Privacy Policy

Effective date 8 October 2026

1. Introduction

Welcome to RoomReveal. This Privacy Policy explains how Mimi Studio d.o.o., a limited liability company organised under the laws of the Republic of Slovenia, with its registered office at Trubarjeva cesta 79, 1000 Ljubljana, Slovenia (hereinafter "Mimi Studio", "we", "us", or "our"), collects, uses, discloses and protects your personal information when you use the RoomReveal mobile application and related services (collectively, the "Service").

By accessing or using the Service, you acknowledge that you have read, understood and agree to be bound by this Privacy Policy. If you do not agree, please do not use the Service.

2. Information We Collect

2.1 Information you provide

We may collect the following information when you voluntarily provide it:

Photos: the photographs of rooms you choose to upload. A photo leaves your device only when you tap Generate. The app never reads your photo library on its own.
Design choices: the style, room type and other options you select, and the designs generated from them.
Account information: on first launch the app creates an anonymous account identified by a random id, with no name and no email address. If you later sign in, we store the identifier Apple or Google gives us and, where they share it, your email address; if you sign in by email, we store that email address. We never see or store a password.
Feedback: the thumbs-up or thumbs-down you give a design, and anything you write alongside it.
Support communications: any message you send us.

2.2 Information collected automatically

When you use the Service, we may automatically collect:

Device information: device model, operating system version and language settings.
Usage data: which screens are opened, which features are used, whether a design was generated and whether it succeeded, and session length.
Crash reports: technical data about errors and performance problems, sent to Sentry.
Hashed device identifier (Android only): when the Android app creates your anonymous account, it sends our servers a hashed form of the device's Android ID. We use it only to prevent abuse of the free trial, by recognising a device that has already had one. It is not used to identify you or to restore an account, and it is not shared with anyone outside our own servers.

None of this ever includes the content of your photos or designs.

2.3 Information from third parties

Payment processors: Apple manages in-app purchases on iPhone and iPad, and Google Play on Android. Through RevenueCat we receive a record of which plan is active and until when. We do not process or store payment card details.
Attribution: to learn which advertisement or link led someone to the app, the app uses Singular, a measurement provider. Singular receives the fact that the app was installed and opened, which products were bought in it (never the amount, and never a payment detail), the random id of your account, your IP address, and technical details of your device and the app, such as the model, the operating system and the app version. It also receives an identifier of your device: on iPhone and iPad the identifier Apple gives to all of one developer's apps on a device (IDFV), which needs no permission, and, only if you allow tracking, the advertising identifier (IDFA); on Android, the advertising ID (see section 11). Where a link that opened the app carries campaign parameters, we record those parameters too.

3. How We Use Your Information

We use the information we collect to:

Generate your designs: your photo and your choices are sent to an AI image model, and the result is checked against your photo so the structure of your room is preserved.
Keep your history, so a design is still there tomorrow, and on your next device if you sign in.
Create and manage your account.
Count credits, process subscriptions and verify entitlements.
Send you notifications about your designs, with your permission.
Analyse usage patterns to improve features and fix what breaks.
Respond to your support requests.
Detect and prevent fraud, abuse and security incidents.
Comply with legal obligations.

4. How We Share Your Information

We do not sell your personal information. We may share your data with:

Service providers, third-party companies that help us operate the Service, each only for the purpose named and under contracts that stop them using it for their own ends:
- Google (Gemini image models) and, for some designs, OpenAI: generating the design from your photo.
- DigitalOcean (Frankfurt, Germany): running our server and database.
- Cloudflare R2: storing photos and designs.
- Apple, Google Play and RevenueCat: in-app purchases, app distribution and subscription status.
- Resend: delivering the sign-in code when you sign in by email.
- Sentry: receiving crash and error reports.
- Singular: measuring which advertisements and links lead to installs and purchases.
Advertising networks, when we advertise the app: Singular reports installs and purchases to the network that showed the advertisement, such as Meta (Facebook and Instagram), so that the advertisement can be measured. On iPhone and iPad the advertising identifier is part of that report only if you allowed tracking (see section 11).
Legal compliance: when required by law, regulation or legal process, or to protect the rights, property or safety of Mimi Studio, our users or the public.
Business transfers: in connection with a merger, acquisition or sale of assets, your information may be transferred as part of that transaction.

