Privacy Policy

Skipshoot LLC ("Skipshoot LLC," "we," "us," or "our") provides AI-powered product visualization and room-scene tools for furniture and interior brands. This Privacy Policy explains how we collect, use, disclose, and protect information about you when you visit our website, create an account, or use our platform and related services (collectively, the "Service").

By accessing or using the Service you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Service. This Privacy Policy is incorporated by reference into our Terms and Conditions.

1. Definitions

• Personal Information means any information that identifies or could reasonably be used to identify a natural person, directly or indirectly.
• Content means any text, images, photographs, product data, metadata, or other material you upload, submit, or otherwise make available through the Service.
• Generated Output means images, scene renders, visualizations, or other AI-generated material produced by the Service based on your Content and inputs.
• Sub-processor means a third-party service provider that processes Personal Information on our behalf to help us deliver the Service.
• Workspace means the shared environment within an account where team members collaborate on catalogs and scenes.

2. Information We Collect

We collect information in three ways: information you provide directly, information collected automatically, and information received from third parties.

2a. Information You Provide

• Account registration. When you create an account with a password we collect your name, email address, and a hashed password. When you sign up or sign in with Google or Microsoft, we receive your name and the email address that provider has verified, and nothing else: we never receive your password for that provider, and we keep no token from it. Whichever way you sign in, it is the same account.
• Profile and workspace data. Company name, role, workspace name, and any other details you add to your profile or workspace settings.
• Content you upload. Product images, room-scene photographs, catalog data, metadata, tags, and any other files or data you submit to the Service. This includes images processed through our AI visualization pipeline.
• Connected sources. If you connect Dropbox, Google Drive or Microsoft OneDrive to import product images, we store the account name that provider reports and a read-only access token, so that we can browse the drive at your direction and copy the files you choose. We copy only the files you pick. Disconnecting the source deletes the token.
• Payment information. We use a third-party payment processor (Stripe) to handle billing. We do not store your full card number on our servers; Stripe stores and processes payment data under its own privacy and security standards.
• Communications. Emails, support tickets, chat messages, and any other correspondence you send to us.
• Survey and feedback responses. Any information you voluntarily provide in response to surveys, user interviews, or product feedback requests.
• Sales enquiries and the catalog fit quiz. When you write to us through the form on our site, we keep your name, email address, company, what you are interested in, and your message, together with the IP address and browser the enquiry came from. If you take the catalog fit quiz, we save your answers as you go, under a random session identifier with no contact details, so an unfinished quiz tells us what was answered but not by whom; if you reach the last step and send your details, the answers and the plan the quiz recommended are kept with your enquiry. Our staff see enquiries on an internal page, may match them to an account by email address, and may export them to reply to you.
• Acceptance records. When you accept the Terms, the EULA and this Policy, or an in-product notice, we record which version you accepted, when, and the IP address and browser you used, as evidence of the agreement.
• How you found us. When you create an account we keep your answer to “How did you hear about us?”, if you give one, and where your first visit to our site came from: the site that referred you, the page you landed on, and any campaign tags in its address. We use it only to count which channels bring people to the Service.
• Shoppers in the website visualizer. When a business puts our website visualizer on its site, a shopper who uses it uploads a photo of a room. We keep that photo and the pictures made from it, the site the visit came from, and a one-way hash of the shopper’s IP address with counts of photos and pictures, which we use only to apply limits. A shopper makes no account and gives no name or contact details, and their photos and pictures never appear in the business’s gallery. Before an upload, a bot check by Cloudflare Turnstile may run in the shopper’s browser (Section 7).

2b. Information Collected Automatically

• Log data. IP address, browser type and version, operating system, referring URL, pages visited, time and date of visit, and other standard server log information.
• Usage and event data. Feature interactions, clicks, button presses, scene renders initiated, catalog actions, and similar product-usage events.
• AI usage records. For every call the Service makes to an AI model we record which model ran, what the call was for, how long it took, the number of tokens the provider reported, and an estimated cost, against your Workspace, your user account and the render session. These records hold no images, prompts or outputs.
• Device information. Hardware model, screen resolution, operating system, and unique device identifiers where relevant.
• Cookies and similar technologies. Session cookies (required for authentication), preference cookies, analytics cookies only if you agree to them, and your browser’s local storage. See Section 6 for full details.

2c. Information From Third Parties

• Authentication providers. If you sign in with Google or Microsoft, we receive your name and the email address that provider has verified. We do not receive a profile picture, a password, or any other part of that account.
• Payment processors. Stripe may share billing status, subscription tier, and fraud-signal information with us.
• Analytics partners. Aggregated or anonymized data from analytics tools that help us understand traffic sources and product usage.

