Privacy policy

Who is responsible

Benveg (Société par actions simplifiée unipersonnelle), 173 rue de Courcelles, 75017 Paris, France, SIREN 130444763.

For any question or request about your data: support@romy.app.

What we collect

romy runs on the following, and nothing is collected just in case:

• Your email address, to create your account and sign you in.
• Your room photo, which you upload yourself.
• The objects detected in that photo and the fate you give each one (keep, remove, replace).
• Your brief: style, renovation level, indicative budget.
• The generated renders, their shopping list, and the internal quality score.
• Your credits and, once purchases open and if you buy a pack, the corresponding receipt.
• Outbound clicks to brand shops, plus technical cost and latency measurements.
• The country your phone is set to, read once when you first open the app and kept on your account so we show you shops that deliver where you are. You can change it in the app, and it is a country, never a location.

We use no advertising cookies, do no profiling, and never track you across sites. On the website, usage measurement happens entirely on our servers: nothing is stored on your device, which is also why you see no cookie banner. The iOS app uses a technical identifier provided by the system (the identifier-for-vendor), shared only across our own apps on your device. It persists between sessions and across updates, and is reset if you delete the app. It cannot be used to follow you into other companies' apps, and we use no advertising identifier.

Why, and on what legal basis

Each use has its own basis, and they are not interchangeable:

• Providing the service (performance of a contract): without the photo there is no render. This is the basis for everything above, unless a point below names another.
• Improving the product (legitimate interest): keeping your room photo and its renders as private test cases, to check and improve how makeovers are made. This is a DIFFERENT purpose from delivering your render. It is on by default, and one switch in your account settings turns it off (“Use my photos to improve romy”). Three commitments bound it: these photos stay inside romy — they never train an outside AI model and are never shown publicly; deleting a room also takes its photo out of our test cases; turning the switch off stops any future use. These tests may send the photo to Google or OpenAI again, on the same terms as a render. A room created before this version of the policy is only included if you ticked, for that room, the box that asked at the time.
• Featuring a makeover in Looks (consent): showing your makeover and your room photo in the app's Looks feed is a DIFFERENT purpose from the public link. It is off by default, asked per makeover, and withdrawn in the same place.
• Legal obligations: once sales take place, the matching receipts will be kept because the law requires it, independently of any account deletion. No sale has happened yet.
• Security and abuse prevention (legitimate interest): per-generation cost ceilings, and request and free-credit ceilings computed from a fingerprint of your IP address — the address itself is not stored.
• Understanding product usage (legitimate interest): knowing which steps succeed and which fail, so we can fix them. These measurements cover your actions, never the content of your photos or the text of your briefs.

For how long

• Room photo, renders, detected objects, briefs: kept as long as you keep the room. You can delete them at any time, and deletion removes the stored images too — not just the database rows.
• Copies kept as test cases: while the room exists and the improvement switch stays on. After that they can no longer be used, and an automatic cleanup, several times a day, removes them from our storage.
• A makeover featured in Looks: its public copies stay while it is featured. They are deleted by an automatic cleanup, which runs several times a day, after you withdraw that choice, stop the public link, or delete the makeover, the room or the account.
• Saved looks and products, as they were when you kept them: until you remove them or delete your account.
• Purchase receipts, once there are any: kept to meet accounting obligations, even after the account is deleted. They then stop naming you.
• Your waitlist entry and access grant: deleted with the account. The fingerprint of the email used to claim free credits, however, is kept after deletion, so the offer stays one per person. The fingerprint cannot be turned back into the address.
• Clicks and technical measurements: kept without your identifier once the account is deleted. They can no longer be traced back to you and are never re-linked.

Turning the improvement switch off stops any future use of your photos. It cannot undo tests that already ran, and we would rather write that down than let you assume otherwise.

Who else sees it

We do not sell or rent any data. The following providers process it on our behalf:

