Privacy Policy
Last updated 30 October 2026
Mani Pratap, trading as Decova (“Decova”, “we”) decides how and why your personal data is used for the service: we are the data fiduciary under India’s Digital Personal Data Protection Act, 2023 and the controller under the GDPR and UK GDPR. This policy explains what we collect, why, who we share it with, how long we keep it and the rights you have.
Grievance Officer and contact
Our Grievance Officer handles privacy questions, requests and complaints, including those under the Information Technology Act, 2000 and its rules, the Digital Personal Data Protection Act, 2023 and the Consumer Protection (E-Commerce) Rules, 2020. The Grievance Officer is Mani Pratap. Write to the Grievance Officer, Mani Pratap, trading as Decova, at privacy@decova.app. We acknowledge complaints within 48 hours and resolve them within 30 days, or sooner where the law requires.
What we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Name, email and profile photo from Google, sign-in method (and, for accounts we set up, a password stored only as a secure hash) | Create and secure your account | Contract |
| Room photos you upload and the designs made from them | Provide the service. Location and camera data (EXIF/GPS) is removed from photos on upload. | Contract |
| Floor plan details (plot size, rooms, city, preferences) and the plans, renders and estimates made | Provide the service | Contract |
| Payment records (pack, amount, date, tax details), once packs go on sale. Card details go to the payment provider, never to us. | Billing, tax and accounting | Contract, legal obligation |
| IP address, browser, sign-in times, security logs | Keep accounts and the service secure, prevent abuse and free-credit farming | Legitimate interests (GDPR); legitimate uses (DPDP) |
We don’t sell your personal data or share it for advertising, and we don’t use your photos to train AI models. Our AI provider, Runware, processes your photo only to create and check your design, under terms that don’t allow it to use your photo to train its models.
Who we share data with
Only the service providers below, which process data on our behalf under contract terms that require them to keep it secure; professional advisers under a duty of confidentiality; a buyer of the business, under this policy; and authorities when the law requires it. This list shows the providers we use today; we update it when that changes.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Vercel | Hosting the app | All data in transit | USA / EU |
| Neon | Database | Account, project and billing records | USA / EU |
| Cloudflare | File storage (R2), DNS, bot check (Turnstile) | Photos, designs, IP address | Global |
| Inngest | Background jobs | Design job IDs | USA |
| Google (Sign in with Google) | Signing you in | Name, email address, profile photo | USA |
| Runware | AI designs, design checks, prompt writing and city cost searches (some models run by their makers, OpenAI and ByteDance) | Room photos, designs, design notes | USA / EU |
Business customers who need a data processing agreement can ask for one at privacy@decova.app.
International transfers
Some of our providers are outside India, mainly in the United States. We transfer data only as the law permits, with the safeguards it requires.
How long we keep data
- Photos, designs and floor plans: while your account is active. Files in accounts that have never bought a pack are deleted after 90 days of inactivity.
- Deleted accounts: removed from our live systems at once. Copies held for disaster recovery by our database provider age out within 30 days.
- Payment records: as long as tax law requires (up to 8 years), anonymised where possible.
- Security logs: 30 days.
How we protect data
We use reasonable security measures, including encryption in transit and at rest and keeping each customer’s files separate from everyone else’s. No system is perfectly secure. If a breach affects your personal data, we’ll tell you and the authorities as the law requires.
Your rights
Depending on where you live (for example under the DPDP Act or the GDPR), you can access, correct, update, download or delete your data, object to or restrict processing, withdraw consent at any time, and, in India, nominate someone to exercise your rights if you die or become unable to. You can do most of this yourself: Settings › Privacy has “Download my data” and “Delete account”, For anything else, email privacy@decova.app. If you are not satisfied with our answer, you can complain to the Data Protection Board of India or to your local data protection authority.
Children
Decova is for adults (18+). We don’t knowingly collect data from children; if we learn we have, we delete it.
Changes
We’ll post changes here with a new date, and post significant ones before they apply.