Privacy Policy

1. Who we are

Home AI ("Home AI", "we", "us", or "our") is an AI-powered interior and home design application: you snap or upload a photo of a room or space, and the app reimagines it in new styles, layouts, and looks using artificial intelligence. Home AI is operated by Tupandas. This Privacy Policy explains what data we collect when you use the Home AI mobile app and related services (together, the "Service"), how we use it, and the choices you have. This policy complies with applicable data-protection laws, including the Turkish Personal Data Protection Law No. 6698 ("KVKK") and, where applicable, the EU/UK General Data Protection Regulation.

2. Scope

This policy applies to information processed when you download, install, register for, or use Home AI on any supported platform. It does not apply to third-party services that you choose to connect to the app, which are governed by their own privacy policies.

3. Information we collect

3.1 Information you provide

• Account information. When you create an account or sign in, we collect identifiers such as your email address, display name, and a unique user ID. If you sign in with Apple or Google, we receive only the basic profile fields you authorize. You can also use the app with an anonymous account, in which case we generate a random identifier instead.
• Photos and images you provide. The photos you capture with the camera or import from your gallery (for example, a photo of a room, wall, or space you want redesigned), together with any style, workflow, or prompt selections you make. We refer to this as "Input Images".
• Generated images. The redesigned images and other visual results that the Service produces from your Input Images, and any edits, remixes, or saved variations you make.
• Files and media. When you import an image or file, we collect the file content and metadata (file name, size, type, and image dimensions) so we can process it and store the result.
• Communications. When you contact support, we collect the messages, attachments, and contact details you provide.

3.2 Information collected automatically

• Device & app data. Device model, operating system and version, app version, language, time zone, country, screen size, locale, install source, and a randomly generated installation identifier.
• Usage data. Events such as screens viewed, features used, generations started, designs saved, errors, crashes, session duration, and similar product analytics. Session-replay-style analytics may capture anonymized interaction events (taps, scrolls, screens) but not the content of your private Input Images.
• Subscription & purchase data. Subscription status, plan, credit balance, transaction identifiers, store country, and renewal/cancellation events received from the App Store, Google Play, or our subscription provider. We do not receive your full payment card number.
• Diagnostics. Crash logs, performance traces, and stack traces (with personal content stripped where reasonably possible).
• Approximate location. We may infer your country/region from your IP address. We do not collect precise GPS location.

3.3 Information from others

• Sign-in providers. If you sign in with Apple or Google, we receive the profile fields you authorize.
• Attribution & measurement partners. We may receive non-content signals (such as install attribution and campaign IDs) to understand how users discovered Home AI.

4. How we use information

• To provide the core Service: processing your Input Images, applying the design style or workflow you chose, generating the redesigned images, storing the resulting files, and syncing across your devices.
• To authenticate your account and keep it secure.
• To process subscriptions and credits, manage entitlements, prevent fraud, and handle refunds.
• To debug issues, monitor performance, and improve features.
• To measure marketing campaigns and understand which channels drive new installs (where permitted).
• To communicate with you about your account, important updates, security notices, and (with your consent where required) product news.
• To comply with legal obligations and enforce our Terms of Use.

We do not sell your personal information, and we do not use the content of your Input Images or generated images to serve third-party advertising.

5. AI image generation

Home AI uses artificial-intelligence image-generation technology to turn your Input Images into redesigned visual results. To do so, we transmit the relevant image and your chosen design parameters from our backend to our AI generation service, which returns the generated image.

How generation is performed:

• Tupandas AI generation service. Generation is performed through our own backend infrastructure and the third-party AI model providers it relies on, acting as our processors, for the sole purpose of producing the redesigned image you requested.

We may add, change, or replace the AI providers and models we use as the Service evolves. When we do, we will update this section.

• Content is transmitted over encrypted connections (TLS).
• We rely on the standard data-processing terms offered by our AI providers, which today do not use API inputs to train their public foundation models by default. Where a provider offers additional enterprise data-processing addenda or stricter no-training options, we may enable them where commercially feasible.
• Your Input Images are sent for the sole purpose of returning the requested generated image and are handled by the provider in accordance with their published retention and security terms.
• AI-generated images may contain distortions, artifacts, inaccurate layouts, or results that are not exactly what you intended, and may not reflect what is physically or structurally possible in a real space. You are responsible for reviewing generated images before relying on them.

