Privacy Policy — DreamWall Visualizer
Effective date: [pending final legal review]
This policy explains what the DreamWall Visualizer (the "app") collects, why, who it is shared with, and how long it is kept. It is written from the app's actual behaviour.
Controller: DreamWall, [pending final legal review]. Contact: privacy@dreamwall.net
1. The short version
- We collect what you type into an enquiry form, and nothing more from you as a visitor.
- We do not use analytics, advertising or tracking technologies. There is no analytics SDK, no advertising pixel, and no cross-site tracking in this app.
- If you upload a photograph of your space, it is sent to our AI provider so the app can analyse the wall and generate an image. It is not stored in our database. Metadata such as GPS coordinates is removed before it leaves your browser.
- We do not sell personal information.
2. What we collect
a) Enquiry details — only if you submit an enquiry. Your name and email address (required), and optionally your company, phone number, a description of your use case, and your message. We also record which page you submitted from, and — where our hosting platform provides it — an approximate location consisting of city, region and country. That location comes from network information; we do not collect or store your precise location, and we do not store your IP address with the enquiry.
b) Photographs you upload. If you upload a photo of a space, your browser resizes and re-encodes it before it is sent anywhere. Re-encoding removes embedded metadata, including camera details and any GPS coordinates recorded by your phone. The re-encoded image is sent to our servers and on to our AI provider to detect the wall and to generate a photorealistic image at your request. The image is not written to our database and we do not retain it as part of your record.
c) Account and dealer information. If DreamWall issues you an account, we hold your email address, your display name if you give one, your role, and the organisation you belong to.
d) Work you create. Quotes, proposals and pipeline records you save, including any customer contact details you choose to enter into them. If you enter someone else's details, you are responsible for having a basis to do so.
e) Technical data needed to run the app. A session cookie if you sign in, and information kept in your own browser: flags recording which introductory prompts you have dismissed, and a draft of your current quote and your saved quotes. Browser-stored items stay on your device and are not transmitted to us, and signing out deletes them.
We do not knowingly collect information from children, and the app is not directed to them.
3. Why we use it, and on what basis
| Purpose | Data | Basis |
|---|---|---|
| Respond to your enquiry and prepare a quotation | Enquiry details | Your request; our legitimate interest in responding |
| Show the product in your space | Uploaded photo, measurements | Your request |
| Provide pricing at your entitled tier | Account, organisation | Contract with your organisation |
| Keep quotes and proposals you save | Work you create | Contract; legitimate interest in servicing the relationship |
| Keep the app secure and prevent abuse | Rate-limit counters, audit log | Legitimate interest in security |
4. Who we share it with
We do not sell personal information and do not share it for cross-context behavioural advertising. We use these service providers:
- the hosting platform (Vercel) — hosts the app and processes requests; provides the approximate city/region/country described above.
- the AI provider (OpenRouter) — the AI gateway we send images and advisor questions to. It is a broker: it forwards the request to the model provider that serves the chosen model. As configured today those are OpenAI (for wall detection) and Google (for the photorealistic image), so an uploaded photograph reaches one of them. Changing the configured model changes the recipient.
- Supabase — database and authentication for accounts, saved proposals and the deal pipeline.
- Resend — sends the notification email when an enquiry is submitted. That email contains every field of the enquiry, including your message.
- A shared rate-limit store (Upstash Redis or Vercel KV), where enabled — receives your IP address as part of a short-lived counter key used to stop abuse. This applies to the AI features and equally to submitting an enquiry, accepting an invitation and signing in — the counters are what stop those being hammered. They expire automatically and hold no other data. Where no such store is configured, the counters stay in the application's memory and your IP is not sent anywhere.
We may also disclose information where required by law, to protect our rights, or in connection with a corporate transaction.
5. International transfers
Our providers may process data in the United States and elsewhere.
6. How long we keep it
Retention is enforced by the application, not left to habit:
- Enquiries you make that go no further: 730 days (2 years) from creation, after which the contact details are redacted — the person's name, email and phone are removed and the record is retained in anonymised form. This covers an enquiry that was never passed to a dealer and never worked by anyone.
- Enquiries that become a business conversation: 3,650 days (10 years). Once an enquiry has been passed to one of our dealers, or a member of our team has picked it up, we keep the contact details for as long as that relationship may reasonably continue. Purchases of this kind are planned over years, and a project discussed in one year is often built in another. The window is longer for that reason, and it is still a fixed period — not indefinite.
- Proposals: 2,555 days (7 years), matching ordinary commercial record-keeping, after which the customer's name, email and phone are removed and the commercial record is kept in anonymised form. Deal (pipeline) records hold no contact details of their own — a deal points at a proposal and carries only a stage, a value and a date — so there is nothing in one to redact; redacting the proposal removes the person from both.
- Audit records are append-only and are kept so past actions remain answerable. They record who did what and when, not the content of enquiries.
- Uploaded photographs are not stored in our database.
Retention is applied by a scheduled job that runs daily. Note that the notification email sent to our sales team when you enquire lives in a mailbox and is not covered by these automated windows; it is managed under our ordinary email retention practices.
These windows are configurable by DreamWall; the figures above are the defaults in force.
7. Your choices and rights
You may ask us to access, correct or delete the personal information we hold about you, or to stop contacting you. Write to privacy@dreamwall.net and we will action it. This does not wait for any of the periods above — a deletion request is actioned when you make it, whether or not we are in a live conversation with you. Erasure removes your name, email address and phone number from enquiries and proposals; the commercial record of the transaction is retained in anonymised form, and our audit records — which show who did what and when, not the content of your enquiry — are kept as required.
Depending on where you live you may have additional rights — for example under the California Consumer Privacy Act, or under other US state privacy laws — including the right to know what we collect, to delete it, to correct it, and not to be discriminated against for exercising a right. We do not sell or share personal information as those laws define it.
8. Security
Access to pricing and records is controlled per organisation and enforced by the database, not only by the interface. Confidential dealer pricing is resolved on the server and never sent to a browser that is not entitled to it, and an automated check blocks any release that would break that rule. Administrative changes are written to an append-only audit log. No system is perfectly secure, and we cannot guarantee absolute security.
9. Changes
We may update this policy. The effective date above will change, and material changes will be notified in the app.
10. Contact
privacy@dreamwall.net · DreamWall, [pending final legal review]