Privacy Policy

This document is an electronic record in terms of the Information Technology Act, 2000 and the rules made thereunder. It is generated by a computer system and does not require any physical or digital signature.

The domain name Designesto.ai (the "Website") is owned and operated by Square Yards Technology Private Limited (the "Company", "we", "us" or "our"), incorporated under the provisions of the Companies Act, 2013, and having its registered office at 3-B, Rajindra Park, Pusa Road, near Rajendra Place Metro Station Gate No. 4, Old Rajinder Nagar, New Delhi 110060, India. The Website provides artificial-intelligence-assisted room and interior design visualization services (the "Platform" or "Services").

For the purpose of this Privacy Policy (the "Policy"), wherever the context so requires:

the terms "You" and "User" shall mean any legal person or entity accessing or using the services provided on this Website, who is competent to enter into binding contracts as per the provisions of the Indian Contract Act, 1872;

the terms "We", "Us" and "Our" shall mean the Website and/or the Company, as applicable;

the terms "Party" and "Parties" shall respectively refer to the User and the Company individually and collectively, as applicable; and

"Personal Information" shall mean information relating to you which, either directly or indirectly, in combination with other information available with us, can identify you.

Headings in this Policy are for reference purposes only and shall not affect the meaning or interpretation of any part of this Policy.

The use of the Website is governed by this Policy and by the Terms of Use available at https://www.designesto.ai/terms-and-conditions. This Policy constitutes a legally binding agreement between the User and the Company.

The Company may amend this Policy by publishing a revised version with a revised effective date. Where a change materially affects how we use Personal Information, we will provide appropriate notice and obtain fresh consent where required by applicable law.

We collect and store only such minimal information as is necessary to provide the Service.

Information you provide to us - (a) your name, email address and password (stored only in hashed form); (b) images and files you upload, including photographs of premises, floor plans and reference images, together with metadata embedded in them; (c) prompts and the style, material, budget and other preferences you submit, and projects and designs you create and save; (d) transaction and billing information, including the Plan selected, Credits purchased and consumed, invoice history, billing address and GSTIN, if furnished; and (e) support tickets, emails, chats and feedback. We do not currently collect a mobile number as part of Account registration.

Information we collect automatically - your IP address, device and browser details, operating system, language and time-zone settings, the pages and features you access, generations requested, credits consumed, session timestamps, error and crash reports, cookies as described in clause 7, and the approximate area inferred from your IP address. For each generation we also record the model provider and the model used, the number of tokens or units that the request and the response consumed, and what the call cost us, so that we can account for Credits, investigate failures and manage capacity. We do not collect precise location unless you expressly enable it.

Your credit and debit card information is not received, stored or retained by the Company or the Website in any manner.

Bot protection - our sign-in and sign-up pages use Cloudflare Turnstile to distinguish a person from an automated script. When the check runs, Cloudflare receives your IP address and the token issued for that check, together with the technical signals its script needs in order to assess the request, and returns a pass or fail result to us. We use it only to protect account creation and sign-in against automated abuse. It is not used for advertising, profiling or measurement, and the cookie it sets is a strictly necessary security cookie as described in clause 7.1.

We rely on your consent where the law requires consent, and otherwise on the necessity of the processing for providing the Services you have asked for and for complying with our legal obligations. Consent for an optional purpose, meaning Model Improvement, marketing and showcase use, and analytics cookies where a banner is shown, is always requested separately from the information needed to provide the Services, and is taken only by a clear affirmative action. Refusing an optional purpose does not reduce your access to core Services. Whether an analytics banner is shown to you depends on where you are, as explained in clause 7.2.

Consent is specific to the purpose described when it is requested. You may refuse an optional purpose without losing access to core Services, and we will seek fresh consent before using Personal Information for a materially different purpose.

You may withdraw consent, request access, correction or erasure, or object to a specific optional use by using the controls made available on the Platform or by writing to connect@designesto.ai.

If withdrawal makes a requested feature impossible to provide, we will explain the consequence before completing the withdrawal. We will stop the relevant future processing within a reasonable period, subject to information that must be retained by law or for the establishment, exercise or defence of legal claims.

We process Personal Information only for lawful purposes connected with the Services, including to: (a) create and authenticate your Account and provide support; (b) generate, deliver, store and retain Output in History; (c) account for Credits, process payments, issue invoices and comply with tax obligations; (d) prevent fraud and misuse, moderate content and secure the Platform; (e) carry out essential diagnostics and, where clause 7.2 permits it, optional analytics; (f) train and improve models only where you have separately opted in under clause 5; (g) send transactional and service communications, which are account, sign-in and security notices, payment receipts and invoices, reminders before an automatic debit, notices that a payment has failed together with the link with which you can recover it, notices confirming a deletion request and its reference, notices of changes to our terms or to this Policy, and replies to your support requests; (h) send marketing communications or showcase designs only where you have separately opted in under clause 4.3; and (i) comply with law and exercise or defend legal claims.

