Privacy Policy

interioo.pl / interioo.co

Last updated: October 2026 · Version 1.4

Changes in version 1.4 (October 2026): when an account is created we record its source, meaning the campaign or website that brought you to us (sections 2.3, 3.2 and 4); we added the interioo_attr cookie (section 8.2) and describe the "account created" event sent to Google Analytics (section 8.3).

This Privacy Policy is available in Polish as required by Polish law.

This Privacy Policy describes the principles of personal data processing by Interioo - a project management platform dedicated to interior designers and architects. This document was prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and the Polish Personal Data Protection Act.

By using our platform, you entrust us with your data. We take this trust seriously and are committed to transparency regarding how we collect, use, and protect your information.

§1. Data Controller

The controller of your personal data is:

For matters related to personal data protection, you can contact us at: [email protected] or by sending a message through the contact form available on the website.

§2. Scope of Collected Data

2.1 Account User Data (Designers / Architects)

During registration and use of the platform we collect the following data:

• Identification data: first and last name, company/studio name
• Contact data: email address, phone number (optional)
• Login data: email address, password (stored in encrypted form)
• Profile data: profile picture (optional), business description
• Billing data: invoice details (VAT number, registered address) - required for paid plans
• Activity data: system logs, login history, IP addresses

2.2 End Client Data (Designers' Clients)

Designers may enter their clients' data into the platform. As a processor, Interioo processes this data on behalf of the designer (Data Processor). This data may include:

• Client's first and last name
• Email address and phone number
• Address of the property covered by the project
• Project files and documents
• Design preferences and requirements collected via forms
• Correspondence within the client portal

2.3 Automatically Collected Data

When using the platform we automatically collect:

• IP address
• Browser and operating system information (User Agent)
• Session data: visit time, pages visited, traffic source
• Technical data: screen resolution, time zone
• Cookies (details in §8)
• Sign-up source: when you create an account we record how you found Interioo - campaign parameters (UTM), the referring website's domain, the landing page and the date of that visit - as well as the sign-up method (email or Google) and where it happened (website, app or browser extension). We do not record full addresses of the pages you visited or your browsing history.

2.4 Interioo Web Clipper Browser Extension

Interioo offers an optional browser extension (Interioo Web Clipper) for saving products from online stores. When you install and use it, the extension processes data in three ways, each strictly to provide the service you request:

Sign-in data. To use the extension you sign in to your Interioo account (via an email code or password). Your credentials are sent to our API only to authenticate you and maintain your session, which is handled with secure httpOnly cookies. Legal basis: performance of the service contract (Art. 6(1)(b) GDPR).

Product data (page content). To save products, the extension reads product details from the pages you browse - name, price, brand, description, dimensions, SKU, image and URL. While the clipper panel is open and you have selected a section, it does this automatically for each product page you open, so the item is ready to add to your estimate; it captures product details only, not your browsing history. To suggest the right category, the scraped details may be sent to Interioo automatically. The product is added to and stored in your cost estimate only when you choose to save it. Legal basis: performance of the service you request (Art. 6(1)(b) GDPR).

To secure sign-in and manage active sessions, when calling our API the extension sends a set of technical characteristics of your device and browser in the request header:

• Device platform/operating system (platform)
• Screen resolution (screenResolution)
• Color depth (colorDepth)
• Timezone offset (timezoneOffset)
• Browser language (language)
• WebGL support (webglSupport)
• Touchscreen support (touchSupport)
• Whether cookies are enabled (cookieEnabled)

From these characteristics we create a technical device identifier (fingerprint) that is bound to your session on the server. We use it solely to secure sign-in and to manage active sessions - this lets you identify and revoke (sign out) individual sessions or devices, and lets us detect session hijacking and unauthorized access. The legal basis is our legitimate interest in ensuring security (Art. 6(1)(f) GDPR). We do not use this data for advertising, cross-site tracking, or marketing profiling, and we do not share it with third parties for such purposes. Collection happens only while you use the extension - you can stop it by uninstalling the extension.

