Privacy Policy
Last updated: July 2026
Your floor plans stay private.
We treat every uploaded floor plan as a client-confidential document. Your plans are never shared with third parties, never used to train AI models, and are deleted when you delete your account.
1. Data we collect
Isoma is operated by Dora Kreative, a business registered in Albania, which is the data controller for the personal data described in this notice. Contact: hello@isoma.app.
Account data (email, hashed password or OAuth identifier), billing metadata (plan, credits, payment status — payment card data is handled by our payment processor and never touches our servers), and content you upload (floor plans, prompts, generated renders).
2. How we use your data
We use it strictly to run the service: authenticate you, generate renders, deliver downloads, take payment, and provide support. We do not sell your data. We do not use your floor plans, prompts, or renders to train AI models — ours or anyone else's.
3. Processing partners
To deliver renders we send a copy of your plan and prompt to AI model providers (Google, OpenAI, Replicate) via their APIs, under their commercial terms which prohibit training on API inputs. Storage and database are provided by Supabase. Payments are handled by Paddle.com Market Limited, which acts as Merchant of Record for our orders — Paddle receives the personal data needed to sell the product to you, manage your subscription, take payment, calculate and remit tax, and issue invoices. Customers paying with an Albanian card are served by our local processor, PokPay. Transactional email is delivered by Resend. We also share data with professional advisers (legal and accounting) and with authorities where required by law. All processors are bound by data-protection agreements consistent with GDPR.
4. Retention and deletion
Uploaded plans and generated renders are retained while your account is active so you can access your project history. Delete an individual project at any time from the app. When you delete your account, we delete your projects, plans and renders within 30 days (retaining only what we are required to keep for tax and legal records — e.g. anonymized invoice references).
5. Security
Data is encrypted in transit (TLS) and at rest. Access to production data is limited to a small number of authorized engineers. We use row-level security to ensure users can only read their own projects and renders.
6. Your rights
You may request access, correction, export or deletion of your personal data at any time by emailing hello@isoma.app. EU users have the additional rights under the GDPR (right to object, right to restrict processing, right to lodge a complaint with a supervisory authority).
7. Cookies
We use only strictly-necessary cookies for authentication and session state. We do not use advertising cookies.
8. Contact
Questions or requests: hello@isoma.app.
See also our Terms of Service.