Privacy Policy

Formspace ("Formspace," "we," "us," or "our") provides AI-powered product visualization and room-scene tools for furniture and interior brands. This Privacy Policy explains how we collect, use, disclose, and protect information about you when you visit our website, create an account, or use our platform and related services (collectively, the "Service").

By accessing or using the Service you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Service. This Privacy Policy is incorporated by reference into our Terms and Conditions.

1. Definitions

• Personal Information means any information that identifies or could reasonably be used to identify a natural person, directly or indirectly.
• Content means any text, images, photographs, product data, metadata, or other material you upload, submit, or otherwise make available through the Service.
• Generated Output means images, scene renders, visualizations, or other AI-generated material produced by the Service based on your Content and inputs.
• Sub-processor means a third-party service provider that processes Personal Information on our behalf to help us deliver the Service.
• Workspace means the shared environment within an account where team members collaborate on catalogs and scenes.

2. Information We Collect

We collect information in three ways: information you provide directly, information collected automatically, and information received from third parties.

2a. Information You Provide

• Account registration. When you create an account we collect your name, email address, and a hashed password. If you register through a third-party authentication provider (e.g., Google), we receive the profile information you authorize that provider to share.
• Profile and workspace data. Company name, role, workspace name, and any other details you add to your profile or workspace settings.
• Content you upload. Product images, room-scene photographs, catalog data, metadata, tags, and any other files or data you submit to the Service. This includes images processed through our AI visualization pipeline.
• Payment information. We use a third-party payment processor (Stripe) to handle billing. We do not store your full card number on our servers; Stripe stores and processes payment data under its own privacy and security standards.
• Communications. Emails, support tickets, chat messages, and any other correspondence you send to us.
• Survey and feedback responses. Any information you voluntarily provide in response to surveys, user interviews, or product feedback requests.

2b. Information Collected Automatically

• Log data. IP address, browser type and version, operating system, referring URL, pages visited, time and date of visit, and other standard server log information.
• Usage and event data. Feature interactions, clicks, button presses, scene renders initiated, catalog actions, and similar product-usage events.
• Device information. Hardware model, screen resolution, operating system, and unique device identifiers where relevant.
• Cookies and similar technologies. Session cookies (required for authentication), preference cookies, and analytics cookies. See Section 6 for full details.

2c. Information From Third Parties

• Authentication providers. If you use single sign-on (e.g., Google OAuth), we receive name, email address, and profile picture from that provider.
• Payment processors. Stripe may share billing status, subscription tier, and fraud-signal information with us.
• Analytics partners. Aggregated or anonymized data from analytics tools that help us understand traffic sources and product usage.

3. How We Use Information

We use the information we collect for the following purposes:

• Providing the Service. Authenticating users, operating Workspaces, processing uploaded Content, generating room visualizations, and delivering all other features of the platform.
• Account management. Creating and managing accounts, processing subscription changes, and communicating transactional information such as invoices and password resets.
• AI processing pipeline. Your uploaded images and product data are passed through our AI models and third-party AI APIs solely to produce the Generated Outputs you request. We do not use your Content to train our models or third-party foundation models without your separate, explicit consent.
• Service improvement. Analyzing aggregate usage patterns, debugging errors, testing new features, and improving platform performance and reliability.
• Customer support. Responding to inquiries, troubleshooting issues, and fulfilling requests.
• Security and fraud prevention. Detecting and preventing unauthorized access, abuse, and other potentially harmful activity.
• Legal compliance. Complying with applicable laws, regulations, legal processes, and enforceable governmental requests.
• Communications about the Service. Sending product updates, feature announcements, and important notices. You may opt out of non-essential communications at any time.

4. Legal Bases for Processing

Where applicable law requires a legal basis for processing Personal Information (e.g., under GDPR or similar frameworks), we rely on the following bases:

• Contract performance. Processing necessary to provide the Service you have subscribed to, including account management, Content processing, and billing.
• Legitimate interests. Processing necessary for our legitimate business interests, such as security, fraud prevention, product analytics, and service improvement, where those interests are not overridden by your rights.
• Legal obligation. Processing required to comply with applicable laws and regulations.
• Consent. Where we rely on your consent (e.g., optional marketing communications or use of non-essential cookies), you may withdraw consent at any time without affecting the lawfulness of prior processing.