5. AI Providers and Training

Generating a design requires sending your photo and your choices to the AI image providers named above. They process it to return a result and are contractually barred from using it for their own purposes.

We do not use your photos or designs to train AI models, and we do not permit our providers to train on them. We do not sell them and we do not publish them.

6. Data Storage and Security

Your photos, designs and account data are stored on servers in the European Union: our server and database run on DigitalOcean in Frankfurt, Germany, and photos and designs are stored in Cloudflare R2. Usage data (section 2.2) is kept separately, on an analytics server that we operate ourselves in the United States; it never includes your photos or designs. We apply industry-standard security measures, including encryption in transit (HTTPS/TLS), encryption at rest, and access controls.

While we strive to protect your personal information, no method of electronic transmission or storage is completely secure and we cannot guarantee absolute security. If we learn of a breach affecting you, we will tell you.

7. Data Retention

Photos and designs are retained until you delete them or delete your account. Account data is retained while the account exists. If you delete your account, we delete or anonymise your personal data within 30 days, except where we are required to retain it for legal or regulatory purposes.

The hashed device identifier sent by the Android app is the one exception: we keep it after the account is deleted, so that deleting an account and creating a new one on the same device does not grant a second free trial.

Anonymised and aggregated data that cannot be used to identify you may be retained indefinitely for analytics and service improvement.

8. Your Rights (GDPR)

If you are located in the European Economic Area, the United Kingdom or Switzerland, you have the following rights under the General Data Protection Regulation:

Access: request a copy of the personal data we hold about you.
Rectification: request correction of inaccurate or incomplete data.
Erasure: request deletion of your personal data ("right to be forgotten").
Restriction: request that we limit the processing of your data.
Portability: request your data in a structured, machine-readable format.
Objection: object to the processing of your data for specific purposes, including direct marketing.
Withdraw consent: where processing is based on consent, you may withdraw it at any time.

You can exercise the most common of these in the app: History, Select, Delete removes a photo and its design, and Settings, Delete account removes your account, your photos and every design made from them. For anything else, contact us at [email protected] and we will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec) or your local supervisory authority.

9. Legal Basis for Processing (GDPR)

Contract performance: processing necessary to provide the Service you requested, including generating designs, keeping your history and honouring your subscription.
Legitimate interests: analytics, fraud prevention and service improvement, where our interests do not override your rights.
Consent: push notifications, marketing communications and, on iPhone and iPad, tracking for advertising measurement (Apple's prompt, section 11). You may withdraw consent at any time.
Legal obligation: where we are required to process data by applicable law.

10. Children's Privacy

RoomReveal is not directed at children and we do not knowingly collect personal information from children under 16 years of age. If we become aware that we have inadvertently collected personal data from a child under 16 without appropriate parental consent, we will take steps to delete that information promptly. If you believe a child has used the app, write to us and we will delete the account.

11. Cookies and Tracking Technologies

The RoomReveal app uses local storage and device identifiers to maintain your session and your preferences.

Advertising identifiers. On iPhone and iPad, the first time the app opens it asks, through Apple's App Tracking Transparency prompt, whether it may track you. If you allow it, Singular reads the device's advertising identifier (IDFA) so that an install can be matched to the advertisement that led to it, and that match may be shared with the advertising network. If you do not allow it, the IDFA is not read. Singular still receives the other information listed in section 2.3, including installs, purchases and the random id of your account, but without the advertising identifier. Apple's SKAdNetwork also reports installs to advertising networks, as totals that identify no one. You can change your answer at any time in the device's Settings, under Privacy & Security, Tracking.

On Android, Singular reads the device's advertising ID for the same purpose. You can reset or delete that ID in the device's Settings, under Privacy, Ads.

On our website we may use cookies and similar technologies. You can control cookie preferences through your browser settings.

12. International Data Transfers

Your data may be transferred to and processed in countries outside your country of residence, including the United States, where our analytics server and some of our service providers are located. When such transfers occur, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the app or by other appropriate means. The effective date at the top of this page indicates when the policy was last revised. Your continued use of the Service after any changes constitutes your acceptance of the updated Privacy Policy.

14. Contact Us

If you have questions or concerns about this Privacy Policy, please contact us:

Mimi Studio d.o.o.
Trubarjeva cesta 79
1000 Ljubljana, Slovenia
Email: [email protected]