Privacy Policy — Roomark

The controller of this site is Tmi Leo Iivonen (trading as Roomark), Finland. This policy is updated when the service or third-party tools we use change.

Controller

Tmi Leo Iivonen — data protection contact: leo.iivonen@gmail.com.

What data we process

Account data: email address and an optional invitation code provided at sign-up.
Listings: the floor plan and the room markings you save to your account.
Usage counts: the number of AI operations (room detection, AI staging) per user, used to enforce monthly and lifetime limits.
Contact messages: the name, email, optional company and message you submit via the contact form.
Payment data: subscription-related transaction data and a customer identifier passed to us by the payment processor (Paddle) for subscription management. We do not process or store card details.

What we do not store

We do not store the apartment photos you upload or the AI-staged images. Images are processed as part of the request and remain in your browser for you to download the finished result.

Purposes and legal bases

Performance of a contract (GDPR 6(1)(b)): account creation, sign-in, saving listings, enforcing usage limits, subscription and billing.
Legitimate interest (GDPR 6(1)(f)): improving the service, security and abuse prevention, and responding to contact messages.
Legal obligation (GDPR 6(1)(c)): data required by accounting and tax law.
Consent (GDPR 6(1)(a)): optional marketing messages, sent only after explicit consent.

Processors and recipients

Supabase — authentication, database and storage (floor plans).
Lovable AI Gateway — routing to AI models (e.g. Google Gemini) for room detection and staging.
Paddle.com Market Limited — payment processor and Merchant of Record, responsible for processing subscriptions, taking payments, collecting VAT and billing. Paddle acts as an independent controller for payment-related data; see Paddle's privacy policy.

Only data required to fulfil the request is passed to these processors. Data may be transferred outside the EU/EEA where a processor operates from there; such transfers rely on EU Standard Contractual Clauses.

Retention

Account data and saved listings: until you delete the listing or the account.
Usage rows: kept for billing and quota tracking.
Contact messages: until the matter is handled, at most 24 months.
Payment-related accounting data: 6 years, as required by Finnish accounting law.

Your rights

You have the right to access, rectify and erase your data, restrict or object to processing, and request data portability. You can delete your saved listings directly from the account page. To delete your account, contact us at the email above. You also have the right to lodge a complaint with a supervisory authority (in Finland, tietosuoja.fi).

Security

We use appropriate technical and organizational measures — encrypted connections (TLS), access controls and regular backups — to protect personal data.

Cookies

We use only technical cookies and browser storage required for sign-in and session persistence. We do not use advertising trackers. The payment processor Paddle may set its own cookies during checkout.

Questions? Get in touch.