3. How We Use Information

We use the information we collect for the following purposes:

• Providing the Service. Authenticating users, operating Workspaces, processing uploaded Content, generating room visualizations, and delivering all other features of the platform.
• Account management. Creating and managing accounts, processing subscription changes, and communicating transactional information such as invoices and password resets.
• AI processing pipeline. Your uploaded images and product data are passed through our AI models and third-party AI APIs solely to produce the Generated Outputs you request and to check those Generated Outputs for quality (Section 8). We do not use your Content to train or fine-tune any AI model, and we do not hand it to a provider for that purpose; what a provider may do with it under its own terms is set out in Section 8.
• Service improvement. Analyzing aggregate usage patterns, debugging errors, testing new features, and improving platform performance and reliability.
• Cost accounting. Using the AI usage records to measure what the Service costs to run, per render, per Workspace and per feature, and to check our providers’ bills.
• Customer support. Responding to inquiries, troubleshooting issues, and fulfilling requests.
• Security and fraud prevention. Detecting and preventing unauthorized access, abuse, and other potentially harmful activity.
• Legal compliance. Complying with applicable laws, regulations, legal processes, and enforceable governmental requests.
• Communications about the Service. Sending product updates, feature announcements, and important notices. You may opt out of non-essential communications at any time.

4. Legal Bases for Processing

Where applicable law requires a legal basis for processing Personal Information (e.g., under GDPR or similar frameworks), we rely on the following bases:

• Contract performance. Processing necessary to provide the Service you have subscribed to, including account management, Content processing, and billing.
• Legitimate interests. Processing necessary for our legitimate business interests, such as security, fraud prevention, product analytics, and service improvement, where those interests are not overridden by your rights.
• Legal obligation. Processing required to comply with applicable laws and regulations.
• Consent. Where we rely on your consent (e.g., optional marketing communications or use of non-essential cookies), you may withdraw consent at any time without affecting the lawfulness of prior processing.

5. How We Share Information

We do not sell, rent, or trade your Personal Information to third parties for their own marketing purposes. We may share information in the following circumstances:

• Sub-processors. We share data with trusted service providers who help us operate the Service (see Section 7 for a list). These providers are contractually bound to use data only as directed by us and to maintain appropriate security standards.
• Workspace members. When you operate within a shared Workspace, other members of that Workspace may see your name, profile information, uploaded Content, and Generated Outputs associated with the Workspace.
• Public share links. When a member of your Workspace shares a render by link, anyone with the link can view that image on a page carrying a “Made with Skip Shoot” line. The page shows no name, Workspace, or product data. Messaging and social platforms fetch the image to build link previews and may cache it. We do not record who views a shared link beyond our standard server logs. A share can be withdrawn at any time from the gallery, after which the link stops working; copies already fetched may persist briefly in caches.
• Our staff. Skipshoot LLC staff can access Workspaces to operate and support the Service, see sales enquiries and usage records, and, at a Workspace administrator’s request, issue a password reset link (Section 10).
• Business transfers. If Skipshoot LLC is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or a portion of its assets, your information may be transferred as part of that transaction. We will notify you via email or a prominent notice on the Service prior to your information becoming subject to a different privacy policy.
• Legal requirements. We may disclose information when required by law, subpoena, court order, or other governmental authority, or when we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Skipshoot LLC, our users, or the public.
• With your consent. We may share information with third parties when you have given us explicit consent to do so.
• Aggregated or de-identified data. We may share aggregated or de-identified information that cannot reasonably be used to identify you for industry research, analytics, or marketing purposes.

6. Cookies and Analytics

We use cookies and similar tracking technologies to operate and improve the Service. A "cookie" is a small text file stored in your browser. We use the following categories:

• Strictly necessary cookies. Required for authentication, session management, and core Service functionality. These cannot be disabled without breaking the Service.
• Preference cookies. Store your settings and preferences (e.g., UI state) to personalize your experience.
• Analytics. We use Vercel Web Analytics and Speed Insights, which record page views and page performance without cookies and without identifying you across sites. We may also use PostHog to collect usage events, page views and feature interactions. PostHog in your browser sets cookies, so it runs only after you agree to analytics cookies. Our servers may also send PostHog a record of what you do in the Service, such as starting a render, which sets no cookie. Either way, events are linked to your account number, never your name or email address. Analytics data is used only to understand and improve the Service.
• Local storage. We keep a few preferences in your browser’s local storage, such as which banners you have dismissed, which tab you last used and your choice about analytics cookies; those never leave your browser. It also holds where your first visit came from, which is sent to us only if you create an account (Section 2).

You can change your choice about analytics cookies at any time from Cookie settings at the foot of our website’s pages, and control cookies through your browser settings. Saying no to analytics cookies does not stop you using the Service. For more information on PostHog’s data practices, see posthog.com/privacy.

