Privacy Policy

Last updated: June 24, 2026

1. Introduction

MyTaste ("we", "us", "our") operates the MyTaste platform at mytaste.design. This Privacy Policy explains how we collect, use, store, and protect your personal data in compliance with the EU General Data Protection Regulation (GDPR) and Romanian data protection law.

2. Data Controller

The data controller responsible for your personal data is MyTaste, registered in Romania. For data protection inquiries, contact us at: privacy@mytaste.design

3. Data We Collect

3.1 Account Data

  • Email address (used for authentication and communication)
  • Display name and profile photo (from Google login or manual entry)
  • Authentication provider (Google, email/password)

3.2 Usage Data

  • Design renders generated, edits made, upscales performed, rooms decluttered
  • Product searches and shopping list items
  • Projects saved (room photos, reference images, design variants)
  • Community gallery posts and interactions

3.3 Images You Upload

  • Room photographs and style reference images
  • AI-generated design renders (stored in Firebase Cloud Storage)
  • Product thumbnails generated for visual search

Important: Your images are processed by Google's Gemini AI models for design generation. Images are sent to Google Cloud Vertex AI for processing and are subject to Google Cloud's data processing terms.

3.4 Payment Data

Payment processing is handled entirely by Stripe. We do not store your credit card numbers, CVV, or full card details. We receive from Stripe: transaction IDs, payment status, and the plan or credit pack purchased. See Stripe's Privacy Policy.

3.5 Analytics & Cookies

With your consent, we use Google Analytics 4 (GA4), Google Tag Manager, and optional marketing pixels (Meta, TikTok) to understand usage patterns and improve the platform. You can manage cookie preferences via our cookie consent banner at any time.

4. AI Image Processing

  • User-uploaded photos are processed by AI models to generate decluttered and staged versions of your space
  • Free-tier users: generated images are automatically published to the community gallery to build a shared inspiration library
  • Paid users: generated images are private by default and are only shared if you manually publish them
  • All images (uploaded and generated) are stored in cloud storage associated with your account
  • Images are processed by third-party AI services: Google Vertex AI and OpenRouter (which routes to model providers such as Google Gemini). These services are subject to their own data processing terms

5. How We Use Your Data

  • Service delivery: Generate AI design renders, source products, manage projects
  • Billing: Process design pack purchases, track allowance usage
  • Communication: Account verification emails, password resets, payment receipts
  • Analytics: Understand feature usage to improve the platform (with consent)
  • Security: Detect abuse, enforce rate limits, prevent fraud

6. Legal Basis for Processing (GDPR Art. 6)

  • Contract performance: Account management, design generation, billing
  • Consent: Analytics cookies, marketing communications
  • Legitimate interest: Security monitoring, fraud prevention, service improvement
  • Legal obligation: Tax records, invoice generation (Romanian fiscal requirements)

7. Data Sharing & Processors

We share data only with the following processors, all under appropriate data processing agreements:

  • Google Cloud Platform (Firebase, Vertex AI) - hosting, authentication, AI processing, storage
  • Stripe - payment processing
  • SerpAPI - product search (receives search queries, not personal data)
  • Resend - transactional email delivery
  • Google Analytics / GTM - analytics (with consent)
  • Meta Pixel / TikTok Pixel - marketing attribution (with consent)
  • Sentry - error monitoring and performance tracking (collects anonymous error reports, stack traces, and device metadata)

We do not sell your personal data to third parties.

8. Cookies & Tracking Technologies

We use the following categories of cookies and tracking technologies:

8.1 Strictly Necessary

  • Firebase Authentication tokens - session management and user identity
  • Cookie consent preferences - stored in localStorage to remember your choices
  • Theme preference - light/dark mode stored in localStorage

8.2 Analytics (requires consent)

  • Google Analytics 4 (GA4) - page views, feature usage, session duration
  • Google Tag Manager (GTM) - tag management and event routing
  • Sentry - anonymous error reports and performance metrics

8.3 Marketing (requires consent)

  • Meta Pixel (Facebook) - conversion tracking and ad attribution
  • TikTok Pixel - conversion tracking and ad attribution

You can manage your cookie preferences at any time via our cookie consent banner. Analytics and marketing cookies are only loaded after you grant consent. Withdrawing consent will stop future data collection but does not affect data already collected.

9. Data Retention

  • Account data: Retained while your account is active
  • Projects & images: Retained until you delete them or your account
  • Payment records: Retained for 10 years (Romanian fiscal law)
  • Analytics data: Retained per Google Analytics defaults (14 months)
  • Search cache: Automatically expires after 7 days

10. Your Rights (GDPR Art. 15-22)

You have the right to:

  • Access: Download all your data via Profile → Data Export
  • Rectification: Update your profile information at any time
  • Erasure: Delete your account and all associated data via Profile → Delete Account
  • Data portability: Export your data in machine-readable JSON format
  • Withdraw consent: Manage cookie preferences, unsubscribe from marketing
  • Object: Contact us to object to specific processing activities
  • Complaint: File a complaint with the Romanian ANSPDCP (national supervisory authority)

11. International Transfers

Your data may be processed in the EU and US (Google Cloud, Stripe). Transfers to the US are covered by the EU-US Data Privacy Framework and Standard Contractual Clauses where applicable.

12. Security

We implement appropriate technical and organizational measures including: encrypted data transmission (TLS), Firebase Authentication, server-side billing enforcement, Firestore security rules with field-level access control, and rate limiting.

13. Children

MyTaste is not intended for users under 16. We do not knowingly collect data from children under 16.

14. Changes to This Policy

We may update this policy periodically. Material changes will be communicated via email or in-app notification. Continued use after changes constitutes acceptance.

15. Contact

For privacy-related questions or to exercise your rights:
Email: privacy@mytaste.design
Address: MyTaste, Romania