Privacy Policy

1. What we collect

• Order details: your name, email, phone and billing address. For companies, also the company name, registration number, VAT number and contact person.
• Your property: its address, country and size, plus the photos, floor plans and dimensions you upload.
• Your design preferences: style, colours, budget range, notes and your answers to the style questionnaire.
• Messages you send us, such as quote requests, revision requests and emails.
• Payment: payments are handled entirely by Stripe. We never see or store your card details. We only receive confirmation that the payment went through.
• Technical data: anonymous page-view statistics and error reports (see section 6).

2. Why we use it

• To provide the service you ordered: preparing and delivering your design, handling revisions and keeping in touch with you about your order. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR).
• To issue invoices and keep accounting records. The legal basis is our legal obligation (Art. 6(1)(c) GDPR).
• To keep the site secure, fix errors and understand, in aggregate, how the site is used. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR).

We do not sell your data and we do not use it to build advertising profiles.

3. Photos of your home

• Your photos and files are stored privately. They are not publicly accessible, and your designs are delivered to you through a personal link that cannot be guessed.
• We use your photos only to prepare your design. For AI-assisted packages, they are sent to an AI image-generation provider for the sole purpose of generating your images.
• We never publish your photos, your address or the designs made for your home (in our portfolio, before/after examples or on social media) without your separate, explicit permission. You can withdraw that permission at any time.

4. Who processes data for us

We use the following service providers, who process data only on our instructions:

• Vercel: website hosting, file storage and anonymous web analytics
• Neon: database, hosted in the EU (Frankfurt)
• Stripe: payments
• Resend: order and delivery emails
• AI image-generation providers (Replicate, Google, OpenAI or Stability AI), only for AI-assisted packages and only the provider used for your order
• Sentry: error reports, with personal data removed before they are sent

Some of these providers are based in the United States. Where data is transferred outside the EU/EEA, the transfer relies on the EU–US Data Privacy Framework or on the European Commission's Standard Contractual Clauses.

5. How long we keep it

• Invoices and accounting records: as long as Bulgarian accounting and tax law requires, currently up to 10 years.
• Orders, photos and delivered designs: for as long as needed to deliver your order and handle revisions, then for up to 24 months after delivery, unless you ask us to delete them sooner.
• Quote requests and emails: up to 24 months after our last contact.
• Our internal operational log (order status changes, delivery and error records, without photos or full email addresses): 12 months. After that it is deleted automatically.

6. Cookies and statistics

• We only use cookies that the site needs to work: one that remembers your language and the login cookies for Studio accounts. We use no advertising or tracking cookies, which is why the site has no cookie banner.
• Page-view statistics come from Vercel Web Analytics, which works without cookies and does not identify individual visitors.
• We also count how many times steps such as opening a package or starting an order happen. These counts use no cookies and no identifiers.

7. Your rights

Under the GDPR you have the right to access your data and to have it corrected or deleted. You can also ask us to restrict its use, to give you a copy in a portable format, or to stop using it where we rely on legitimate interest. Where you have given consent, you can withdraw it at any time.

To exercise any of these rights, email info@casadilola.online. We will reply within one month.

You also have the right to complain to the Bulgarian Commission for Personal Data Protection (https://www.cpdp.bg) or to the data protection authority in your country.

8. Changes

We may update this policy when our services or the law change. The date of the latest version is shown at the top of this page.