Privacy Policy

1. Introduction and data controller

Welcome to the KLAI privacy policy ("KLAI", "we", "us", "our"). This privacy policy explains what personal data we collect, how we use it, with whom we share it, and what rights you have regarding it when you use our web application and AI assistant for space analysis and design recommendations.

This privacy policy applies to all visitors of our website and to all users of the KLAI service, regardless of whether they use it as registered users or anonymously (as a guest). It covers both the KLAI website (klai.design) and the KLAI application (app.klai.design).

The data controller within the meaning of the General Data Protection Regulation (GDPR) is:

The external service providers listed below (OpenAI, Anthropic, AgentSight, Bunny.net, Qdrant, Railway, Stripe, [SMTP provider]) act as processors / sub-processors, processing personal data on our behalf and in accordance with our instructions, based on their own data-processing agreements and/or terms of service. Google and Apple, when you use them to sign in, act as independent external authentication providers under their own privacy policies — they are not our sub-processors, but separate controllers for the data they process as part of the OAuth sign-in.

2. What data we collect

2.1 Data related to your user account

To use certain features (saving conversation history, purchased recommendations, etc.) you can register and sign in to a user account. The basic AI features are also available without registration, through an anonymous (guest) session.

During registration/sign-in we collect:

• First and last name
• E-mail address
• Password (stored exclusively in hashed form — bcrypt — never in readable form)
• If you sign in via Google or Apple: name, e-mail address and (for Google) profile picture, as shared by those providers according to your privacy settings with them

Sign-in via Google and Apple takes place through the OAuth protocol — KLAI does not see or store the password of your Google/Apple account.

If you forget your password, we send a password-reset link containing a time-limited token to the e-mail address you entered.

Anonymous (guest) use: If you use KLAI without registering, you are assigned a temporary, randomly generated guest identifier (e.g. guest_...) which is stored in your browser's local storage. This identifier does not contain and is not linked to your name, e-mail or other personal data, unless you subsequently register and thereby link an existing guest conversation to a newly created account.

2.2 Data related to the AI assistant, chat and photos

When you use the AI assistant, the following may be collected and processed:

• Questions and messages you send to the AI assistant
• Responses generated by the AI assistant
• Photos you upload (rooms, furniture, materials/samples for comparison)
• Results of the AI space analysis (room type, dimensions, materials, colours, furniture list, your requirements — what to keep/remove)
• Date and time of the interaction
• Conversation ID and, if you are signed in, your user account identifier
• E-mail address (if entered for delivery of the recommendation or via checkout/Stripe)
• Payment data processed via Stripe (KLAI does not store payment card data; that is handled exclusively by Stripe)
• Interface/interaction language

We do not ask or require users to share personal data in order to use the basic AI analysis; the e-mail address and payment data are collected only if you decide to purchase a recommendation/service.

2.3 Forms that collect personal data

We do not collect an address or payment card data through our web forms; payment data is processed directly through Stripe.

3. Cookies and browser local storage

3.1 Cookies

KLAI uses cookies that are necessary for the operation of the web application (authentication, security, language), and — only with your consent — analytics cookies (Google Analytics, loaded via Google Tag Manager) and marketing cookies set by the Meta Pixel and the Pinterest Tag. Necessary cookies are always active; analytics and marketing cookies are loaded only after you accept them via our cookie banner, where each category can be allowed or refused separately.

The necessary cookies (sign-in, security, language, and the record of your cookie choice) are required for the service to work and do not need prior consent under the GDPR and ePrivacy rules. Google Analytics cookies are analytics cookies, while the Meta Pixel and Pinterest Tag are marketing cookies: none of them is set until you actively accept the corresponding category through our cookie banner, and you can change or withdraw your choice at any time via the "Cookie settings" link in the footer.

3.2 Browser local storage and session storage

This data is stored locally in your browser, does not directly contain personal data (name, e-mail) and serves exclusively functional, technical purposes.

3.3 Web analytics and tracking

With your consent, KLAI uses the following tools on klai.design and app.klai.design:

Google Analytics (Google Ireland Ltd.), loaded via Google Tag Manager — to understand how visitors use the site (pages visited, session duration, approximate location at city level). It loads only after you accept analytics cookies and is not active if you decline. IP addresses are processed by Google in anonymised form for measurement purposes.

Meta Pixel (Meta Platforms Ireland Ltd.) — to measure the performance of our advertising on Meta platforms (Facebook, Instagram) and to help optimise those ads. The Pixel loads only after you accept marketing cookies and is not active if you decline. When active, it may share the following event data with Meta: page views (klai.design and app.klai.design) and, on app.klai.design, the standard events CompleteRegistration (successful account creation), Lead (starting a first chat), InitiateCheckout (starting the payment process) and Purchase (successful payment, with order value and currency). These events describe the action taken, not the content of your conversations or photos. Meta acts as an independent controller for the data it receives under its own data policy.

Pinterest Tag (Pinterest Europe Ltd.) — to measure the performance of our advertising on Pinterest and to help optimise those ads. The Tag loads only after you accept marketing cookies and is not active if you decline. It runs on both klai.design and app.klai.design so that a click on a Pinterest ad can be connected to the resulting action (such as a page view or a completed purchase on app.klai.design). These events describe the action taken, not the content of your conversations or photos. Pinterest acts as an independent controller for the data it receives under its own privacy policy.

Aside from the tools listed above, KLAI does not use other web-analytics, behaviour-tracking or error-tracking tools (e.g. Plausible, Microsoft Clarity, Sentry, Hotjar, PostHog).

