Legal
Privacy Policy
Who We Are
Maquete is based in England and Wales. We operate the Maquete.ai platform, an AI-powered architectural rendering service. We are the data controller for personal data collected through the Service. You can reach us at contact@maquete.ai.
What Data We Collect
We collect the following categories of personal data: Account data — your name and email address provided at registration, or obtained via Google OAuth when you choose to sign in with Google. Usage data — information about how you interact with the Service, including pages visited, features used, and render activity. Technical data — your IP address, browser type, device information, and cookies. We do not collect payment card details directly — these are handled by our payment processor.
How We Use Your Data
We use your personal data to: provide and operate the Service; authenticate your identity and manage your account; communicate with you about your account, updates, and support; improve and develop the Service through anonymised usage analytics; comply with our legal obligations. We do not sell your personal data to third parties. We do not use your uploaded design files or renders to train AI models without your explicit consent.
Your Uploaded Content
Design files, reference images, prompts, project information, renders and videos you submit are stored so we can provide render history, projects, sharing and related features. They may be sent to the AI provider selected for the relevant feature, including Google Gemini, OpenAI or fal.ai. We do not use Your Content to train our own models and do not authorise providers to train on it where provider controls allow. You can export your data and delete your account in Settings. Account deletion removes stored customer content and files; individual render deletion is not currently available.
Legal Basis for Processing
Under UK GDPR, we process your personal data on the following legal bases: Contract — processing necessary to provide you with the Service you have signed up for. Legitimate interests — processing for service improvement and security, where this does not override your rights. Legal obligation — processing required to comply with applicable laws. Consent — where we ask for your agreement before processing, such as for optional communications.
Cookies
We use strictly necessary cookies and local storage for authentication, security and your saved privacy choice. When you are signed in, we also save that privacy choice to your account so it follows you across devices. Google Analytics and Sentry Session Replay run only after you accept analytics. You can accept or reject with equal prominence and change your choice at any time through “Privacy settings” in the public-site footer or Studio account settings. Sentry core error reporting may operate without analytics consent under our legitimate interests, with default personal-data collection disabled.
Third-Party Services
We use service providers to operate Maquete.ai: Google (OAuth, Gemini and, with consent, Analytics); OpenAI and fal.ai for AI processing; Stripe for subscriptions and credit packs; Cloudflare R2 for file storage; Sentry for error monitoring and, with consent, masked session replay; Resend for email; Upstash for rate limiting; Vercel for the website; and Railway and our hosted PostgreSQL services for the API and database. These providers process only the data needed for their role. International transfers use applicable safeguards such as adequacy regulations or contractual clauses.
Data Retention
We retain account and stored content while your account is active so the Service and render history work. When you use self-service deletion, we revoke login access and delete stored project content and files as part of that process. We retain only records required for tax, accounting, fraud prevention, dispute handling or legal claims for the applicable statutory period. Historical payment and provider-cost entries are pseudonymised and kept only for financial reporting. Some retained records, such as Stripe transaction references, may remain linkable where required for accounting, disputes or legal compliance, with access restricted to authorised administrators. Backups and provider caches may take a limited additional period to expire.
Your Rights
Under UK GDPR, you have the right to: access the personal data we hold about you; correct inaccurate data; request erasure of your data ("right to be forgotten"); restrict or object to processing; receive your data in a portable format; withdraw consent at any time where processing is based on consent. To exercise any of these rights, contact us at contact@maquete.ai. We will respond within one month. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
Security
We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include encrypted data transmission, access controls, and regular security reviews. However, no method of transmission over the internet is completely secure and we cannot guarantee absolute security.
Children
The Service is not directed at children under the age of 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or via a notice within the Service before they take effect. The date of the most recent revision appears at the top of this page.
Contact & Complaints
If you have any questions, requests, or concerns about this Privacy Policy or how we handle your data, please contact us at contact@maquete.ai. If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk or 0303 123 1113.