Spacethetic Privacy Policy

1. Introduction

This privacy policy (the "Policy") describes how Tandav Labs Inc. ("Tandav Labs," "we," "us," "our") collects, uses, discloses, and protects personal data when you visit spacethetic.com (the "Site") or access or use Spacethetic—our AI interior design services, web applications, mobile apps, and APIs (collectively, the "Services").

Spacethetic lets you upload images of your homes or interior spaces and objects (e.g., furniture, tiles, furnishings) and generate new design variants ("Assets"). As used here, "personal data" means any information that relates to an identified or identifiable individual.

Applicability

This Policy applies to personal data that Tandav Labs collects, uses, and discloses, including:

• (i) data collected through the Services;
• (ii) data used for improving and training Tandav Labs' machine learning systems (see §2.2);
• (iii) data collected via our websites; and
• (iv) data collected from third-party sources (e.g., public databases, commercial data providers, publicly available internet sources).

When you make purchases, we use third-party payment processors; we do not store your full payment card details—only transaction confirmations.

Not covered

This Policy does not cover personal data about Tandav Labs employees/candidates or contractors in those capacities.

Changes

We may update this Policy from time to time to reflect changes in law, our practices, or features. When required by law, we'll notify you. If changes are unacceptable, you should stop using the Services.

Definitions

"You," "Your" means the individual using the Services or the company on whose behalf the individual uses the Services. "Usage Data" means data generated by your use of the Services or our infrastructure (e.g., log data, device info, session length).

Controller

For most processing described here, Tandav Labs Inc. is the data controller. Contact: privacy@tandavlabs.com

2. Collecting and Using Your Personal Data

2.1 Types of Data Collected

Personal Data you provide

• Account & Contact Info: name, email, username, organization, role/title, billing info (handled by payment processor), preferences.
• Content/Inputs: images of interiors/objects you upload; associated prompts, notes, metadata; any messages you send us (support, surveys, feedback).
• Generated Assets: outputs created by you (rendered variants).
• Communications: emails, in-app messages, or survey responses.

Automatically collected (Usage Data)

• Technical: IP address, device and browser type/version, OS, referring/exit pages, timestamps, error logs.
• Interaction: page views, features used, clickstream, session duration, approximate location inferred from IP (city/region level).
• Cookies/Similar Tech: for essential functionality, analytics, and (where permitted) marketing. See Cookie settings on the Site.

Third-party sources

Public databases, advertising/analytics providers, payment processors, fraud-prevention partners, identity providers (for SSO), or social sign-in (if enabled).

2.2 How We Use Personal Data

We use personal data to:

• Provide, operate, and improve the Services (including to render Assets, process uploads, maintain infrastructure, fix bugs, enhance models and features).
• Account management and customer support.
• Contract performance (purchases, subscriptions, trials).
• Security, fraud prevention, and integrity (detect/mitigate abuse, enforce policies).
• Service communications (transactional emails, product updates, security notices).
• Recommendations and product R&D (analytics, quality evaluation, A/B tests).
• Marketing (where permitted)—news, offers, events similar to your interests; you can opt out anytime.
• Business operations—audits, compliance, mergers or acquisitions, and other corporate transactions.
• Legal compliance—respond to lawful requests, enforce terms, protect rights, users, and the public.

Model improvement & training

To improve quality, safety, and performance, we may use and retain (a) your Inputs (e.g., uploaded images and prompts) and (b) Assets to train, fine-tune, evaluate, and test our models and systems, unless: (i) you are on a plan or have settings that disable such use (if available), or (ii) applicable law provides a right to object and you exercise that right (see §6—Europe/UK). Where feasible, we apply data minimization/pseudonymization and access controls.

2.3 Sharing Your Personal Data

We may share personal data:

• With service providers/partners (hosting, cloud compute, storage/CDN, analytics, logging, support, email/SMS, payment processing, fraud prevention, ID verification/SSO, error monitoring, marketing—with your consent where required).
• Business transfers (merger, acquisition, financing, asset sale).
• With your consent (e.g., integrations you enable).
• Law enforcement/legal where required or permitted by law. Unless legally restricted, we will notify you of requests we receive for your personal data.

2.4 Retention

We retain personal data as long as necessary for the purposes above, to comply with legal obligations, resolve disputes, and enforce agreements. Usage Data is generally kept for shorter periods unless needed for security, service integrity, or legal reasons. If you delete your account, we will delete or de-identify associated personal data within a reasonable time unless retention is required by law or for legitimate business purposes (e.g., billing records, security logs).

