Privacy Policy

1. Information We Collect

When you join the waitlist

• Email address (required) and, optionally, your name.
• Usage type: Personal, Student, or Professional.
• Context that depends on usage type: home stage (Personal), school name and major (Student), or business name and professional role (Professional).

When you create an account

• Name, email address and password. Your password is never stored in plain text. It is hashed and salted by Supabase Auth, our sign-in provider.
• Account type: Personal or Professional, and for Professional accounts the name of your school or company.
• A consent record: when you accepted this Privacy Policy and the Terms of Service, and which version. We keep it in your account data and in a separate audit table so we can prove what you agreed to.

When you use Toran

• Room photographs you choose to upload. A photo can show more than furniture. Faces of household members, documents, prescription bottles, mail, screens and similar items can appear in the frame. Please remove anything you would not want sent to an outside AI service before you upload.
• Spatial data: the 3D view of your room, its layout and the objects Toran detects, built from your photos, plus the information collected when Maya scans your room.
• Derived images: images we create or extract while processing, such as redesigned room renders, object crops and edited regions.
• Your design input: the text you write to Toran and Maya, inspiration images you upload, and the preferences you share, such as style, colors, budget and which furniture to keep, move or replace.
• Saved designs: the versions and design briefs you create.
• Support messages you send to support@mytoran.com.

Collected automatically

• IP address, browser type, operating system and referring page, used for security, abuse prevention and basic operations logs.
• Sign-in tokens from Supabase Auth, stored in browser cookies. They keep you signed in.
• Your choices in the browser: light or dark theme (a cookie and localStorage), whether you dismissed onboarding tips (localStorage), and the last page you visited (sessionStorage). None of this is sent to our servers automatically. See our Cookie Policy.
• Usage counts, such as how many AI requests your account made today, so we can apply daily limits and track the cost of running Toran.

What we do not collect

• We do not run third-party analytics. We do not use Google Analytics, Mixpanel, Amplitude, Segment, PostHog, Sentry or similar tools.
• We do not run advertising pixels or social-media trackers.
• We do not process payments. No payment provider is connected to Toran today. If we add one, we will update this policy and tell you in advance.

2. How We Use Your Information

• To run Toran: to process your room photographs, spatial data and prompts through our AI tools, build your 3D view, and produce the designs you ask for.
• To remember your design brief so each new edit fits the room you already chose.
• To sign you in and keep your account secure.
• To apply daily AI usage limits and track the cost of each feature.
• To send transactional email, such as waitlist confirmations, invitations, account confirmation and password reset. Resend delivers waitlist and invitation emails. Supabase Auth delivers account confirmation and password reset.
• To give support, find and fix problems, investigate abuse, and improve quality. Toran staff may view your conversations, prompts and saved designs for these reasons. Access is limited to staff who need it. We may also review combined, non-identifying usage patterns.
• To prevent abuse and respond to security incidents.
• To meet legal obligations.

We do not use your identifiable room photographs to train our own models. We do not send marketing email without your separate, clear consent.

3. Room Photographs and AI Processing

When you ask for an edit or a 3D view, your photographs, spatial data and the prompts that go with them are sent over an encrypted connection to outside AI providers. Different steps use different providers:

TODO, 3D view and room-scan service (name, data, retention and training default). Fill from the vendor's terms: [CONFIRM: name of the service that builds the 3D view and runs the room scan] · [CONFIRM: what it receives] · [CONFIRM: its retention] · [CONFIRM: its training default].

We rely on each provider's published terms and default data handling. We have not negotiated custom data processing agreements with them at this stage of the company. If that changes, we will update this policy.

Toran stores your photographs and generated images in Supabase Storage, in four areas: room-images (originals), object-assets (object crops), room-edits (edited room renders) and ai-guru-results (transformation outputs). Files are stored under paths tied to your user ID.

4. Sub-processors

These companies help us run Toran. Each is listed with what it may handle:

• Supabase: sign-in and database hosting. Stores account details, consent records, room and object information, and image files. Hosted in the United States.
• OpenAI: AI image generation, edits and vision-assisted prompts (Section 3).
• Replicate: AI segmentation, inpainting and background removal (Section 3).
• FAL.ai: AI segmentation and transformation (Section 3).
• Anthropic: AI text reasoning, including Maya's conversation. No room images are sent.
• Resend: delivery of waitlist and invitation emails. Hosted in the United States.
• Render / Vercel: application hosting.

TODO, 3D and room-scan service: name it here and state what it does with your photos (Section 3). Until it is named, this list is incomplete.

We do not sell or rent your personal information to anyone. We may share information when the law, a court or a government authority requires it, or to protect the safety of our users or the public. We will give reasonable advance notice before adding a sub-processor that materially changes how your data is handled.

