Privacy policy

This Privacy Policy describes how DSource.AI ("we", "us") collects, uses, shares, and protects personal data when you use dsource.ai and its related services (the "Platform"). We are the "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and the "data controller" under the EU/UK General Data Protection Regulation ("GDPR"), where applicable, for the data described here.

This Policy applies to all visitors, whether or not you create an account. Some features — including the AI analysis and image-generation tools and the contact form — can process your data even if you are not signed in.

For privacy questions, requests, or grievances, contact our Grievance Officer (Section 13) at hello@dsource.ai.

We collect only the data listed below. We do not collect your name at account signup, your phone number, precise location, or payment information (we currently process no payments).

a. Account data (you provide it).

• –Email address and password. Passwords are hashed and managed by our authentication provider (Supabase); we never store or see your plaintext password.
• –An account-type flag (user or vendor) stored with your account.

b. Contact form data (you provide it). First name, last name, email address, country, and your message, when you submit the Help Center contact form.

c. Images and prompts you submit to AI features (you provide them).

• –Photos you upload to the AI Material Finder or AI Visualizer — typically photos of room interiors. These may incidentally reveal personal information: the inside of a home, belongings, documents, or people in frame.
• –Image files may contain embedded metadata (EXIF), which can include the time the photo was taken, the device used, and GPS location. We do not currently strip this metadata before processing, so it may be transmitted to our AI provider along with the image. We recommend removing location metadata from photos before uploading.
• –The text prompts and design parameters (space type, room, style, lighting, color palette) you enter for AI generation.
• –AI outputs associated with your session, and — where render-history features are enabled — uploads and generated designs stored in private storage linked to your account.

d. Vendor catalog data (vendors provide it). Product listings, descriptions, image URLs, and CSV uploads submitted through the vendor portal. Each record is linked to the vendor's account identifier. Vendors should not include personal data in listings; any personal data embedded in listings remains covered by this Policy.

e. Technical data (collected automatically).

• –Authentication cookies (see Section 6) that keep you signed in.
• –Server and hosting logs generated when you use the Platform, which can include your IP address, browser user agent, request paths, and — for AI features — logged prompt text and AI analysis output.
• –Usage event records for AI features and platform activity, which may include your account identifier, IP address, user agent, model used, prompt text, generation parameters, token counts, and success/error status.
• –Engagement records from the inspiration feed, tied to your account identifier and a per-tab session identifier: which items were shown to you and in what position, which you viewed, dwelled on, clicked, saved, hid, or selected an object within, the searches you typed there, and the internal relevance score of an item at the moment it was shown.
• –Aggregate page-view measurement through Vercel Web Analytics, which records the page visited, referrer, country, and device or browser type. It is cookieless, sets no persistent identifier, and does not follow you to other websites.

What we do not collect: we run no advertising trackers, no tracking pixels, no marketing identifiers, and no cross-site or cross-context tracking of any kind. We do not fingerprint your device. The measurement described above is first-party and used only to operate and improve the Platform. We do not sell or share personal information for advertising, and we do not use your data for targeted advertising.

Local browser storage. The spec builder saves your working spec in your browser's localStorage so it survives a refresh. It stays on your device, is not an identifier, and is not transmitted to us as analytics; clearing your browser storage deletes it.

• –Creating and operating your account, signing you in, and gating vendor features — performance of our contract with you (GDPR) / your consent (DPDP Act).
• –Analyzing photos you upload and generating design visualizations — performed only when you affirmatively upload an image or submit a prompt; your action is your specific consent to that processing (DPDP Act) / contract and consent (GDPR).
• –Responding to contact-form inquiries — legitimate interest in responding to you / consent.
• –Hosting and displaying vendor product listings — performance of the vendor relationship.
• –Security, abuse prevention, debugging, and service integrity (including IP and user-agent logging) — legitimate interest / permitted uses under the DPDP Act.
• –Complying with law, legal process, and enforceable government requests — legal obligation.

We do not use your photos, prompts, or generated outputs to train our own AI models. If we ever propose to, we will ask for separate, specific, opt-in consent first, which you may refuse or withdraw without losing access to the Platform.

Which provider receives your submission depends on the feature and the model selected. Image analysis, material and object detection, content validation, and floor-plan extraction run on Google's Gemini models. Image generation runs on Gemini or on a model hosted by Replicate, Inc., which processes it under Replicate's privacy policy.

Specifically: your uploaded image (including any embedded metadata) and/or your text prompt are sent to those models to validate the content, detect materials and objects, or generate design imagery. Google processes this data under the Gemini API Terms of Service and its data-handling commitments, which include limited-duration logging of prompts and outputs for abuse monitoring and legal compliance. Google's handling of this data — including whether content may be used to improve Google's services on certain service tiers — is governed by Google's terms, not ours, and we encourage you to review them.

• –Do not include faces, identity documents, or other sensitive personal information in photos or prompts. Any such data is processed incidentally and at your initiative.
• –Only upload photos you own or have the right to use, with the permission of any identifiable person shown.
• –AI features are used solely to analyze images and generate visualizations. We make no decisions about you using automated processing that produce legal or similarly significant effects.

We share personal data only with the following recipients:

• –Supabase Inc. — database hosting, authentication, and file storage for account data, contact messages, vendor catalog records, usage events, and (where enabled) stored uploads and renders.
• –Google LLC — Gemini API processing of images and prompts you submit to AI features (Section 3).
• –Replicate, Inc. — hosted model inference for image generation and related AI features; images and prompts you submit are sent there when the selected model runs on Replicate.
• –Vercel Inc. — hosting provider; operates the servers that run the Platform, retains standard server logs, and provides the cookieless aggregate page-view measurement described in Section 1(e).
• –Third-party content hosts — some product images in listings are served from external retailer and CDN domains; when your browser loads or opens them, those hosts receive your IP address and user agent as part of the ordinary content request.
• –YouTube (Google) — the About page contains a click-to-load embedded video; if you play it, YouTube receives your IP address and may set its own cookies under Google's privacy policy.
• –Law enforcement or government authorities — where disclosure is required by applicable law or valid legal process; where legally permitted, we will tell you before disclosing.

We do not sell personal data, share it for cross-context behavioral advertising, or provide it to data brokers.

Our service providers process data on infrastructure that may be located outside your country, including outside India. Transfers of personal data outside India are made in accordance with the DPDP Act and any restrictions notified by the Central Government. For EEA/UK users, transfers to our processors rely on safeguards such as Standard Contractual Clauses included in those processors' data-processing agreements. Wherever your data is processed, it receives the protections described in this Policy.

We set only strictly necessary first-party cookies: Supabase authentication cookies (names beginning with sb-) that hold your session so you stay signed in. They are essential to providing the service and are not used for tracking or advertising. We set no advertising or marketing cookies, and our page-view measurement is deliberately cookieless (Section 1(e)). The only third-party cookies that can occur are set by YouTube if you choose to play the embedded video on our About page.

• –Account data: for the life of your account, then deleted within 30 days of a verified deletion request.
• –Contact-form messages: up to 24 months from submission, then deleted.
• –Photos and prompts submitted to AI features: processed transiently to serve your request; where render-history storage is enabled, stored uploads and generated designs are kept until you request deletion.
• –Vendor catalog records: for the duration of the vendor relationship, then removed or anonymized on request, subject to records we must keep by law.
• –Usage events and server logs (including IP addresses): up to 12 months for usage events and up to 90 days for raw server logs, unless needed longer for security investigations or legal claims.
• –Data we must retain to comply with Indian tax, accounting, or other statutory obligations, or to establish or defend legal claims, is kept for the legally required period.

Google retains Gemini abuse-monitoring logs for a limited period under its own terms; that retention is outside our control.

Under the DPDP Act, you have the right to: access a summary of your personal data and how it has been processed; correct, complete, and update it; request erasure; have grievances redressed (Section 13); nominate another individual to exercise your rights in the event of death or incapacity; and withdraw consent at any time, as easily as you gave it. Withdrawing consent stops future processing but does not affect processing already carried out, and may make consent-dependent features (such as AI analysis) unavailable.

If the GDPR applies to you, you additionally have rights of access, rectification, erasure, restriction, portability, and objection, and the right to complain to your supervisory authority. If you are a California resident and the CCPA applies, you have the rights to know, delete, correct, and opt out of sale/sharing (we do not sell or share), without discrimination.

How to exercise your rights: email hello@dsource.ai from the address associated with your account, or include enough information for us to verify your identity. There is currently no in-app self-service deletion; all requests are handled through this channel. We respond within 30 days for most requests and never later than the timelines required by applicable law. We may decline requests that are manifestly unfounded, excessive, or that we cannot verify.

The Platform is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18, and accounts may not be created for them. If you believe a person under 18 has provided us personal data, contact us and we will delete it.

We use reasonable security safeguards appropriate to the data we handle, including encryption in transit (TLS), encryption at rest by our storage providers, database row-level security, role-based access controls, and audit logging of administrative actions. No system is perfectly secure; you are responsible for keeping your password confidential.

If a personal data breach affects you, we will notify you without undue delay in plain language, describing the nature of the breach, its likely consequences, the measures we are taking, and the steps you can take to protect yourself, along with a contact for questions. We will also notify the Data Protection Board of India and any other authorities as required by applicable law, including the DPDP Act's reporting timelines and, where the GDPR applies, its 72-hour authority notification requirement.

We will post any changes on this page with an updated version number and date, and for material changes we will give you advance notice by email or an in-Platform notice. Where a change requires fresh consent under applicable law, we will ask for it rather than assume it. Prior versions are available on request.

In accordance with the DPDP Act and Rules, the Information Technology Act, 2000 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, the contact details of our Grievance Officer are:

• –Email: hello@dsource.ai (attention: Grievance Officer)

We acknowledge grievances within 24 hours and resolve them within 15 days (and in any event within the timelines required by applicable law). If you are not satisfied with our response, you may escalate to the Data Protection Board of India after exhausting this process.

This Policy should be read together with our Terms of Service.