2.5 International Transfers

We operate globally using third-party infrastructure. Your data may be transferred to and processed in countries that may have different data-protection laws than yours. We implement appropriate safeguards for cross-border transfers (e.g., EU Standard Contractual Clauses, UK Addendum) and technical/organizational measures.

2.6 Security

We use commercially reasonable administrative, technical, and physical safeguards (e.g., encryption in transit, access controls, logging). No method is 100% secure, and we cannot guarantee absolute security.

3. Children's Privacy

The Services are not directed to children under 13 and we do not knowingly collect personal data from them. If you are a parent/guardian and believe your child provided us personal data, contact privacy@tandavlabs.com. If we learn we collected such data without verifiable consent where required, we will delete it.

4. Links & Third Parties

The Services may link to third-party websites, apps, or services. Their privacy practices are governed by their policies. We are not responsible for third-party content, policies, or practices.

5. Updates to this Policy

We may update this Policy periodically. Material changes will be posted on this page (and emailed/in-app where required by law). Your continued use of the Services after posting indicates acceptance of changes.

6. Supplemental Terms for Certain Regions

Europe/UK (EEA, Switzerland, UK)

Legal bases

We process personal data where one or more of the following applies:

• Contract (to provide the Services to you);
• Legitimate interests (e.g., security, service improvement, analytics, limited direct marketing);
• Consent (e.g., non-essential cookies, certain marketing);
• Legal obligation (compliance, recordkeeping);
• Vital/Public interest (rare, if applicable).

International transfers

We use SCCs/UK Addendum and complementary safeguards where appropriate.

Cookies/consent

Non-essential cookies are used only with your consent. Manage preferences via our Cookie Settings on the Site.

Your rights

Subject to exceptions, you may:

• request access, rectification, or erasure;
• object to or restrict processing (including objection to model-improvement/training use of your Inputs/Assets where based on legitimate interests);
• request data portability;
• withdraw consent where processing relies on consent;
• lodge a complaint with your local supervisory authority.

Exercising rights

Email privacy@tandavlabs.com or use account tools at spacethetic.com/account. We will verify your identity and respond per applicable law.

California (CCPA/CPRA)

This section applies to California residents or where CA law applies.

Information we collect/disclose (past 12 months)

Purposes

As described in §2.2.

"Sale"/"Sharing"

We do not sell personal information for money. We may share identifiers/Internet activity with advertising/analytics providers for cross-context behavioral advertising where permitted—this is "sharing" under CPRA. You can opt out via Do Not Sell/Share My Info link (site footer) and Cookie Settings.

CCPA/CPRA rights

• Know/Access, Correct, Delete personal information;
• Opt-out of Sale/Sharing;
• Limit use of Sensitive PI (if collected);
• Non-discrimination for exercising rights.

Submit requests/opt-out

Email privacy@tandavlabs.com or visit spacethetic.com/account and the Do Not Sell/Share link. We'll verify your request and respond within statutory timeframes. You may use an authorized agent.

7. User Content & Responsibility (Privacy-Relevant)

You are solely responsible for the Content you upload or generate (e.g., room photos, furniture/object images, metadata), including obtaining all necessary permissions/consents (e.g., from photographers, designers, brands, or individuals depicted). Do not upload Content you lack rights to or that infringes privacy, publicity, or IP rights. If your Content contains personal data of others, you represent you have a lawful basis to provide it to us and to have it processed as described here.

8. Data Subject/Consumer Requests & Contact

• Account/Privacy tools: spacethetic.com/account (access, deletion, preferences)
• Email: privacy@tandavlabs.com (all regions)

We may request information to verify your identity/authority before acting on a request.

9. Cookies & Tracking Technologies (Summary)

We use:

• Strictly Necessary Cookies (security, session, load balancing)
• Functional Cookies (preferences, UX)
• Analytics Cookies (usage, performance)
• Advertising/Marketing Cookies (with consent where required)

Manage preferences in Cookie Settings on the Site and via your browser settings. Some features may not function without certain cookies.

10. Additional Disclosures

• Payment Processing: handled by third-party processors; we don't store full card numbers.
• De-identified/Aggregated Data: we may use/share de-identified or aggregated data for analytics, research, and service improvement. We commit to not re-identify de-identified data except as permitted by law.
• No Automated Decision-Making with Legal/Similarly Significant Effects without appropriate safeguards and notices (if applicable in your region).