§3. Legal Bases and Purposes of Processing

3.1 Contract Performance (Art. 6(1)(b) GDPR)

We process your data for the purpose of:

• Providing the Interioo platform services in accordance with the terms of service
• Creating and managing user accounts
• Processing payments and invoicing
• Providing access to the client portal
• Providing technical support

3.2 Legitimate Interest (Art. 6(1)(f) GDPR)

We process data on the basis of legitimate interest for the purpose of:

• Ensuring platform security and detecting abuse
• Analysing service usage to improve it
• Direct marketing to existing customers
• Pursuing and defending claims
• Presenting the User's business name and logo as a commercial reference, on the terms set out in section 11.5 of the Terms - with the right to object at any time (Art. 21 GDPR)
• Measuring the effectiveness of our marketing, i.e. which campaign or website new accounts come from (sign-up source, section 2.3)

3.3 Consent (Art. 6(1)(a) GDPR)

Based on your consent we process data for the purpose of:

• Sending newsletters and marketing communications
• Using optional analytical and marketing cookies (Google Analytics)
• Profiling for the purpose of personalising our offer

You may withdraw your consent at any time without affecting the lawfulness of processing before its withdrawal.

3.4 Legal Obligation (Art. 6(1)(c) GDPR)

We also process data to fulfil legal obligations, in particular:

• Keeping and storing accounting and tax documentation for the period required by law (5 years)
• Responding to requests from public authorities
• Fulfilling data subject rights

§4. Data Retention Period

We store personal data for the period necessary to fulfil the purposes for which it was collected:

§5. Data Recipients

5.1 Processors

To provide our services we may transfer data to the following categories of entities:

• Cloud infrastructure providers: Supabase (databases), Cloudflare (hosting, CDN, Workers)
• Payment service providers: Stripe or another certified payment operator
• Email service providers: sending transactional notifications
• Analytics providers: Google LLC (Google Analytics) - details in §8
• Technical support and hosting providers

All processors operate under data processing agreements and ensure an adequate level of protection.

5.2 Data Transfers Outside the EEA

Some of our providers (including Google LLC, Cloudflare) are based in the United States. Data transfers to these entities are carried out on the basis of:

• Standard Contractual Clauses (SCC) adopted by the European Commission
• Adequacy decisions - for countries recognised as providing an adequate level of protection

You have the right to obtain a copy of the safeguards applied - contact us at [email protected].

5.3 Disclosure Under Legal Requirements

We may disclose data to public authorities (Police, prosecution, courts, DPA) only in cases required by law or on the basis of a final court order.

§6. Data Subject Rights

Under the GDPR you have the following rights:

6.1 Right of Access (Art. 15 GDPR)

You have the right to obtain from us confirmation as to whether we process your data and, if so, access to it and information about the purposes, categories, recipients and retention period.

6.2 Right to Rectification (Art. 16 GDPR)

You have the right to demand immediate rectification of inaccurate personal data or completion of incomplete data.

6.3 Right to Erasure - "right to be forgotten" (Art. 17 GDPR)

You have the right to demand deletion of your data when: the data is no longer necessary; you have withdrawn consent; you have objected; the data was processed unlawfully. This right does not apply when processing is required by law (e.g. tax obligation).

6.4 Right to Restriction of Processing (Art. 18 GDPR)

You have the right to demand restriction of processing in cases of challenging data accuracy, unlawful processing, need to pursue claims, or objection.

6.5 Right to Data Portability (Art. 20 GDPR)

You have the right to receive your data in a structured, commonly used format (JSON/CSV) and transmit it to another controller - where processing is based on consent or a contract.

6.6 Right to Object (Art. 21 GDPR)

You have the right to object to processing based on legitimate interest, including profiling. An objection to direct marketing is absolute and requires no justification.

6.7 Right Not to Be Subject to Automated Decision-Making (Art. 22 GDPR)

You have the right not to be subject to decisions based solely on automated processing, including profiling, where they produce legal effects or similarly significantly affect you.

6.8 How to Exercise Your Rights

To exercise the above rights, send a request to [email protected] with the subject "GDPR Request". We will respond within 30 days of receiving the request. In justified cases, the deadline may be extended by a further 60 days.

6.9 Right to Lodge a Complaint

If you believe we are processing your data unlawfully, you have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO):

§7. Data Security

We apply appropriate technical and organisational measures to protect data against unauthorised access, loss or destruction:

• Data encryption in transit (TLS 1.2/1.3 protocol)
• Password encryption using bcrypt/Argon2 algorithms
• Role-based access control (RBAC) - only authorised employees have access to data
• Regular security audits and software updates
• Cloudflare hosting environment with DDoS protection
• Regular data backups across multiple locations
• System monitoring and security incident notifications

In the event of a personal data breach that may cause a risk to the rights or freedoms of individuals, we will notify the DPA within 72 hours, and the affected individuals without undue delay.

§8. Cookie Policy and Analytics

8.1 What Are Cookies?

Cookies are small text files stored on your device by the browser. We use them to ensure proper functioning of the platform, to remember your preferences, and to analyse traffic.

