Privacy Policy

Last Updated: December 2024

Magic Room (“we,” “us,” “our,” or “Company”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services.

1. Information We Collect

1.1 Information You Provide

• Email address (via Clerk authentication)
• Account preferences and settings
• Payment information (processed securely through Stripe)
• Room design preferences (room type, theme, custom prompts)

1.2 Information Automatically Collected

• IP address and browser type
• Usage analytics (via Vercel Analytics)
• Device information and cookies
• Referrer and landing page information

2. How We Use Your Information

• To provide and maintain our services
• To process your payments and manage credits
• To authenticate your account via Clerk
• To generate design variations using Google Gemini AI via OpenRouter
• To improve our service quality and user experience
• To comply with legal obligations
• To send account notifications and support communications

3. Privacy-First Image Processing

Your images are processed ephemerally and never permanently stored:

• Upload Storage: Images stored in Supabase Storage are automatically deleted after 2 hours
• Processing: Images are sent directly to OpenRouter/Gemini AI for processing (in-memory only)
• Results: Generated designs are returned as base64 data (temporary, session-based)
• No Backup: We do not maintain backups of your uploaded images
• No Training: Your images are not used to train AI models

4. Third-Party Services

We share minimal data with trusted service providers:

4.1 Clerk (Authentication)

We use Clerk for secure authentication. Clerk receives your email and authentication details. See Clerk's Privacy Policy

4.2 Supabase (Database & Storage)

Your account data and temporarily uploaded images are stored in Supabase. See Supabase's Privacy Policy

4.3 OpenRouter & Google (AI Processing)

Your room images are sent to OpenRouter, which routes them to Google's Gemini AI for processing. Images are processed in-memory and not stored. See OpenRouter's Privacy Policy and Google's Privacy Policy

4.4 Stripe (Payments)

Payment information is processed securely through Stripe. We never see your card details. See Stripe's Privacy Policy

4.5 Upstash (Rate Limiting)

We use Upstash Redis for rate limiting. Only request metadata is stored temporarily. See Upstash's Privacy Policy

5. Data Security

• All data transmitted over encrypted HTTPS connections
• Supabase handles encryption at rest for stored data
• API keys and secrets are securely stored and never exposed
• We follow industry-standard security practices
• Images are automatically deleted to minimize security risk

6. Your Rights

You have the right to:

• Access your personal data
• Request corrections to inaccurate data
• Delete your account and associated data
• Export your data in machine-readable format
• Opt-out of optional communications

To exercise these rights, contact us at kazakis.th@gmail.com

7. GDPR Compliance

For users in the EU, we comply with GDPR requirements. We process personal data only with your consent and provide transparent information about data handling. You have the right to withdraw consent at any time.

8. Cookies

We use cookies to maintain your session and improve your experience. You can control cookie settings in your browser. Essential cookies cannot be disabled as they are necessary for the service to function.

9. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes via email or a prominent notice on our site. Your continued use of the service constitutes acceptance of changes.

10. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us at: