Privacy Policy

• Authenticating your identity and maintaining your session.
• Processing uploaded photos through Google Gemini AI to generate design visualizations.
• Storing your design history and generated outputs in your account.
• Managing your credit balance, tracking deductions, and processing purchases.
• Delivering subscription benefits, processing renewals, and managing cancellations.
• Providing AI-estimated renovation costs.

• Sending transactional emails: account confirmation, password reset, payment receipts, subscription renewal notices.
• Notifying you of material changes to our Terms or Privacy Policy.
• Responding to support requests and feedback.
• Sending promotional emails about new features and offers (with your consent; you can opt out at any time).

• Analyzing usage patterns to identify popular features and improve UX.
• Monitoring conversion funnels to optimize the onboarding and design flow.
• Debugging errors and performance issues.
• Conducting A/B testing of new features and UI changes.

• Detecting and preventing fraud, abuse, and unauthorized access.
• Enforcing our Terms of Service and usage policies.
• Complying with legal obligations, regulatory requirements, and lawful requests from authorities.

If you are in the EEA or UK, we process your data on the following legal bases:

• Contract: Processing necessary to provide the Service you've requested (design generation, account management, payment processing).
• Legitimate Interests: Analytics, security, fraud prevention, and product improvement — balanced against your rights.
• Consent: Marketing emails and non-essential cookies. You may withdraw consent at any time.
• Legal Obligation: Compliance with laws (e.g., tax, anti-fraud regulations).

We share data with trusted third-party vendors who process data on our behalf under strict data processing agreements:

• Google (Gemini API): Your uploaded photos are transmitted to Google's Gemini API for AI processing. Google processes these images according to their API Terms and Data Processing Agreement. Images are not used to train Google's public AI models under the API terms.
• Supabase: Authentication, database storage (profiles, design history, credits), and edge function hosting.
• Stripe: Payment processing, subscription management, and fraud prevention. Stripe is a certified PCI-DSS Level 1 service provider.
• Vercel: Frontend hosting and analytics.
• PostHog: Product analytics. Records which pages you visit and which features you use, and replays of how the site was used, with everything you type and your photos and designs hidden. Linked to your account once you sign up.
• Google Tag Manager / Analytics: Aggregated website analytics and behavior tracking.
• Meta (Meta Pixel): Measures visits, sign-ups, checkouts and purchases that come from our ads on Facebook and Instagram, and helps us show those ads to people likely to find Kasaro useful. Meta receives your browser and device details, the pages you visit, and these events with the purchase amount. Your photos and designs are never sent to Meta.

We may disclose your information if required to do so by law or in good faith belief that such disclosure is necessary to:

• Comply with a legal obligation, court order, or government request.
• Protect the rights, property, or safety of Kasaro AI, its users, or the public.
• Investigate and prevent fraud or security incidents.

In the event of a merger, acquisition, asset sale, or bankruptcy proceeding, your data may be transferred to the successor entity. We will notify you via email and/or a prominent notice on our website at least 30 days before your data becomes subject to a different privacy policy.

We may share data with third parties when you have explicitly given consent (e.g., connecting third-party integrations from your account settings).

You can control cookies through your browser settings. Disabling strictly necessary cookies will prevent the Service from functioning correctly. You may also opt out of analytics cookies by using browser extensions such as the Google Analytics Opt-out Add-on.

For users in the EEA/UK, we present a cookie consent banner. Non-essential cookies are only placed after you provide consent, and you can change your choice at any time with the Cookie settings link at the bottom of every page.

Our Service does not currently respond to browser "Do Not Track" signals, as there is no established standard for how sites should respond. We will update this policy if a standard is adopted.

You have the right to request a copy of the personal data we hold about you, including your account information, design history, and usage records.

You may update your account information (name, email) directly from your account Settings page. For other data corrections, contact us.

You may request deletion of your account and associated personal data. Submit a deletion request from your account Settings page or email us. We will complete the deletion within 30 days, except where we are required to retain data by law (e.g., financial records).

You may request an export of your personal data in a machine-readable format. Contact us to initiate a data export.

You may object to or request restriction of processing of your personal data, particularly for marketing purposes or where processing is based on legitimate interests.

You can unsubscribe from promotional emails at any time by clicking the "Unsubscribe" link in any marketing email or by contacting us. Transactional emails (receipts, security alerts) cannot be opted out of while your account is active.

Where processing is based on consent (e.g., marketing emails, non-essential cookies), you may withdraw consent at any time without affecting the lawfulness of prior processing.

We will respond to privacy rights requests within 30 days (or the timeframe required by applicable law). In complex cases, we may extend this by an additional 30 days with notice. We do not charge a fee for reasonable requests.

In the past 12 months, we have collected the following categories of personal information (as defined by the CCPA): identifiers (name, email, IP address); commercial information (purchase history, subscription status); internet activity (browsing behavior, feature usage); visual information (photos you upload); and inferences drawn from the above.

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to Delete: Request deletion of personal information we hold about you.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt Out of Sale/Sharing: We do not sell or share personal information for cross-context behavioral advertising. No opt-out is required.
• Right to Limit Use of Sensitive Personal Information: We do not use or disclose sensitive personal information for purposes beyond those permitted by CPRA.
• Right of Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

Submit CCPA requests by emailing privacy@kasaro.ai with "CCPA Request" in the subject line. We will verify your identity before fulfilling requests and respond within 45 days.

Kasaro AI acts as the data controller for personal data processed through the Service. Contact our data controller at: privacy@kasaro.ai.

In addition to the rights listed in Section 10, EEA/UK residents have the right to:

• Lodge a complaint with your local supervisory authority (e.g., ICO in the UK, CNIL in France, BfDI in Germany).
• Not be subject to solely automated decision-making that produces significant legal or similarly significant effects on you.

See Section 3 (How We Use Your Data) for a full description of our legal bases under GDPR.

If you believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with a data protection authority. For UK residents, the relevant authority is the Information Commissioner's Office (ICO).