7. Sub-processors

We work with the following categories of sub-processors to deliver the Service. Each handles data under its own data processing terms and safeguards, except Google’s unpaid Gemini tier, which works under Google’s terms for unpaid services (Section 8):

• Cloud infrastructure. Vercel hosts the Service, runs its render jobs, stores uploaded and generated images, and serves them; a managed PostgreSQL provider hosts the database.
• AI model providers. Google’s Gemini API analyses room and product images and generates renders. Replicate would upscale finished renders, but upscaling is switched off, so nothing is sent to it. Your Content is transmitted to them solely to fulfil the request you initiate. What each may do with it under its own terms is set out in Section 8.
• Payment processing. Stripe, Inc. handles all payment card data. Stripe is PCI-DSS compliant. See stripe.com/privacy.
• Email delivery. Transactional and notification emails are sent through Resend, and Zoho Mail hosts the inbox you write to at admin@skipshoot.com.
• Analytics. Vercel Web Analytics and Speed Insights, and PostHog only if you agree to analytics cookies (see Section 6).
• Authentication. Google and Microsoft, only when you choose to sign in with them.
• Connected sources. Dropbox, Google Drive and Microsoft OneDrive, only when you connect one to import images, and only to read what you choose.
• Bot protection. Cloudflare Turnstile, in the website visualizer, checks that a shopper uploading a photo is a person: its script runs in the shopper’s browser, and we send Cloudflare the result of the check with the shopper’s IP address to confirm it. Only where the check is switched on. See cloudflare.com/privacypolicy.

8. AI Processing and Your Content

• Purpose limitation. Images and product data you upload are processed by our AI pipeline exclusively to produce the room visualizations and Generated Outputs you request, and those Generated Outputs may be checked for quality as described below. We do not use your Content for any other purpose without your consent.
• No training on your data. We do not use your Content to train or fine-tune any AI model, and we do not hand it to a provider for that purpose. What a provider may do with it under its own terms is described below.
• Which Google tier your images go through. Generating a render — in Studio and Editorial, and the pictures the website visualizer makes for shoppers — runs on the paid tier of Google’s Gemini API. Under Google’s terms for paid services, Google does not use prompts, images or outputs to improve its products, though it may log them to detect abuse and for legal reasons. The analysis steps before a render — finding the surfaces in a room photograph (a shopper’s photo in the website visualizer included) or in a scene made in Editorial, locating a surface in a scene, and estimating a product’s size from its photograph — currently run on the unpaid tier. Under Google’s terms for unpaid services, Google may use what is submitted to improve its products and machine-learning technologies, and human reviewers may read it after it has been disconnected from our account. Those steps send the room photograph, the scene, the shopper’s photo or the product photograph, and no other data about you or the shopper. Suggesting furniture for a scene in Editorial also runs on the unpaid tier, and sends only words: the kind of piece, the design style and the setting chosen in the scene builder, with no image and nothing about you.
• Quality checks of Generated Outputs. Our staff may check a Generated Output made for you or your Workspace for problems that would stop it being used commercially, such as furniture placed where it could not stand, a piece at the wrong scale, or a visible flaw left by the AI. That check runs on Google’s unpaid tier, under the terms for unpaid services described above, and sends only the picture, with no file name and no other data about you or your Workspace. The Service does not store the picture or the result of the check, and the check does not change or delete your Generated Output.
• Retention by providers. Content sent to a provider is sent to fulfil that request. Providers keep logs for the periods their own terms state, and removing something from the Service does not delete the copies they hold.
• Generated Output storage. Generated Outputs are stored in your account so you can access, download, and manage them. You may delete Generated Outputs at any time from within the Service.

9. Data Retention

• Account data. We retain your account information for as long as your account is active. If you close your account, we will delete or anonymize your Personal Information within 90 days unless we are required to retain it by law.
• Content and Generated Outputs. Uploaded Content and Generated Outputs are kept while your account is active. Deleting your account deletes your renders, and every Workspace only you belong to, at once; this cannot be undone, and there is no recovery period. Products, scenes and other Content you added to a Workspace that others still use stay with that Workspace. Copies in our providers’ backups are gone within 180 days.
• Billing records. Transaction and invoice records are retained for up to 7 years to comply with financial and tax record-keeping requirements.
• Log and analytics data. Server logs are retained for up to 90 days. Anonymized or aggregated analytics data may be retained indefinitely.
• AI usage records. Kept with our billing records, for up to 7 years, including after a Workspace or account is deleted, because they are the record of what the Service cost to run. They identify a Workspace and user by number only and hold no Content.
• Sales enquiries and quiz answers. Kept while we are in, or reasonably expect, a business relationship with you, and deleted on request.
• Acceptance records. Kept for as long as we may need to show that the agreement was made, which can be after the account is deleted; from then on they are matched to a one-way hash of the account’s email address, not to the account.
• How you found us. Kept after the account is deleted, when it is tied only to the number the account had, and used only for counts.
• Share links. Kept until you withdraw them or delete the render they show, whichever is first.
• Website visualizer. A shopper’s photo and the pictures made from it are deleted 30 days after they are made, or at once when the shopper chooses Delete my photo now before leaving the page. The record of a visit, which holds only counts, a hashed IP address and the site it came from, is deleted 30 days after the visit ends, and the daily counts kept against a hashed IP address after two days.
• Legal holds. We may retain information beyond the standard periods described above where necessary to comply with legal obligations, resolve disputes, or enforce our agreements.