6. Legal bases for processing (KVKK / GDPR)

We process your personal data on the following legal bases under the Turkish Personal Data Protection Law ("KVKK") and, where applicable, the EU/UK GDPR:

• Performance of a contract — to provide the Service you requested (Article 5(2)(c) KVKK; Article 6(1)(b) GDPR).
• Legitimate interests — to keep the Service secure, prevent abuse, debug issues, measure aggregate usage, and grow our business in a way that is balanced against your rights (Article 5(2)(f) KVKK; Article 6(1)(f) GDPR).
• Consent — for optional analytics, advertising identifiers, and marketing messages, where required by law (Article 5(1) KVKK; Article 6(1)(a) GDPR). You can withdraw consent at any time.
• Legal obligation — to comply with applicable laws (Article 5(2)(a) KVKK; Article 6(1)(c) GDPR).

7. How we share information

We share personal information only in these limited circumstances:

• Service providers / processors who host our infrastructure, run analytics, deliver authentication, process subscriptions, generate images, send emails, and provide customer support — all under written agreements that limit how they can use your data.
• App stores and payment processors (Apple App Store, Google Play, and our subscription provider) that complete your purchase and manage your subscription.
• Legal and safety — when we believe in good faith that disclosure is necessary to comply with the law, respond to valid legal process, protect our rights or property, or protect the safety of users or the public.
• Business transfers — if we are involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will give you notice before your information becomes subject to a different policy.
• With your direction — when you choose to share or export content (for example, sharing a generated image via the OS share sheet or saving it to your device gallery).

8. Third-party services we use

The table below lists the third-party services we currently rely on, the provider, and what we use them for. Specific providers may change over time as we improve the Service; when they do, we will update this section.

9. Analytics & advertising identifiers

On iOS, we ask for your permission through Apple's App Tracking Transparency framework before accessing the IDFA. If you decline, we do not access the IDFA and limit what we share with attribution partners. We do not use third-party advertising networks to show you ads inside the app.

You can change your tracking preference at any time in your device settings.

10. Data retention

• Account & content — kept while your account is active. If you delete an item (Input Image, generated image, or a project), we delete it from active storage and from backups within a reasonable period.
• Account deletion — when you delete your account, we delete or anonymize your personal data within 30 days, except where we are required to keep it for legal, tax, or security reasons.
• Diagnostics & analytics — typically retained for up to 14 months in identifiable form.
• Subscription records — retained for the period required by Turkish tax and consumer-protection law (generally up to 10 years for financial records under the Turkish Tax Procedure Law).
• Support records — retained for up to 5 years for quality assurance and legal compliance.

11. Security

We use industry-standard safeguards including encryption in transit (TLS), encryption at rest where supported by our providers, access controls, audit logging, and least-privilege principles. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security. If we become aware of a security incident affecting your data, we will notify you and the relevant authorities (including the Turkish Personal Data Protection Authority where applicable) as required by law.

12. International transfers

Home AI is offered globally. Your information may be processed in countries other than your own, including in the United States, the European Union, and Türkiye. Where we transfer personal data out of the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum. Where we transfer personal data out of Türkiye, we rely on the safeguards permitted under Article 9 of the KVKK.

13. Your rights

Depending on where you live, you may have the following rights:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Deletion — ask us to delete your account and associated data.
• Portability — receive your data in a structured, commonly used format.
• Restriction or objection — limit or object to certain processing.
• Withdraw consent — where processing is based on consent.
• Lodge a complaint — with your local data-protection authority (in Türkiye, the Kişisel Verileri Koruma Kurumu).

You can exercise most of these rights from inside the app (for example, by editing your profile or deleting your account) or by contacting us at [email protected]. We will respond within the time required by applicable law (30 days under the KVKK).

14. Children's privacy

Home AI is not intended for users under 18 years of age. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected information from a user under 18, we will delete it. If you are under 18, please do not use the Service.

15. California & US state rights

If you are a California resident, the California Consumer Privacy Act (CCPA/CPRA) gives you the right to know what personal information we collect, the right to delete it, the right to correct inaccurate information, and the right to opt out of "sale" or "sharing" of personal information. We do not "sell" personal information as that term is commonly understood. Residents of other US states with comparable laws (such as Virginia, Colorado, Connecticut, Utah, and Texas) have similar rights, which can be exercised by contacting us at the address below.

16. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you in the app, by email, or by updating the "Last updated" date at the top of this page. Your continued use of the Service after the change becomes effective means you accept the updated policy.

17. Contact us

If you have any questions about this Privacy Policy or our handling of your personal information, please contact us:

• Operator: Tupandas
• Email: [email protected]