4. Photos and AI processing

KLAI uses artificial intelligence to analyse photos of spaces, furniture and materials and to generate design recommendations.

4.1 The processing flow

1. Through the chat or a form, you send a query, a description of the space and/or photos (rooms, furniture, materials/samples). Photos you upload through the interface are sent directly to the backend AI service for processing; there is no direct upload from the browser to the CDN storage.
2. Before processing, photos are automatically checked (protection against misuse/prompt injection) and compressed if necessary.
3. The AI assistant analyses the content (text and/or image) and generates a response, a space analysis or a product recommendation.
4. The interaction data is stored for the purposes stated in this document.

Our web application does not permanently store photos or conversation content locally in your browser.

4.2 How photos are stored

• Photos are sent to external AI service providers (see the table in section 7) in order to generate the analysis and recommendations.
• Photos are stored on CDN storage (Bunny.net) so they can be displayed in the conversation and for later review of the recommendation.
• Photos remain linked to your user account solely to display previous conversations and recommendations, and are permanently deleted after the user account is deleted.

4.3 Use of data for AI model training

We do not use your photos or other data to train our own AI models. Photos and data are sent to external AI service providers (OpenAI, Anthropic) exclusively to generate responses/analysis in real time. These providers process data according to their own terms of service, over which we have no direct insight or control. According to their currently applicable terms, data sent via the API is by default not used to train their models; for details we recommend reviewing their privacy policies.

5. Purposes of processing

We use the collected data to:

• Provide and operate the AI assistant and the space analysis you request
• Generate design recommendations, product comparisons and material matches
• Manage the user account and maintain the context of the conversation
• Detect and resolve technical issues
• Analyse and improve the quality of AI responses and recommendations
• Process payments and deliver purchased recommendations by e-mail
• Perform security checks (protection against misuse/prompt injection)

6. Legal basis for processing

• Performance of a contract / provision of the requested service (Art. 6(1)(b) GDPR) — for managing the user account and for providing the AI analysis and recommendations you request.
• Legitimate interest (Art. 6(1)(f) GDPR) — for the security, maintenance and improvement of the service.
• Consent (Art. 6(1)(a) GDPR) — when you voluntarily enter personal data (e.g. e-mail for delivery of the recommendation) or when you sign in via Google/Apple (in that case consent is given with those providers, under their own terms).

7. External service providers / sub-processors

To provide the service we use the following external providers. Each of them processes data on our behalf, based on a data-processing agreement and/or their own terms of service:

In addition, when you sign in via Google or Apple, those providers act as independent authentication providers (OAuth) under their own privacy policies; they are not our sub-processors, but separate controllers for the data exchanged during sign-in. The list of service providers may change from time to time in line with the development of the KLAI platform. An updated version of this Privacy Policy will always be published.

We do not sell, rent or trade your data. We do not share data with anyone other than the providers listed above, except:

• where required by law, court order or by a competent authority;
• in connection with a merger, acquisition or transfer of the business (while maintaining an equivalent level of protection); or
• with your explicit consent.

8. International data transfers

Storage and hosting of the infrastructure take place within the EU (Netherlands, Railway). When the AI providers (OpenAI, Anthropic) process messages and photos, data may be transferred to the USA. Such transfers are protected by appropriate safeguards, including standard contractual clauses and/or the providers' participation in the EU-US Data Privacy Framework, in accordance with their data-processing terms.

9. Data retention period

• Conversation data and AI analysis results are kept until you delete your account.
• Photos are, by design, kept until you delete your account, after which they are permanently removed from the CDN storage and from the connected systems.
• Temporary technical data (e.g. image metadata in the Redis cache) is automatically deleted after 7 days.
• You can request deletion of your data before the expiry of the above periods (see section 12, "Your rights").

10. Data security

We apply appropriate technical and organisational data-protection measures, including encryption of data in transit (HTTPS/TLS), restricted access to data by authorised personnel only, and storage within the EU. Passwords are stored exclusively in hashed form (bcrypt). Although absolute security cannot be guaranteed, we take reasonable steps to protect data against unauthorised access, loss or misuse.

11. Data breach notification

In the event of a personal data breach, we will notify the competent authorities and, where legally required, the affected users, without undue delay, in accordance with the obligations under the GDPR.

12. Your rights

In relation to your personal data you have the following rights:

• Right of access — to request insight into the data we process about you.
• Right to rectification — to request correction of inaccurate or incomplete data.
• Right to erasure — to request deletion of your data, in accordance with section 9 of this policy.
• Right to restriction of processing.
• Right to data portability.
• Right to object to processing based on legitimate interest.
• Right to withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
• Right to lodge a complaint with the data-protection supervisory authority (see section 15).

To exercise these rights, contact us using the details provided in section 15.

13. Protection of minors

KLAI is not intended for persons under 18 years of age. We do not knowingly collect personal data of minors below that age. If we learn that we have collected personal data of a minor without the appropriate consent of a parent/guardian, we will take steps to delete such data.

14. Changes to this privacy policy

We may update this privacy policy from time to time to reflect changes in our service, technology or legal requirements. We will notify users of any significant change by posting on the website, with the date of the last update indicated at the top of the document. We recommend reviewing this page periodically.

15. Contact and supervisory authority

For questions regarding the processing of your personal data or to exercise the rights from section 12, you can contact us at: support@klai.design.

You also have the right to lodge a complaint with the data-protection supervisory authority:

16. Governing law

This privacy policy and the processing of personal data described in it are governed by the law of the Republic of Croatia and the European Union, including the General Data Protection Regulation (GDPR).