Privacy Policy

1. Controller and contact

The controller of the personal data processed through the Dometria web application (https://dometria.app/) is the Dometria team.

For any questions about privacy and personal data, you can contact us at rumen.b.popov@gmail.com.

2. What data we process

We process only the data needed for you to have an account and use the application.

When signing in with Google

During authentication Google may provide us with the following data from your Google account, when available:

• name;
• email address and whether it's verified by Google;
• your Google account ID;
• profile photo.

Of these, we store only the email address, the name and the Google account ID. We don't store the Google profile photo. We have no access to your Google password.

When signing up with email and password

• email address;
• your name, if you choose to enter it;
• the password — only as a cryptographic hash (scrypt with a random salt), never as text.

When using the application

• the floor plan files you upload, their names and notes, and the result of processing them (3D model and furnishing);
• a profile photo — only if you upload one yourself in the settings; we keep it downsized (256×256), without location and camera data, and only you can see it;
• your settings preferences (default style and units) and how many generations you've used this month;
• technical data described in section 9.

We don't require or process special categories of personal data. Please don't upload files containing personal information that isn't needed for the floor plan.

3. What we use the data for

The legal basis is the performance of the service you request by using the application, and for technical data and security measures, our legitimate interest in keeping the service secure and running.

We don't use your data for advertising, we don't sell it, and we don't carry out profiling or automated decisions with legal effects for you.

4. Google Sign-In / Google OAuth

Dometria offers sign-in with a Google account via the OAuth 2.0 / OpenID Connect protocol. When you choose “Continue with Google”, you're redirected to a Google page where you choose your account and confirm access yourself. Google returns only the basic authentication data described in section 2.

• We use the data from Google solely for sign-in and for maintaining your Dometria account.
• We don't get access to your Gmail, Google Drive, contacts, calendar or other Google services.
• We don't post anything on your behalf.
• We don't transfer data received from Google to third parties unless required by law.

Dometria's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can revoke Dometria's access to your Google account at any time in your Google account security settings. This doesn't automatically delete your Dometria account — for deletion see section 8.

5. Storage and security

• The data is stored on the server that runs Dometria.
• The connection to the application is protected with HTTPS (TLS).
• Passwords are stored only as a hash (scrypt); in the database the session key is also stored only as a hash (SHA-256).
• The session cookie is inaccessible to scripts on the page (HttpOnly) and is sent only over a secure connection.
• Repeated failed sign-in attempts from one address are temporarily limited.
• Only the Dometria administrator has access to the server.

Retention period

• Account data — for as long as the account exists or until you ask for it to be deleted.
• The sign-in session — up to 30 days or until you sign out.
• Uploaded plans and their results — for as long as the service needs them or until you ask for them to be deleted.
• Technical logs — for a limited period needed for security and troubleshooting.

No system is completely secure, but we apply reasonable technical and organisational measures to protect your data.

6. Data sharing

We don't sell or rent out your personal data. Data is shared only in the following cases:

• Google (sign-in) — when you sign in with Google, authentication is performed by Google under the Google Privacy Policy.
• Google (reading the plan) — the image of the uploaded plan is sent to Google's Gemini API so the drawing can be read (walls, rooms, dimensions). Only the plan file and its note are sent, without your email address, name or account ID.
• Creem (payments) — subscriptions are sold through Creem (creem.io), the merchant of record: it processes the payment, charges VAT and issues the invoice. When you subscribe, your email address and account number are passed to Creem; you enter your card details on Creem's page and Dometria never sees them. We keep only the Creem subscription and customer IDs, to know which plan is paid for.
• By law — when required by applicable law or by a competent authority.

Links to products from online shops in the application lead to those shops' websites. We don't pass your data to them; when you open their site, their privacy policies apply.

7. Your rights

Under the General Data Protection Regulation (GDPR) and applicable law, and subject to the conditions they set out, you have the right:

• to receive information about and access to your personal data;
• to request correction of inaccurate data;
• to request deletion of your data;
• to request restriction of processing;
• to receive your data in a structured, machine-readable format (portability);
• to object to processing based on legitimate interest;
• to lodge a complaint with a data protection supervisory authority — in Bulgaria this is the Commission for Personal Data Protection (CPDP).

To exercise your rights, write to us at rumen.b.popov@gmail.com. We may ask you to confirm the email was sent from the address linked to the account, so that we don't hand data to someone else. We reply without undue delay and within the time limits set by the GDPR.

8. Deleting your account and data

You can delete your account yourself at any time: Settings → Account → Delete account in the dashboard. Your account, sign-in sessions, profile photo, uploaded plans with their results and usage history are deleted immediately. If you have a paid subscription, cancel it first under “Subscription and payments”.

You can also request deletion by email:

• send an email to rumen.b.popov@gmail.com with the subject “Delete my Dometria account”;
• write from the email address the account is registered with (or give that address if you write from another one);
• we'll delete the account and sign-in sessions and confirm by email;
• if you'd like us to delete an uploaded plan too, give its number — it's in the address of the result page (…/upload?id=number).

Deletion is carried out without undue delay, usually within 30 days. Data may be kept longer only if required by law.

9. Cookies and technical data

Dometria uses only what it needs to work. We don't use advertising cookies, third-party tracking cookies or visitor analytics tools.

With every request, the web server logs standard technical data: IP address, date and time, requested address, response code and browser information (user agent). They're used for security, abuse prevention and troubleshooting.

10. Changes to this policy

We may update this policy when we change the application or the way we process data. The current version is always on this page, and the date of the last change is shown at the top. For significant changes we'll notify you in the application or by email.

11. Contact

Send questions, requests and complaints about personal data and this policy to:

rumen.b.popov@gmail.com