Privacy Policy

Boldnest is an AI-powered interior-design tool. The data controller is:

• Boldnest
• Kifisia, 14561, Athens, Greece

For any question about how we handle your data, email privacy@boldnestai.com. We aim to respond within 30 days as required by GDPR.

When you join the waitlist: your email address, your marketing-opt-in choice (defaulted OFF), and a timestamp. Stored on our Neon database in the Waitlist table.

When you visit and submit the waitlist form: your IP address is briefly visible to our anti-abuse rate limiter to block automated spam, held only in server memory for up to 60 seconds and never written to the database. A hidden form field ("honeypot") helps distinguish bots from humans — it is not intended to capture data, and any content in it is discarded.

When you create an account: your email address, a bcrypt hash of your password (we never see or store the plaintext), account timestamps, and — if you opt in — marketing consent flags. Stored in the User table.

When you generate a design (no photo): the brief you submit — room type, style, dimensions, budget, colour palette, material preferences, and any free-text you type. Also two derived flags: whether the result came in over budget, and whether you uploaded a photo. Stored in the DesignEvent table. If signed in, your user ID is linked to the row; anonymous designs are not linked to any personal identifier.

When you upload a room photo for the AI Redesign: the photo IS temporarily stored on our server to support the refinement feature (so you can ask for changes without re-uploading). It is stored in the Redesign table alongside the brief and the AI-generated redesign image. The uploaded photo, the generated image, and any related session data are automatically deleted within 24 hours of your last activity in that redesign session, by an automated daily cleanup job. If you explicitly save the design to your account, a copy of the generated redesign is retained in your SavedDesign record until you delete it or your account; your original uploaded photo is still deleted on the 24-hour schedule regardless.

When you save a design: the full design payload (recommended furniture, layout, prices, palette, and — if you produced one — the AI-generated redesign image), plus a display name you choose. Stored in the SavedDesign table, linked to your account.

When you save a design, we also keep a small preview (around 200 pixels wide) of your original room photo on that saved design so you can recognise it in your My Designs list. This preview is kept until you delete the saved design or your account.

Automatic logs: our hosting provider (Vercel) records short-term request logs (timestamps, HTTP paths, response codes, edge region). These are used for operational monitoring only and are retained per Vercel's retention policy.

Boldnest sets a small number of strictly-necessary cookies. None are used for analytics, advertising, or cross-site tracking. For the full list, see our Cookie Policy.

• Waitlist email + timestamp — pre-contractual step at your request (Article 6(1)(b)).
• Marketing opt-in — your explicit consent (Article 6(1)(a)). Separate from waitlist storage.
• Account data — necessary to perform the contract of providing your account (Article 6(1)(b)).
• Design generation (brief + photo) — necessary to fulfil your request (Article 6(1)(b)).
• Anti-abuse rate limiting + honeypot — legitimate interest in protecting the service from automated abuse (Article 6(1)(f)).
• Aggregate DesignEvent flags — legitimate interest in improving the product (Article 6(1)(f)). Not used to profile individual users.

When you join the waitlist or create an account, you can separately tick an optional checkbox to receive furniture and design offers from Boldnest's partner stores. This is:

• Optional and off by default. You must actively tick the box — there is no pre-consent.
• Separate from your core account. Turning it off (or never turning it on) has no effect on the app itself.
• Style-targeted. If you opt in, the design styles you've generated or saved (for example "scandinavian", "industrial") may be used to send you relevant offers. We store this list on your user record; it is not shared with partners in raw form — partners receive segments, not individual profiles.

Legal basis: your explicit consent (Article 6(1)(a)).

You can opt out at any time by clicking the unsubscribe link in any offer email (a signed one-click link — no login needed), or by emailing privacy@boldnestai.com. Opting out flips the marketing flag off and removes you from future segments.

We share your data with the following processors, only to the extent needed to run the service. All are in the United States; transfers rely on the European Commission's Standard Contractual Clauses (SCCs) incorporated into each provider's Data Processing Addendum.

• Vercel Inc. (USA) — hosting, serverless functions, and edge CDN. Sees all HTTP traffic and short-term logs.
• Neon Inc. (USA, AWS us-east-1) — managed Postgres database. Stores the tables described above.
• Anthropic PBC (USA) — the Claude API generates furniture recommendations and design summaries from your brief. When you upload a room photo, that photo is also sent to Anthropic for a quick pre-analysis that detects whether the room shows real windows, blank wall space, and existing seating; the resulting yes/no flags help the recommendation step avoid items that would render poorly in the redesign (for example, curtains for a windowless room or cushions with no sofa to place them on). Neither your email nor account details are sent, and Anthropic's API terms state that API inputs are not used to train their models. The photo's retention on our side is unchanged — see the retention section below for the 24-hour cleanup of source photos.
• Google LLC (USA) — the Gemini API generates photorealistic redesigns from your uploaded room photo, and performs object detection on the result. Your uploaded photo, the text brief, and shopping-list metadata are sent to Google during processing. Not your email or account details. Google's paid-tier API terms state that request data is not used to train their models.
• Resend Inc. (USA, Delaware) — sends transactional emails (waitlist confirmation, welcome recap). Receives only the recipient email address and the message content.
• GitHub Inc. (USA) — source-code hosting. No personal data flows to GitHub; source only.

Payments (not yet active). The app's data model contains fields for a future subscription tier (Stripe customer and subscription IDs), but Stripe is not currently connected and no payment data is collected or processed at this time. Before payments go live we will update this policy to name Stripe as an additional processor.

We do not sell your data or share it with advertising networks.

• Waitlist emails — until you ask us to delete them, or until we close the waitlist.
• Account records — until you delete your account.
• Saved designs — until you delete them or delete your account.
• Uploaded room photos and unsaved redesign sessions — automatically deleted within 24 hours of your last activity in that session by an automated cleanup job. This includes the source photo, the AI-generated redesign image, and any related session data in the Redesign table.
• Anonymous DesignEvent records (aggregate flags, no photo, no identifier) — kept for product analytics with no fixed retention window.
• Rate-limit IP state — held in server memory for 60 seconds; never persisted.

You have the right to: access a copy of your data; rectify inaccurate data; erase your account and everything linked to it; receive your data in a portable machine-readable format; object to processing based on legitimate interest; withdraw consent for marketing at any time; and lodge a complaint with the Hellenic Data Protection Authority (dpa.gr) or your local supervisory authority.

To exercise any of these, email privacy@boldnestai.com. We'll respond within 30 days.

If we discover a personal-data breach that poses a risk to your rights, we'll notify the Hellenic Data Protection Authority within 72 hours as required by Article 33 GDPR, and — if the risk is high — notify you directly at the email address on your record.

You must be at least 15 years old — the age of digital consent in Greece under Article 8 GDPR as implemented by Greek Law 4624/2019 — to use Boldnest. If we learn that a person under this age has provided data to us, we'll delete it promptly.

If we materially change how we handle your data, we'll update this page and the "Last updated" date at the top. Changes that require renewed consent, we'll ask for.

privacy@boldnestai.com