• Supabase (Ireland, EU) — database, authentication, and storage of photos and renders
• Modal (EU) — running the generation engine
• Google (Gemini API — United States, and any other country where Google or its agents maintain facilities) — analysing your photo and generating the image; your room photo is sent to it as soon as you upload it, and again on every generation. Under the paid terms we use, Google does not use your photo to train its models; it keeps a copy for a limited period only, solely to detect abuse
• OpenAI (Images API — United States, and the other countries where its sub-processors maintain facilities) — generating the image, when romy hands it to its model; your room photo is then sent to it on every generation. Under the API terms we use, OpenAI does not use your photo to train its models; it keeps a copy for 30 days at most, solely to detect abuse, unless the law requires otherwise or the image is flagged as unlawful and kept longer for review
• Google (Sign in with Google, United States) — if you choose that sign-in method
• Apple (Sign in with Apple, United States) — if you choose that sign-in method
• Sentry (EU region) — technical error reports; they carry your account identifier, never your email. If you report a bug from the iOS app, your message and the screenshot you choose to attach go there too — the screenshot is shown to you and you can remove it before sending
• Resend (United States) — sending sign-in emails
• Amplitude (Germany, EU) — product usage measurement: the actions you take in the app, tied to your account identifier
• Crisp (France, EU — their own statement, which we have not independently verified) — the help chat in the iOS app, which reaches you when that app is published; nothing on this website uses it. It connects only when you open it. We then send it your message, any attachment you add, which build of the app you are on, and — when you are signed in — your account identifier, a scrambled version of that identifier that lets Crisp reopen your own conversation rather than somebody else's on a shared phone, and the email address that account uses, so our reply reaches you without you having to retype it. Never your room photos or your renders, unless you attach them yourself. We do not send an Apple "Hide My Email" relay address, because our reply could not reach it. When we send no address — signed out, or that relay case — the chat asks you for one itself, and answering stays optional. Like any service you contact, Crisp also sees your IP address (from which it infers an approximate, city-level location) and the languages your phone is set to prefer
• Vercel (United States) — website hosting
• Stripe (Ireland, EU) — card payments for credit packs and plans bought on the website
• RevenueCat (United States) and Apple — purchases from the iOS app, once it is published. They then receive your account identifier and the transaction reference; if you ask Apple for a refund, we also tell Apple, through RevenueCat, that the purchase concerned was delivered to you — never your usage of it. You can ask us at any time to stop answering Apple about your purchases, by writing to support@romy.app

Providers outside the European Union operate under the European Commission's standard contractual clauses.

If you use romy from an AI assistant

You can link your romy account to an artificial-intelligence assistant, such as Claude or ChatGPT, to start a render from the conversation. The assistant is a service you chose, governed by its own terms and its own privacy policy. Assistants such as Claude or ChatGPT are published by companies based in the United States.

What you write in the conversation, your brief included, reaches the assistant before it reaches us. What romy answers appears there too: the render, which shows your room, with its title, the product list and the names of your rooms. Those then stay with the assistant, under its terms. For ChatGPT, romy has accepted OpenAI's terms for apps: OpenAI may use what romy answers in your conversation under the terms between you (or your organisation) and OpenAI, which can include improving its services, even after you remove romy.

Your room photo: if you have already added it to the conversation, the assistant already has it, and romy may take it from there. If not, romy asks you to add it through romy (the app, or a romy page); it then reaches us directly, without passing through the assistant. We never ask you to drop it into the conversation.

A room's photo can also appear in the conversation: romy shows it when the assistant asks for it on your behalf, for example when you ask to see the room. The assistant may then receive it, and it stays with the assistant under its terms.

Once with romy, the photo and the renders follow exactly the rules of this policy, as if they came from the app. To cut the link, remove romy from your assistant's connections, or delete your romy account; to erase a conversation, ask the assistant.

Shared pages and Looks

If you create a public link for a render, that page becomes PUBLIC: anyone can view it without an account, and it can appear in search engines. Nothing is shared unless you do this.

By default the page shows your original room photo beside the render. You can keep the photo off with the “Include before photo” switch, before or after sharing. Our automatic safety check can also keep it off, and the switch then says so.

You can turn sharing off at any time, and the page stops responding immediately; a room photo you turn off is gone from the page the next time it loads. An image link the page already handed out still stays valid for up to twenty-four hours, and the preview shown in messaging apps can still be served from our own delivery network for up to twenty-five hours. Someone who opened the page in the romy app keeps a copy of its pictures on their phone. Once sharing stops, the app deletes that copy the next time it checks the page; a room photo you only turned off can stay stored there, although the app no longer shows it. Search engines and messaging apps may keep a copy for longer still, which is outside our control.

“Feature in Looks” is a separate choice, made per makeover in the same Share panel, and off until you turn it on. It lets romy show that makeover in Looks, a feed in the romy iPhone app for signed-in users — never in ads, onboarding or on our website. Nothing appears there until the makeover also has a public link and romy's team has checked both pictures, including for private details such as faces or mail, and chosen to feature it.

A makeover featured in Looks includes your original room photo, even when “Include before photo” is off on the public link, because the two choices are separate. It also carries a title, its products and the address of its public link. Its pictures and the feed that lists them are public files that anyone who finds them can open without an account. Their addresses contain your account identifier — a random code, never your name or email — which shows which featured makeovers come from the same account.

You can withdraw that choice at any time, in the same place; stopping the public link or deleting the makeover does the same. romy then removes the makeover from Looks and deletes its public copies in an automatic cleanup, which runs several times a day. A phone that already loaded it keeps the pictures until the app next refreshes Looks, and someone who saved it keeps its title and products.

Your rights

You have the right to access, correct, erase, port, restrict and object to the processing of your data, and to withdraw your consent at any time.

To object to your photos being kept to improve the product, turn off the switch in your account settings — at any time, with no reason needed.

Write to support@romy.app; we answer within one month. You may also lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).