Privacy Policy — DreamWall Visualizer

Effective date: [pending final legal review]

This policy explains what the DreamWall Visualizer (the "app") collects, why, who it is shared with, and how long it is kept. It is written from the app's actual behaviour.

Controller: DreamWall, [pending final legal review]. Contact: privacy@dreamwall.net

1. The short version

• We collect what you type into an enquiry form, and nothing more from you as a visitor.
• We do not use analytics, advertising or tracking technologies. There is no analytics SDK, no advertising pixel, and no cross-site tracking in this app.
• If you upload a photograph of your space, it is sent to our AI provider so the app can analyse the wall and generate an image. It is not stored in our database. Metadata such as GPS coordinates is removed before it leaves your browser.
• We do not sell personal information.

2. What we collect

a) Enquiry details — only if you submit an enquiry. Your name and email address (required), and optionally your company, phone number, a description of your use case, and your message. We also record which page you submitted from, and — where our hosting platform provides it — an approximate location consisting of city, region and country. That location comes from network information; we do not collect or store your precise location, and we do not store your IP address with the enquiry.

a2) Your answers to the project questionnaire — only the ones you choose to give. Before the estimator we offer a few multiple-choice questions about the project: the kind of space, what it is mainly for, whether it is indoors or out, how far back people will watch from, and optionally a budget range. The questionnaire is entirely optional — you can skip it, skip any individual question, or go straight to entering your wall size, and nothing is withheld from you if you do.

What is stored is your selection, not your words: we record the identifier of the option you picked (for example `home_theater`, `indoor`), and the database itself will only accept values of that form. There is no free-text box in the questionnaire, and this record cannot contain one. If you had a wall on screen when you submitted, its width and height and the screen you were looking at are stored alongside your answers.

Your answers are used for two things: to narrow the products the app suggests to you, and to be read by the DreamWall salesperson who replies to you. Your budget answer is used only by that person — it is deliberately excluded from the app's recommendation logic, so the products you are shown are chosen on the size and the room, never on what you said you could spend.

b) Photographs you upload. If you upload a photo of a space, your browser resizes and re-encodes it before it is sent anywhere. Re-encoding removes embedded metadata, including camera details and any GPS coordinates recorded by your phone. The re-encoded image is sent to our servers and on to our AI provider to estimate the scale of the space and, at your request, to generate a photorealistic image. The outline of the wall itself is drawn by you, in your browser. The image is not written to our database and we do not retain it as part of your record.

c) Account and dealer information. If DreamWall issues you an account, we hold your email address, your display name if you give one, your role, and the organisation you belong to.

d) Work you create. Quotes, proposals and pipeline records you save, including any customer contact details you choose to enter into them. If you enter someone else's details, you are responsible for having a basis to do so.

e) Technical data needed to run the app. A session cookie if you sign in, and information kept in your own browser: flags recording which introductory prompts you have dismissed, and a draft of your current quote and your saved quotes. Browser-stored items stay on your device and are not transmitted to us, and signing out deletes them.

We do not knowingly collect information from children, and the app is not directed to them.

3. Why we use it, and on what basis

4. Who we share it with

We do not sell personal information and do not share it for cross-context behavioural advertising. We use these service providers:

• the hosting platform (Vercel) — hosts the app and processes requests; provides the approximate city/region/country described above.
• the AI provider (OpenRouter) — the AI gateway we send images and advisor questions to. It is a broker: it forwards the request to the model provider that serves the chosen model. As configured today those are OpenAI (for estimating the scale of an uploaded photo) and Google (for the photorealistic image), so an uploaded photograph reaches one of them. Changing the configured model changes the recipient.

• Supabase — database and authentication for accounts, saved proposals and the deal pipeline.
• Resend — sends the notification email to our sales team when an enquiry is submitted (it contains every field of the enquiry, including your message), sends you an automated acknowledgement of that enquiry, and carries our account emails such as password resets.
• A shared rate-limit store (Upstash Redis or Vercel KV), where enabled — receives your IP address as part of a short-lived counter key used to stop abuse. This applies to the AI features and equally to submitting an enquiry, accepting an invitation and signing in — the counters are what stop those being hammered. They expire automatically and hold no other data. Where no such store is configured, the counters stay in the application's memory and your IP is not sent anywhere.

We may also disclose information where required by law, to protect our rights, or in connection with a corporate transaction.

5. International transfers

Our providers may process data in the United States and elsewhere.

6. How long we keep it

Retention is enforced by the application, not left to habit:

• Enquiries you make that go no further: 730 days (2 years) from creation, after which the contact details are redacted — the person's name, email and phone are removed and the record is retained in anonymised form. This covers an enquiry that was never passed to a dealer and never worked by anyone.
• Enquiries that become a business conversation: 3,650 days (10 years). Once an enquiry has been passed to one of our dealers, or a member of our team has picked it up, we keep the contact details for as long as that relationship may reasonably continue. Purchases of this kind are planned over years, and a project discussed in one year is often built in another. The window is longer for that reason, and it is still a fixed period — not indefinite.

• Your questionnaire answers are kept after your contact details are removed. When either window above expires — or when you ask us to delete your information — your name, email address and phone number are erased from the enquiry, and the multiple-choice answers and wall dimensions stay on the anonymised record. They are what the remaining record is for: that someone wanted an indoor home-theatre wall of a certain size is business information about a project, and once the person is removed it identifies nobody. They are stored as option identifiers, never as text you typed, and the database will not accept anything else in that field.

• Proposals: 2,555 days (7 years), matching ordinary commercial record-keeping, after which the customer's name, email and phone are removed and the commercial record is kept in anonymised form. Deal (pipeline) records hold no contact details of their own — a deal points at a proposal and carries only a stage, a value and a date — so there is nothing in one to redact; redacting the proposal removes the person from both.
• Audit records are append-only and are kept so past actions remain answerable. They record who did what and when, not the content of enquiries.
• Uploaded photographs are not stored in our database.

Retention is applied by a scheduled job that runs daily. Note that the notification email sent to our sales team when you enquire lives in a mailbox and is not covered by these automated windows; it is managed under our ordinary email retention practices.

These windows are configurable by DreamWall; the figures above are the defaults in force.

7. Your choices and rights

You may ask us to access, correct or delete the personal information we hold about you, or to stop contacting you. Write to privacy@dreamwall.net and we will action it. This does not wait for any of the periods above — a deletion request is actioned when you make it, whether or not we are in a live conversation with you. Erasure removes your name, email address and phone number from enquiries and proposals; the commercial record of the transaction is retained in anonymised form, and our audit records — which show who did what and when, not the content of your enquiry — are kept as required. As described in section 6, the multiple-choice answers and wall dimensions from the project questionnaire remain on that anonymised record; they are option selections about a project, not information about you, and once your contact details are removed they identify nobody. If you would prefer those removed as well, say so in your request and we will do it.

Depending on where you live you may have additional rights — for example under the California Consumer Privacy Act, or under other US state privacy laws — including the right to know what we collect, to delete it, to correct it, and not to be discriminated against for exercising a right. We do not sell or share personal information as those laws define it.

8. Security

Access to pricing and records is controlled per organisation and enforced by the database, not only by the interface. Confidential dealer pricing is resolved on the server and never sent to a browser that is not entitled to it, and an automated check blocks any release that would break that rule. Administrative changes are written to an append-only audit log. No system is perfectly secure, and we cannot guarantee absolute security.

9. Changes

We may update this policy. The effective date above will change, and material changes will be notified in the app.

10. Contact

privacy@dreamwall.net · DreamWall, [pending final legal review]