Privacy Policy

Account information. Email, name, authentication provider, plan and billing status, account identifiers, consent records, and support communications.

Project information. Room or property photographs, floor plans, measurements, prompts, preferences, reference images, budgets, material choices, generated concepts, walkthroughs, edits, exports, share settings, and project names.

Technical information. Authentication cookies, browser and device information, IP address, timestamps, request and error logs, security signals, rate-limit records, and privacy-focused page analytics.

Payment information. Stripe processes payment details. Colzera receives customer, transaction, subscription, invoice, receipt, refund, and limited billing metadata, not complete card numbers.

Interior images can reveal location clues, possessions, security features, family information, people, documents, or accessibility needs. Remove people, valuables, private documents, mail, access codes, alarm details, and information not needed for the project before uploading.

Do not submit government identifiers, complete financial account numbers, medical records, biometric identifiers, illegal content, or another person's confidential information without authority. You control what project information you provide.

We use information to authenticate users; understand room requirements; generate design concepts, budget estimates, edits, exports, and interactive walkthroughs; preserve and recover rendering jobs; provide share links; manage credits, subscriptions, and payments; provide support; maintain security; prevent misuse; diagnose failures; improve performance; communicate about accounts; and comply with law.

Colzera does not sell personal information or use it for cross-context behavioral advertising. We do not use private project content to train third-party foundation models unless we clearly disclose that use and obtain any consent required by law.

Where applicable law requires a legal basis, we process information to perform our agreement, pursue legitimate interests such as operating and securing Colzera, comply with law, and, where required, based on consent.

Relevant project text and media may be sent to configured AI, image, 3D, storage, or rendering providers to create the requested project. Processing may infer room geometry, objects, design preferences, or material directions from uploads.

Providers process information under their own contractual and privacy commitments. We use available provider controls to limit retention and training use where appropriate. Avoid uploading information that is not needed for the design.

Colzera uses Supabase for authentication and private database records; Stripe for payments; Vercel for hosting and privacy-focused analytics; Resend for transactional and support email; and approved storage, AI, or rendering providers. Authentication sessions use secure cookies and database records use row-level access controls.

Project media and generated assets may be stored with a cloud storage or rendering provider. Anyone with an active public share link may be able to view the associated walkthrough. You are responsible for choosing what to share. You can request that support disable a link when self-service controls are unavailable.

No storage or transmission method is completely secure. We use reasonable administrative, technical, and organizational safeguards, monitor misuse, limit server credentials to server environments, and keep an auditable credit and billing ledger.

We disclose information to service providers only as reasonably needed to operate Colzera; at your direction; to investigate abuse or protect users, the public, rights, or the Service; to comply with lawful requests; or in a financing, merger, acquisition, reorganization, or asset transfer subject to appropriate protections.

Vercel Web Analytics provides aggregated usage information without third-party advertising cookies. Colzera removes query strings before analytics transmission so authentication codes, checkout identifiers, and project parameters are not included in page-view analytics.

We generally retain account and project information while your account is active. After a verified deletion request, eligible account and project information is deleted or de-identified within 30 days; encrypted backups may take up to 90 additional days to cycle out.

We generally retain security and diagnostic logs up to 12 months, support correspondence up to 3 years, and billing, tax, consent, credit-ledger, and transaction records up to 7 years. We may retain information longer for fraud prevention, disputes, legal holds, or other legal obligations.

You can manage projects, sharing, billing, authentication, and account access from Colzera and can request that we access, correct, export, restrict, object to processing of, or delete eligible information. We verify identity before acting and explain any legally permitted denial or appeal route.

Submit a request using the support form. We do not discriminate against people who exercise privacy rights. Authorized agents may submit requests where local law permits and authority is verified.

Colzera and providers may process information in the United States and other countries with different privacy laws. Where required, we use approved transfer safeguards. Colzera is for people at least 18 years old and does not knowingly permit child accounts.

We may update this Policy. Material changes receive reasonable notice through the Service, by email, or as required by law.

The data controller is Colzera, based in Maryland, United States. Contact support@colzera.com or use the support page.