5. How We Share Information

We do not sell, rent, or trade your Personal Information to third parties for their own marketing purposes. We may share information in the following circumstances:

• Sub-processors. We share data with trusted service providers who help us operate the Service (see Section 7 for a list). These providers are contractually bound to use data only as directed by us and to maintain appropriate security standards.
• Workspace members. When you operate within a shared Workspace, other members of that Workspace may see your name, profile information, uploaded Content, and Generated Outputs associated with the Workspace.
• Business transfers. If Formspace is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or a portion of its assets, your information may be transferred as part of that transaction. We will notify you via email or a prominent notice on the Service prior to your information becoming subject to a different privacy policy.
• Legal requirements. We may disclose information when required by law, subpoena, court order, or other governmental authority, or when we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Formspace, our users, or the public.
• With your consent. We may share information with third parties when you have given us explicit consent to do so.
• Aggregated or de-identified data. We may share aggregated or de-identified information that cannot reasonably be used to identify you for industry research, analytics, or marketing purposes.

6. Cookies and Analytics

We use cookies and similar tracking technologies to operate and improve the Service. A "cookie" is a small text file stored in your browser. We use the following categories:

• Strictly necessary cookies. Required for authentication, session management, and core Service functionality. These cannot be disabled without breaking the Service.
• Preference cookies. Store your settings and preferences (e.g., UI state) to personalize your experience.
• Analytics cookies. We use PostHog to collect usage events, page views, feature interactions, and session data. PostHog data is used exclusively to understand and improve the Service. When you are signed in, analytics events may be associated with your account identifier to give us a complete view of your product journey. PostHog is configured to respect do-not-track signals where possible.

You can control cookies through your browser settings. Disabling analytics cookies will not prevent you from using the Service, but it may limit our ability to improve the product based on usage patterns. For more information on PostHog’s data practices, see posthog.com/privacy.

7. Sub-processors

We work with the following categories of sub-processors to deliver the Service. Each is subject to data processing agreements and appropriate safeguards:

• Cloud infrastructure. Servers, databases, file storage, and content delivery networks used to host and run the Service.
• AI model providers. Third-party AI APIs used to process uploaded images and generate room visualizations. Your Content is transmitted to these providers solely to fulfill the generation request you initiate. We select providers whose terms prohibit use of customer data for model training.
• Payment processing. Stripe, Inc. handles all payment card data. Stripe is PCI-DSS compliant. See stripe.com/privacy.
• Email delivery. Transactional and notification emails are sent via a third-party email delivery provider.
• Analytics. PostHog for product usage analytics (see Section 6).
• Customer support. Crisp for in-app chat and support ticket management.
• Authentication. Third-party OAuth providers (e.g., Google) when you choose to use single sign-on.

8. AI Processing and Your Content

• Purpose limitation. Images and product data you upload are processed by our AI pipeline exclusively to produce the room visualizations and Generated Outputs you request. We do not use your Content for any other purpose without your consent.
• No training on your data. We do not use your Content to train, fine-tune, or improve our own AI models or those of our third-party AI providers, except where you have given explicit written consent to participate in a training program.
• Temporary processing. Content transmitted to third-party AI APIs is processed transiently to return the output to you. We select providers that do not retain your input data beyond the processing window required to complete the request.
• Generated Output storage. Generated Outputs are stored in your account so you can access, download, and manage them. You may delete Generated Outputs at any time from within the Service.

9. Data Retention

• Account data. We retain your account information for as long as your account is active. If you close your account, we will delete or anonymize your Personal Information within 90 days unless we are required to retain it by law.
• Content and Generated Outputs. Uploaded Content and Generated Outputs are retained for as long as your account is active and for a reasonable period thereafter to allow for account recovery. Following account deletion, Content is purged from active storage within 90 days and from backups within 180 days.
• Billing records. Transaction and invoice records are retained for up to 7 years to comply with financial and tax record-keeping requirements.
• Log and analytics data. Server logs are retained for up to 90 days. Anonymized or aggregated analytics data may be retained indefinitely.
• Legal holds. We may retain information beyond the standard periods described above where necessary to comply with legal obligations, resolve disputes, or enforce our agreements.

