices in sessionStorage and your photo in IndexedDB. That stays on your own device. We can't access it. Your tab also remembers where you came from (the ?ref= or utm_ labels in the link, such as 'tiktok'). We send them along when counting the price offer, so we can see which channel works.

Who receives your data

We don't sell anything and share nothing for advertising. These companies work for us as processors, under a data processing agreement:

A third-party AI image providerProcessor, based in the United States

Does: Makes the new image with an AI model. For that it receives your photo, the product photo and the text of the request, including what you type yourself (what needs to go, where the piece goes, your own style description).
Note: The provider may use its own sub-processors to run the model, under the same terms. You can ask which ones at [email protected]. Your browser loads the new image through redsgn.me, not directly from the provider, so the provider doesn't see your IP address.
Outside the EU: Yes, the US. Based on the European Commission's standard contractual clauses (SCCs, module 2) in our data processing agreement with this provider. You can ask for a copy of these safeguards at [email protected].

A third-party AI language-model providerProcessor, based in the United States

Does: Only for Furnish and Pinterest. Looks at your photos (scaled down), the pin's image or your inspiration photo, and what you type yourself. With that it chooses pieces from the catalogue or makes a plan, sorts your photos, and checks that the new image still shows your own room. It makes no images itself.
Note: The provider doesn't use what we send to train its models. Your browser never talks to it directly, so the provider doesn't see your IP address.
Outside the EU: Yes, the US. Based on the European Commission's standard contractual clauses (SCCs) in the data processing agreement with this provider. You can ask for a copy of these safeguards at [email protected].

Fly.ioFly.io Inc., United States

Does: Hosts the website and the database, on servers in Amsterdam. That's where the visitor codes, counts, hashed IP addresses and email addresses are kept.
Outside the EU: The data stays in the Netherlands. Because Fly.io is a US company, the standard contractual clauses in Fly.io's data processing agreement apply.

CloudflareCloudflare Inc., United States

Does: Sits in front of the website: delivers pages quickly and keeps out bots and attacks. To do that it sees every request, with your IP address, and may set a short-lived security cookie.
Outside the EU: Certified under the EU-US Data Privacy Framework, with standard contractual clauses as a fallback.

ResendResend Inc., United States

Does: Sends email. When you join the waitlist, Resend forwards your address to the mailbox of whoever runs redsgn. Later it also sends the message that redsgn has launched.
Outside the EU: Certified under the EU-US Data Privacy Framework, with standard contractual clauses in its data processing agreement.

Umami Cloud (only if we switch it on)Umami Software, Inc., United States

Does: Counts visits to redsgn, without cookies. It measures only page views, the referring site, the type of browser and device, and the country. No profile of you and no account. Off by default, and only used once we switch it on.
Outside the EU: The data sits in Umami Cloud's EU region. Because Umami Software is a US company, the standard contractual clauses in Umami's data processing agreement apply. You can ask for a copy at [email protected].

The shops are not our processors. When you use a product link or Furnish, your browser loads the product photos directly from the shop. Per country, these are the shops and addresses:

The Netherlands: IKEA (ikea.com), Sklum (cdn.sklum.com), JYSK (cdn1.jysk.com, cdn2.jysk.com, cdn3.jysk.com, cdn4.jysk.com), WOOOD (cdn.shopify.com), Meubella (cdn.shopify.com), Furnified (cdn.shopify.com) and Woonexpress (woonexpress.nl)
Croatia: IKEA (ikea.com), JYSK (cdn1.jysk.com, cdn2.jysk.com, cdn3.jysk.com, cdn4.jysk.com), Emmezeta (s3.emmezeta.hr), Gnijezdo (gnijezdo.hr), Dizajnholik (dizajnholik.hr), Concordia (concordia.hr) and Namještaj Intermod (namjestaj-intermod.hr)

Those shops see your IP address, as with any website. Our server also fetches product pages and photos from the same addresses, without sending anything about you. redsgn is not affiliated with any of these shops.

Pinterest is not our processor either. Our server only fetches the pin whose link you paste, without sending anything about you. redsgn is not affiliated with Pinterest.

Otherwise we only share data when the law requires us to.

How long we keep it

Your photo, with us: Not stored. Only in memory: a few seconds while we prepare it for the AI provider. For Furnish and Pinterest at most 3 hours, to check the new image and remake it once if needed. Gone whenever the server restarts.
Your photo, at the AI language-model provider: Under that provider's terms, deleted within 30 days, unless it has to look into a request for misuse.
Your photo, at the AI provider: Deleted automatically after 1 day. The same goes for the product photo and the guide image.
The new image: Deleted automatically at the AI provider after 7 days. We don't keep a copy. Until then anyone with the link can open it. The link is long and can't be guessed.
The request, at the AI provider: The text of the request and the links to the images: up to 30 days in the provider's request history.
Cookie redsgn_vid: 1 year after it was set.
Cookie redsgn_market: 1 year after it was set or you last chose a country.
Your connection's country: Not stored. Only used to set the cookie.
Free image counts: Per visitor code and per hashed IP address: deleted 12 months after they were last used.
Share codes and invitations: Per visitor code and hashed IP address: deleted 12 months after they were last used.
Price offer measurements: 180 days.
Request numbers: 30 days. Needed to give a free image back when making it fails.
IP address in memory: At most 24 hours, and gone whenever the server restarts.
Email address: Until you unsubscribe, and at most 24 months after you last signed up. We then also delete the notification in the operator's mailbox.
In your browser: Your choices until you close the tab. Your photo until you remove it in the tool or clear your browser data for redsgn.me.
Server logs: Our own logs contain no photos, email addresses or IP addresses.

Your rights

You can ask us:

what data we hold about you, and for a copy (access and portability);
to correct or delete it;
to restrict its use;
to stop using it where we rely on legitimate interest (objection);
to withdraw your consent for the waitlist.

Email [email protected]. We'll reply within one month. We only ask for more details if we can't otherwise be sure the request is yours.

We don't know your name. If your request is about your visitor code, include the value of the redsgn_vid cookie, which you can find in your browser under the cookies for redsgn.me. Or simply delete the cookie: then nothing is linked to you any more.

If you disagree with how we handle your data, you can complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or to the supervisory authority where you live in the EU. Please feel free to tell us first.

No automated decisions about you

The AI makes a picture of your room. No decision about you depends on it, and we don't build profiles. The number of free images is the same for everyone. There is no automated decision-making with legal or similarly significant effects (GDPR art. 22).

Children

redsgn is not meant for children under 16. If you're younger, please don't leave an email address. If your child did, email us and we'll delete it.

Security

Everything runs over HTTPS. The cookie with your visitor code can't be read by scripts on the page. We only store IP addresses as hashes, and the numbers for the operator are protected by a key. We collect nothing beyond what's described above.

Changes

If we start doing something different with your data, we'll update this page first, with a new date at the top. For anything new that needs your consent, such as a waitlist that does more than it does now, we'll ask first.