We use your information only for the purpose for which it was collected and will not use it for any new and incompatible purpose without first informing you and obtaining your consent.

Marketing communications. We send marketing email only to a person who has separately opted in to receive it, and an opt-in to marketing is never bundled with registration or with a purchase. Every marketing email carries a one-click unsubscribe control and a link to your email preferences, and an unsubscribe takes effect without any further step. The transactional and service communications listed in clause 4.1(g) are part of the Service, are not marketing, and cannot be opted out of while your Account is open; if you no longer wish to receive them, you may close your Account as described in clause 6.3.

We will use uploaded images, Prompts or Output to train, fine-tune, test, evaluate or improve our image models, safety filters and related features (the "Model Improvement Purpose") only after you provide separate, express and optional consent. Where reasonably practicable, we remove direct identifiers and limit access to authorised personnel. Model-improvement datasets are stored in India. You may withdraw this consent at any time at connect@designesto.ai; withdrawal stops future inclusion and use of your source data and we will remove it from active training datasets within 30 days, unless retention is required by law. Withdrawal cannot reverse training runs already completed or require deletion of statistical model parameters that cannot reasonably be linked back to you. Service delivery, marketing/showcase use and Model Improvement are separate purposes and require separate permissions.

The Company stores Account data, billing records, History and model-improvement datasets on secure servers located in India. In order to produce the Output you ask for, the images, floor plans and Prompts you submit are sent to the artificial-intelligence model providers named in clause 8.3, and some of those providers process the request on infrastructure outside India. That processing is carried out under a contract that permits the provider to use your material only to generate the Output for us, requires appropriate security and confidentiality, and gives the provider no right to use your material to train or improve its own models. Account data and model-improvement datasets are not transferred outside India.

The Company maintains a defined data governance framework which addresses (a) the type and duration of data stored; (b) restrictions on the use of data; (c) data destruction protocols; and (d) security breach response and incident handling procedures.

The Platform provides a History feature that retains uploaded images, Prompts and Output in your Account so that you may access, revisit, re-use and download them. History is a convenience feature and not a guaranteed backup or archival service, and you should retain your own copies. When you delete your Account it is closed and hidden immediately and can be restored for thirty (30) days by signing in again; after that it cannot be restored. Your profile, sign-in credentials and the details you gave when you registered are erased one hundred and eighty (180) days after your request, the period for which the law requires us to keep them. Images you uploaded, Output, History and records of your use of the Platform are retained but are no longer linked to you as an identified person. Invoices, credit notes and payment records already issued are kept as issued for the period stated in clause 6.5, because tax law requires it; they may carry the name, address, State and goods and services tax identification number you gave for billing and are used only to meet those obligations. A deletion is reapplied to any backup that is restored. The full procedure is in clause 12.2 of the Terms of Use.

Where we transfer Personal Information to a service provider in India or another country, we require that recipient to maintain at least the level of protection required under applicable Indian law. We make such a transfer only where it is necessary for the performance of the lawful contract between you and the Company or where you have consented to the transfer, and we apply any additional lawful transfer mechanism that applies to the transfer.

Retention. We keep Account data, meaning your profile, Credit records, History and the material you have uploaded, for as long as your Account is open, and after closure as described in clause 6.3. Payment, invoice and tax records are kept for eight (8) years from the end of the financial year to which they relate, because the Companies Act, 2013 and the Central Goods and Services Tax Act, 2017 require records of that kind to be kept for that period. Notifications received from the payment gateway never contain a card number, bank account number, wallet identifier or UPI identifier; their contents are erased thirty (30) days after receipt and only a reference is kept so that a repeated notification can be recognised. Where we are required by law to retain the information you gave us when you registered, we keep it for one hundred and eighty (180) days after your Account is closed and then erase it. Security and access logs are kept for a rolling period of one hundred and eighty (180) days, held in India, as directed by the Indian Computer Emergency Response Team. Support correspondence is kept for three (3) years from the date on which the matter is closed, so that we can deal with a related complaint or claim, which matches the limitation period for a claim on a contract in India. Operational backups are held on a controlled rotation and are overwritten in the ordinary course, and any deletion is reapplied to a backup that is restored. Where a longer period is required by law, or where information is needed for the establishment, exercise or defence of a legal claim, we keep that information for that period and for that purpose alone.

The Website uses cookies and similar technologies. Strictly necessary cookies are used for authentication, security, session continuity and essential preferences, and include the security cookie set by the bot-protection check described in clause 2.5. They do not require optional analytics consent. We do not store your password in a cookie.