5. International Data Transfers

Our sub-processors are based mainly in the United States. If you use Toran from the European Economic Area, the United Kingdom, Switzerland or anywhere outside the U.S., your personal data is sent to and handled in the United States. We rely on each provider's published transfer terms, including Standard Contractual Clauses where the provider offers them. We have not yet signed Standard Contractual Clauses ourselves. We plan to put a formal transfer mechanism in place and will update this policy when we do.

6. Data Retention

We keep your account data, photographs, spatial data and saved designs for as long as your account is open. If you ask us to close your account, we start deleting your credentials, photographs, spatial data, generated images and related details within 30 days of confirming your request. We may keep some information longer where the law requires it, such as records for tax, fraud prevention or legal claims.

Waitlist entries are kept until you ask us to remove them or until we no longer need them to tell you about launch.

Deletion at outside AI providers follows each provider's own schedule (Section 3). We do not control those timelines.

7. Your Rights

Everyone

• Access: ask for a copy of the personal data we hold about you.
• Correction: ask us to fix inaccurate information. A self-service profile editor is planned.
• Deletion: ask us to delete your account and data. For now this is handled by hand. Email support@mytoran.com with the subject line "Data Deletion Request". We confirm receipt and finish within 30 days.
• Export: ask for a machine-readable copy of your data. This is also handled by email for now. Use the subject line "Data Export Request".
• Object, restrict or withdraw consent: email us at any time.

We may ask you to confirm your identity before acting on a request, so that nobody else can access or delete your data.

EU, EEA and UK residents (GDPR / UK GDPR)

Our legal bases for processing are:

• Contract: to give you the service you sign up for, including account creation, AI processing of your photos and transactional email.
• Legitimate interests: security, abuse prevention, support and basic operations logs.
• Consent: for any future marketing email and for the record that you accepted this Policy and the Terms.
• Legal obligation: where it applies.

You may also complain to your national data protection authority.

California residents (CCPA / CPRA)

In the last 12 months we collected these categories of personal information: identifiers (name, email, IP address); account details; internet and device activity; images of your home (audio-visual information); and preferences and design choices you gave us. We collect them from you, from your device, and from our service providers. We use them for the purposes in Section 2 and share them only with the providers in Section 4. We do not sell personal information and we do not share it for cross-context behavioral advertising. You have the right to know, delete, correct, and limit the use of sensitive personal information, and we will not treat you differently for using these rights. We are working to honor the Global Privacy Control signal in the app. Until then, email us to opt out.

Residents of other U.S. states

Many states give similar rights to know, correct, delete and opt out. Email us and we will treat your request the same way.

Canadian residents (PIPEDA)

Our privacy contact is support@mytoran.com. Your data may be sent to and handled in the United States by the providers in Section 4.

8. AI-Generated Content

Toran creates, edits and changes images using artificial intelligence. If an output could be mistaken for an original photograph or for human-made work, you should say it is AI-generated when you share it outside Toran. We are adding a visible "AI-generated" label inside the app (Section 11).

Toran does not make automated decisions that have legal or similarly significant effects on you, such as decisions about credit, jobs, housing or insurance. Its AI features are creative and visual.

9. Security

Supabase encrypts stored data with AES-256 and data in transit with TLS 1.2 or higher. Sign-in tokens are short-lived. No system is completely secure. If a breach affects your personal data, we will email you within 72 hours where the law requires it, and otherwise as soon as we reasonably can.

10. Children's Privacy

Toran is not meant for children. We do not knowingly collect personal information from anyone under 13 (U.S. COPPA), under 16 (EU GDPR), or under any higher age set where you live. The Terms of Service require every account holder to be at least 16. If you believe a child has given us information, email support@mytoran.com and we will delete it promptly.

11. Known Gaps and Roadmap

We are publishing this policy in good faith during public beta. These are tracked engineering tasks we commit to finishing as Toran grows:

• Self-service account deletion that removes your data from the database and from storage.
• Self-service data export.
• Honoring the Global Privacy Control browser signal in the app.
• Sending FAL.ai's opt-out header on every request so it does not store your images by default.
• A visible "AI-generated" label on rendered images.
• A machine-readable list of sub-processors and an email notice when it changes.

12. Changes to This Policy

We will update this policy as Toran changes. For material changes, we will email you or show a clear notice in the app at least 14 days before they take effect. If you keep using Toran after that date, you accept the new policy. We record the version of the policy you accepted next to your consent record.

13. Contact

For privacy requests, questions or complaints, write to:

Toran Inc., Seattle, Washington, USA

support@mytoran.com