Privacy Policy
Last updated: 23 August 2026
The data controller for walldecor.io is EHRESTE VENTURES SRL, a company registered in Romania. For anything in this policy, email contact@walldecor.io.
The short version
- We do not sell your data, and we do not run advertising or cross-site tracking.
- We do not train AI models on your images and we never submit them for training. The providers who process them receive your photo only to produce your result. We will name them and share their terms on request.
- The free Wall Art Visualizer runs in your browser. Your artwork and wall photo are not uploaded to us at all unless you are signed in and save a design.
- You can have your account and images deleted by emailing contact@walldecor.io.
1. What we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Email address | Sign-in by magic link, receipts, service notices, support replies | Performance of the contract |
| Room photos and artwork you upload | To generate and display your designs | Performance of the contract |
| Generated images and the prompts behind them | So your results are there when you come back, and so we can debug failures | Performance of the contract; legitimate interest |
| Credit balance and transaction history | Running the credit system, accounting | Contract; legal obligation (tax records) |
| Payment details | Handled entirely by our payment provider. We receive the amount, currency, country, and last four digits, never the full card number | Contract; legal obligation |
| Marketing email list | Product news and tips, if you gave us your email for that | Consent, withdrawable at any time |
| Bounce and spam-complaint events from our email provider | To stop emailing addresses that reject us. We do not track email opens or clicks | Legitimate interest in deliverability |
| Usage analytics (page views, conversions) | Understanding which pages work | Legitimate interest |
| Support messages, bug reports, feature requests | Answering you and fixing things | Legitimate interest |
We ask for no more than the above. There is no name field, no address field, and no profile beyond your email and your credit balance.
Two collection points are worth naming plainly. If you buy without an account, we create one for the email address you paid with, so your credits have somewhere to live. That is how you get access, not a marketing sign-up. And if you download a design from the free Wall Art Visualizer, we ask for an email address and send a one-time code to it; that address is used for the download, and for product email only if you ticked the box, which you can undo from any email we send.
2. How your images are stored
Images you upload to the AI workspace are held in private storage. Nothing in it is publicly readable. When your browser asks for one, the request goes through our own server, which checks that you are signed in and that the image is yours before it returns anything. A link on its own gets nobody in.
The AI provider is the exception, because it has to fetch your photo to process it. It is given a signed link that expires shortly after your generation completes: long enough for the job, useless afterwards.
Even so, please keep genuinely sensitive material out of the service. That means identity documents, financial or health information, confidential business material, and photographs of other people’s homes that they would not want seen. Section 11 of our Terms and Conditions says the same thing and explains where responsibility sits if you upload it anyway.
The free Wall Art Visualizer does not have this exposure, because it does not upload anything. It composites in your browser, and it keeps your working session in your browser’s local storage on your own device. Clearing your site data removes it.
3. Who we share it with
We use a small number of specialist providers to run the service. Each one gets the minimum it needs to do its job, and none of them is permitted to use your data for its own purposes.
| Category of provider | What it handles | Where |
|---|---|---|
| Hosting, database, and file storage | Running the site, your account, and your saved images | EU / US |
| AI processing | Generating your designs, and analysing your photo to build the prompt behind them. Receives the room photo and the prompt. We submit nothing for training | US |
| Payments | Card processing, receipts, tax. We never see your card number | EU / US |
| Email delivery | Sign-in links, receipts, and marketing email | EU / US |
| Site analytics | Page views and conversions. Never receives your images | EU |
The GDPR lets us describe recipients by category, which is what the table does, but we are happy to be specific: email contact@walldecor.io and we will send you the current list of named providers and their data processing terms.
Where a provider processes data outside the EEA, the transfer relies on the European Commission’s Standard Contractual Clauses in that provider’s data processing agreement.
We will also disclose data if a law, court, or regulator requires it, or to establish or defend a legal claim. If the business is ever sold, the data transfers with it under this same policy.
We never sell your data or share it with data brokers.
4. How long we keep it
- Account, images, and generations: until you ask us to delete them, or after two years of complete inactivity.
- Payment and invoice records: as long as tax law requires, currently ten years in Romania. We cannot delete these on request.
- Marketing list: until you unsubscribe. We keep a record of the unsubscribe itself so we do not re-add you.
- Visualizer download addresses: kept while the download code is valid, then only if you opted into product email, until you unsubscribe.
- Support messages: up to two years.
- Server logs: retained by our hosting provider for a short rolling period.
5. Your rights
Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, port it elsewhere, or object to processing we base on legitimate interest. You can withdraw consent to marketing at any time. Every marketing email has a one-click unsubscribe link, and it takes effect immediately.
Email contact@walldecor.io and we will act within one month, which we may extend by a further two months for a genuinely complex request, telling you why within that first month. There is no charge. Deletion removes your account, your uploads, and your generated images; it does not remove invoices we are legally required to keep.
We take no decisions about you by automated means that produce a legal or similarly significant effect, so the Article 22 right does not arise. Generating an image is not a decision about you.
If you are unhappy with how we handled it, you can complain to your national data protection authority. Ours is the ANSPDCP (Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal), dataprotection.ro.
6. Cookies and local storage
We use a small number of first-party items, and no ad trackers:
- Authentication cookies: strictly necessary. Without them you cannot stay signed in.
- Payment cookies: set by our payment provider during checkout, for fraud prevention.
- Analytics: measures page views and conversions. Not used for advertising, and does not follow you to other sites.
- Local storage: keeps your visualizer session, your last selected image, and recent prompts on your own device. This never reaches our servers.
Strictly necessary items are set without asking, because the service cannot work without them. Anything that is not strictly necessary is set only with your consent, and you can withdraw that at any time by clearing your site data or emailing contact@walldecor.io.
7. Security
Traffic is encrypted in transit. Database access is restricted by row-level security so one account cannot read another’s rows. Image storage is private and served only through an authenticated request, as section 2 describes. Sign-in uses one-time links and codes rather than passwords, so there is no password of yours for us to lose.
8. Children
walldecor.io is not for anyone under 16. We do not knowingly collect their data. If you believe a child has given us data, email contact@walldecor.io and we will delete it.
9. Changes
If we change this policy materially we will update the date at the top and email account holders. Continuing to use the service means the new version applies.
10. Contact
EHRESTE VENTURES SRL, Romania
contact@walldecor.io
See also our Terms and Conditions and our Refund Policy.