Analytics cookies and your choice. Google Analytics and Microsoft Clarity are the only optional analytics services we use, and neither is loaded until the conditions in this clause are met. If you are in a country whose law requires consent before analytics cookies are set, including the European Economic Area, the United Kingdom or Switzerland, we show a cookie banner before any analytics cookie is set and set none unless you accept. Elsewhere, no banner is shown and analytics may run on the basis of this notice, and you may refuse at any time. Your acceptance or refusal is recorded in a first-party cookie for one hundred and eighty (180) days, so that a refusal is remembered for as long as an acceptance would be, and you may change or withdraw it at any time through the "Cookie preferences" control in the site footer or on our cookie policy page, which lists every cookie we set, its purpose and how long it lasts. Refusing or withdrawing consent removes the analytics cookies we are able to reach from the Website; Microsoft Clarity also sets identifiers on Microsoft's own domains, which we cannot delete on your behalf, and a refusal stops them being set again. We set no advertising cookie, no advertising pixel and no tag-manager container. The bot-protection cookie described in clause 2.5 is a strictly necessary security cookie and is not covered by the banner.

We disclose Personal Information only where necessary for the stated purposes, where you direct us to do so, where separate consent is required and obtained, or where law permits or requires disclosure. Recipients may include: (a) artificial-intelligence model and inference providers used to generate requested Output; (b) cloud hosting, India-based storage, content-delivery and security providers; (c) payment gateways that process payment independently; (d) email delivery, support, CRM and, where clause 7.2 permits, analytics providers; (e) group companies providing internal administration, support or shared infrastructure; (f) professional advisers under confidentiality duties; (g) recipients with whom you choose to share a project or Output; (h) government authorities, regulators, law-enforcement agencies and courts where lawfully required; and (i) an acquirer in a merger, restructuring or sale, subject to protections no less protective than this Policy.

We share personal information only for the purposes stated in this Privacy Policy and only with entities necessary to provide the requested services or comply with applicable legal and regulatory obligations. We do not sell your personal information to third parties for their independent marketing purposes.

The service providers we currently rely on are: Razorpay Software Private Limited, for payments, subscription mandates and refunds; Twilio SendGrid, for transactional and marketing email; Google Cloud Platform, for hosting, storage and infrastructure; OpenAI, Google Gemini and fal.ai, as artificial-intelligence model and inference providers; Google, as the provider of the optional Google sign-in; Google Analytics and Microsoft Clarity, for the optional analytics described in clause 7.2; and Cloudflare, for content delivery, network security and the bot-protection check described in clause 2.5. Each of them processes personal data for us under a contract that limits it to the purpose we specify, and each publishes its own privacy notice. We update this clause when a provider changes.

Transactions on the Website are secure and protected. Any information entered by the User when transacting on the Website is encrypted to protect the User against unintentional disclosure to third parties. The User's credit and debit card information is not received, stored by or retained by the Company / Website in any manner. This information is supplied by the User directly to the relevant payment aggregator/gateway which is authorized to handle the information provided and is compliant with the regulations and requirements of various banks and institutions and payment franchisees that it is associated with.

We maintain reasonable administrative, technical and organisational safeguards appropriate to the nature and risk of the information, including encryption in transit, access controls, authentication, monitoring and restricted personnel access. Encryption at rest is used where supported and appropriate. No internet-based service is completely secure. We do not receive or store complete card credentials or biometric information; payment credentials are handled by authorised payment processors.

Subject to applicable law, you may request access to a summary of Personal Information and processing activities, correction or completion of inaccurate information, erasure, withdrawal of consent, grievance redressal and nomination of another person to exercise rights in the event of death or incapacity. Requests may be sent to connect@designesto.ai. We may verify your identity before acting on a request. We will respond within thirty (30) days of receiving the request, and we may extend that period once by a further thirty (30) days where the request is complex or where you have made several requests, telling you of the extension and of the reason for it within the first period.

In accordance with applicable information-technology, data-protection and consumer laws, the Company has designated the following Grievance Officer:

No establishment or representative outside India. We are established in India and operate the Platform from India. We do not direct the Platform at any other country: we do not market it outside India, we price it only in Indian rupees and United States dollars, we offer it only in English, and we have no office, agent or representative elsewhere.

Children. The Platform is intended solely for persons aged 18 years and above. We do not knowingly collect or process information relating to a child. If we become aware that such information or an image of a child has been uploaded, we will delete it promptly. Please report any concern to connect@designesto.ai.

Third-party links. The Website may contain links to third-party websites and services. Optional third-party analytics are loaded only in accordance with clause 7.2. The Company is not responsible for the independent privacy practices or content of third-party sites, and you should review their notices before providing information.

Contact. Square Yards Technology Private Limited, registered office at 3-B, Rajindra Park, Pusa Road, near Rajendra Place Metro Station Gate No. 4, Old Rajinder Nagar, New Delhi 110060, India. Privacy and grievance queries: connect@designesto.ai. Legal notices: legal@designesto.ai.

This Policy and any dispute arising out of or in connection with it or the Platform shall be governed by and construed in accordance with the laws of India.

Subject to any forum or remedy that applicable law gives you and does not permit these Terms to exclude, the courts at New Delhi, India shall have exclusive jurisdiction. If you are a consumer, you may bring a claim in any other forum that applicable consumer law permits.