8.2 Types of Cookies Used

Essential Cookies (always active - no consent required)

Analytical Cookies (require consent)

Functional Cookies (require consent)

8.3 Google Analytics

We use Google Analytics 4 (GA4), a traffic analysis service provided by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).

Google Analytics collects information about the use of our platform, including:

• Number of visits and sessions
• Time spent on the page and individual sections
• Traffic sources (how you found our website)
• Browser, operating system and device type used
• Approximate geographic location (at country/region level)

Important information about Google Analytics:

• We have enabled IP anonymisation (IP Masking) - Google does not see the full IP address
• We have disabled sharing data with Google for advertising purposes
• Data is stored by Google for a maximum of 26 months
• Google processes data as our Data Processor under a DPA agreement
• If you have consented to analytics cookies, when you create an account our server sends Google Analytics an "account created" event (sign-up method and where it happened), linked to the identifier in the _ga cookie. We do not send your email address, name or account identifier.

Google Analytics is activated only after you have given your consent via the cookie banner. You can withdraw your consent at any time by changing cookie settings in our consent management panel or by installing the Google Analytics Opt-out browser extension.

8.4 Microsoft Clarity

We use Microsoft Clarity, a user behaviour analytics service provided by Microsoft Corporation (One Microsoft Way, Redmond, WA 98052, USA).

Clarity records how you use our website, including:

• Session recordings: cursor movement, clicks, scrolling and navigation between pages
• Heatmaps showing which parts of a page draw attention
• Signals of usability problems, such as rage clicks or quick back-navigations
• Device, browser and operating system type, and approximate location

Important information about Microsoft Clarity:

• Text content is masked by default - recordings do not show what you type into forms
• We do not use Clarity to identify individuals, and we do not link recordings to your account
• Microsoft processes the data under the Clarity terms of service, and the MUID identifier is also used across other Microsoft sites
• Clarity data is retained for a maximum of 13 months

You can limit Clarity by changing your cookie settings in our consent management panel, by blocking cookies in your browser, or through the privacy settings of your Microsoft account.

8.5 How to Manage Cookies

You can control cookies in several ways:

• Interioo consent management panel - available in the website footer and in account settings
• Browser settings - you can block or delete cookies directly in your browser
• Private mode (incognito) - cookies are not saved after closing the window

Note: disabling essential cookies may prevent the use of some platform features.

§9. Data Processing Agreement - Designers' Client Data

Designers using Interioo act as the Data Controller of their clients' data. Interioo acts as the Data Processor within the meaning of Art. 4(8) GDPR.

This relationship is governed by a Data Processing Agreement (DPA), which is an integral part of the Interioo Terms of Service and includes, among other things:

• Scope and purpose of processing
• Categories of data and persons processed
• Security obligations
• Rules for the use of sub-processors
• Procedures for handling data subject requests
• Conditions for data deletion upon contract termination

Designers (Controllers) are responsible for ensuring the legal basis for processing their clients' data and informing them about the processing.

§10. Profiling

To a limited extent, we use automated data processing (profiling) for the purpose of:

• Tailoring notifications and alerts to your preferences
• Analysing platform usage patterns to improve UX
• Suggesting features that may be useful in your work

This profiling has no legal effects on you and does not significantly affect your rights. Data is anonymised or pseudonymised. You have the right to object to profiling at any time.

§11. Children

The Interioo platform is intended exclusively for users who are at least 18 years old. We do not knowingly collect personal data from persons under 18. If you learn that a child has provided us with data without parental or guardian consent, please contact us immediately - we will delete the data.

§12. Privacy Policy Changes

This Privacy Policy may be updated in connection with changes in law, technology, or the scope of our services. We will notify you of significant changes:

• By email to the address associated with your account
• Via an in-app notification
• By updating the "last updated" date at the top of this document

Continued use of the platform after the changes take effect constitutes acceptance of the new version of the Policy. In the case of changes requiring renewed consent, we will display an appropriate notice.

§13. Final Provisions

This Privacy Policy is governed by Polish and EU law, in particular:

• GDPR Regulation (EU) 2016/679
• Act of 10 May 2018 on the Protection of Personal Data (Journal of Laws 2018, item 1000)
• Act of 16 July 2004 - Telecommunications Law
• Act of 18 July 2002 on the provision of electronic services

Matters not governed by this Policy shall be subject to the universally applicable provisions of Polish and EU law.

Contact

All questions, requests or complaints regarding the processing of personal data should be directed to:

We will do our best to respond to your query within 72 hours on business days.