10. Security

We implement and maintain administrative, technical, and physical safeguards designed to protect your Personal Information against unauthorized access, disclosure, alteration, and destruction. These measures include:

• Encryption of data in transit using TLS.
• Encryption of sensitive data at rest.
• Access controls limiting data access to authorized personnel only.
• Regular security reviews and dependency monitoring.
• Use of managed cloud infrastructure with built-in security controls.

No method of electronic transmission or storage is completely secure. We cannot guarantee absolute security of your information. If you become aware of a security vulnerability or incident, please notify us immediately at hello@formspace.us.

11. International Data Transfers

Formspace is headquartered in the United States. If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the United States and other countries where our sub-processors operate. These countries may have data protection laws that differ from those in your jurisdiction.

Where required, we rely on appropriate transfer mechanisms such as Standard Contractual Clauses approved by the European Commission, or other lawful transfer mechanisms, to ensure your Personal Information receives adequate protection when transferred internationally.

12. Children’s Privacy

The Service is intended for business and professional use by individuals who are at least 18 years of age. We do not knowingly collect Personal Information from children under 13 (or the applicable age of digital consent in your jurisdiction). If we learn that we have inadvertently collected such information, we will promptly delete it. If you believe a child has provided us with Personal Information, please contact us at hello@formspace.us.

13. Your Rights and Choices

Depending on your location, you may have the following rights regarding your Personal Information:

• Access. Request a copy of the Personal Information we hold about you.
• Correction. Request that we correct inaccurate or incomplete Personal Information.
• Deletion. Request that we delete your Personal Information, subject to certain legal exceptions.
• Portability. Request that we provide your Personal Information in a structured, machine-readable format.
• Restriction. Request that we restrict processing of your Personal Information in certain circumstances.
• Objection. Object to processing based on legitimate interests or for direct marketing purposes.
• Withdraw consent. Where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.
• Account settings. You may update your profile information and notification preferences directly in your account settings at any time.

To exercise any of these rights, email us at hello@formspace.us with a description of your request. We will respond within 30 days (or within the timeframe required by applicable law). We may ask you to verify your identity before processing your request.

14. US State Privacy Rights

Certain US state privacy laws grant additional rights to residents of those states.

• California (CCPA / CPRA). California residents have the right to know what Personal Information we collect and how it is used, the right to delete Personal Information, the right to correct inaccurate Personal Information, the right to opt out of the sale or sharing of Personal Information (we do not sell or share Personal Information for cross-context behavioral advertising), and the right to non-discrimination for exercising these rights. To submit a verifiable consumer request, email hello@formspace.us.
• Other states. Residents of Virginia, Colorado, Connecticut, Texas, and other states with comprehensive privacy laws may have similar rights. We will honor verified requests made in accordance with applicable state law.

15. Do Not Track

Some browsers offer a "Do Not Track" (DNT) setting that signals to websites that you do not want to be tracked. Because there is no accepted industry standard for responding to DNT signals, our Service does not currently alter its data collection practices in response to DNT signals. We will revisit this position if a standard practice emerges.

16. Links to Third-Party Sites

The Service may contain links to third-party websites, integrations, or services that are not operated by Formspace. Clicking those links will take you away from the Service. We have no control over and assume no responsibility for the content, privacy practices, or conduct of any third-party sites. We encourage you to review the privacy policy of every site you visit.

17. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the "Last updated" date at the top of this page and provide at least 14 days’ advance notice by email or in-app notification before the changes take effect. For non-material changes, updating the date is sufficient notice.

Your continued use of the Service after the effective date of the revised policy constitutes your acceptance of the changes.

18. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: hello@formspace.us
• Company: Formspace
• Jurisdiction: State of Georgia, United States

We will make every reasonable effort to address your concern promptly and in accordance with applicable law.