10. Security

We implement and maintain administrative, technical, and physical safeguards designed to protect your Personal Information against unauthorized access, disclosure, alteration, and destruction. These measures include:

• Encryption of data in transit using TLS.
• Encryption of sensitive data at rest.
• Access controls limiting data access to authorized personnel only.
• Regular security reviews and dependency monitoring.
• Use of managed cloud infrastructure with built-in security controls.

Passwords and sessions. We store only a hash of your password. Changing or resetting it signs you out of every other session. If you cannot reset your password by email, a Workspace administrator may ask us to issue a single-use reset link for you; we issue it only after verifying the request, it expires after one hour, and nobody at Skipshoot LLC sees or sets your password.

No method of electronic transmission or storage is completely secure. We cannot guarantee absolute security of your information. If you become aware of a security vulnerability or incident, please notify us immediately at admin@skipshoot.com.

11. International Data Transfers

Skipshoot LLC is headquartered in the United States. If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the United States and other countries where our sub-processors operate. These countries may have data protection laws that differ from those in your jurisdiction.

Where required, we rely on appropriate transfer mechanisms such as Standard Contractual Clauses approved by the European Commission, or other lawful transfer mechanisms, to ensure your Personal Information receives adequate protection when transferred internationally.

12. Children’s Privacy

The Service is intended for business and professional use by individuals who are at least 18 years of age. We do not knowingly collect Personal Information from children under 13 (or the applicable age of digital consent in your jurisdiction). If we learn that we have inadvertently collected such information, we will promptly delete it. If you believe a child has provided us with Personal Information, please contact us at admin@skipshoot.com.

13. Your Rights and Choices

Depending on your location, you may have the following rights regarding your Personal Information:

• Access. Request a copy of the Personal Information we hold about you.
• Correction. Request that we correct inaccurate or incomplete Personal Information.
• Deletion. Request that we delete your Personal Information, subject to certain legal exceptions.
• Portability. Request that we provide your Personal Information in a structured, machine-readable format.
• Restriction. Request that we restrict processing of your Personal Information in certain circumstances.
• Objection. Object to processing based on legitimate interests or for direct marketing purposes.
• Withdraw consent. Where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.
• Account settings. You may update your profile information and notification preferences directly in your account settings at any time, and you can delete your own account from your settings; what that removes is set out in Section 8 of the EULA.

To exercise any of these rights, email us at admin@skipshoot.com with a description of your request. We will respond within 30 days (or within the timeframe required by applicable law). We may ask you to verify your identity before processing your request.

14. US State Privacy Rights

Certain US state privacy laws grant additional rights to residents of those states.

• California (CCPA / CPRA). California residents have the right to know what Personal Information we collect and how it is used, the right to delete Personal Information, the right to correct inaccurate Personal Information, the right to opt out of the sale or sharing of Personal Information (we do not sell or share Personal Information for cross-context behavioral advertising), and the right to non-discrimination for exercising these rights. To submit a verifiable consumer request, email admin@skipshoot.com.
• Other states. Residents of Virginia, Colorado, Connecticut, Texas, and other states with comprehensive privacy laws may have similar rights. We will honor verified requests made in accordance with applicable state law.

15. Do Not Track

Some browsers offer a "Do Not Track" (DNT) setting that signals to websites that you do not want to be tracked. Because there is no accepted industry standard for responding to DNT signals, our Service does not currently alter its data collection practices in response to DNT signals. We will revisit this position if a standard practice emerges.

16. Links to Third-Party Sites

The Service may contain links to third-party websites, integrations, or services that are not operated by Skipshoot LLC. Clicking those links will take you away from the Service. We have no control over and assume no responsibility for the content, privacy practices, or conduct of any third-party sites. We encourage you to review the privacy policy of every site you visit.

17. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the "Last updated" date at the top of this page and provide at least 14 days’ advance notice by email or in-app notification before the changes take effect. For non-material changes, updating the date is sufficient notice.

Your continued use of the Service after the effective date of the revised policy constitutes your acceptance of the changes.

18. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: admin@skipshoot.com
• Company: Skipshoot LLC
• Jurisdiction: State of Georgia, United States

We will make every reasonable effort to address your concern promptly and in accordance with applicable law.