Privacy Policy

SUNDAY HOUSE LIMITED, trading as Sunday House, is the data controller for the personal data described in this policy. We are a company registered in England and Wales.

• Registered office: 86 Lawnswood Road Wordsley, DY8 5NA, England
• Email: support@sundhous.shop
• Telephone: +44 7168478734
• Website: sundhous.shop

Sunday House is online software. We do not sell furniture or lighting, we do not handle physical goods and we do not attend your home, so we never need your home address or access details.

We keep collection narrow and tied to a purpose. We collect:

• Subscription data: the email address you give at checkout, your plan, billing period and subscription status.
• Room brief data (your user input): the text you type into the studio — the room, your budget in USD, your style choice, whether you can drill walls, and anything else you describe about the space.
• Generated outputs: the before and after frames, colour and material boards, lighting plans, shoppable lists, walkthrough videos and PDF room plans produced from your brief.
• Support and lead data: your name, email and message when you use the contact form or the room brief form, plus our replies.
• Billing data: subscription status, plan, billing period, invoice history, billing address and the last four digits and card brand supplied to us by Stripe.
• Technical data: IP address, browser and device type, request timestamps and error logs, used for security, rate limiting and diagnosing faults.

Room photos. If you attach a photo in the studio, it is read by your own browser and shown back to you as your before frame. It is not uploaded to our servers and is not sent to our generation provider. It disappears when you close or reload the page. If you choose to attach a photo to a support email, that copy is handled as support data.

We do not ask for and do not want special category data. Please do not include health, biometric, financial or other sensitive details, or identifiable images of other people, in a room brief.

We use three collection sources, and no others:

• Directly from you: when you type a room brief, run a generation, contact support or subscribe.
• Automatically from your device: when your browser requests pages and our API routes, through server logs and strictly necessary cookies.
• From Stripe: subscription state, invoice results, refunds and disputes reported back to us after you pay. Stripe never passes us your full card number.

We do not buy personal data, scrape it or obtain it from data brokers.

This section is the whole picture for the AI part of Sunday House, because it is the part people most want a straight answer about.

• User input. Your user input is the room brief text you type: the room, the budget, the style, the drilling limit and your description of the space. When you press Plan or Visualise, that user input is sent to our servers, turned into a prompt and passed to our generation provider so it can produce your outputs. It is used for nothing else. We do not keep your user input in a database of our own, we do not profile you with it, and we do not sell or share it.
• File uploads and sample data.A room photo you attach is processed entirely in your own browser to display your before frame. It is never uploaded to us, never reaches our servers and is never sent to the generation provider. It is discarded when you close or reload the page. The worked example briefs on the site are our own sample data, not anyone's real room.
• Generated results. Your outputs are held by our generation provider at a temporary link for up to 30 days so you can view and download them, then removed. We do not copy them into storage of our own. Download whatever you want to keep.
• Deletion. Because we do not retain your user input or your generated results, there is normally nothing of yours for us to delete. If a brief has reached us through a support message or the room brief form, email support@sundhous.shop and we will delete that record within 30 days.
• No model training.We do not use your user input, your uploads or your generated results to train, fine-tune or improve any AI model, ours or a third party's. Our contract with our generation provider prohibits training on the content we send it. If that ever changed we would ask for your consent first, and it would be opt-in.

Generation is automated, but it produces suggestions for you to review rather than decisions about you. What our outputs are and are not is set out in the AI Disclaimer, and who owns them is in the Content License.

Under UK GDPR and EU GDPR we rely on the following legal bases.

• To perform our contract with you: accepting a room brief, generating outputs, providing downloads and exports, and applying your subscription allowance.
• To perform our contract and comply with legal obligations: taking subscription payments, issuing invoices, handling refunds and disputes, and keeping tax and accounting records.
• Our legitimate interests: keeping the service secure, rate limiting abuse, preventing fraud, fixing faults, and answering support requests. We balance these against your rights.
• Your consent: optional analytics or marketing cookies, and any marketing email. You can withdraw consent at any time without affecting anything done beforehand.
• Legal obligation: responding to lawful requests and meeting our statutory record-keeping duties.

We do not train AI models on your data.Your room briefs and generated outputs are not used to train, fine-tune or improve any model, ours or a third party's. We do not sell personal data and we do not share it for cross-context behavioural advertising.

We share personal data only with processors who need it to run the service, under contracts that restrict them to our instructions.

• Payments — Stripe:takes and processes subscription payments and manages refunds and disputes. Your card details are entered on Stripe's own hosted checkout. Sunday House never sees, stores or transmits your full card number, expiry or security code, and card data never reaches our servers.
• Hosting — Vercel: serves the website and runs our server-side API routes and logs.
• Lead storage — Supabase: stores support enquiries and room brief submissions sent through our forms.
• Generation provider — KIE: receives the text prompt built from your room brief in order to return the generated images and walkthrough videos. It receives your brief text, not your account identity or payment data, and not any photo you viewed locally.
• Email delivery: the provider that sends account, billing and support email.
• Professional advisers and authorities: only where the law requires it, or to establish or defend legal claims.

If our business is ever restructured or transferred, personal data may pass to the buyer under the same protections. We would tell you first.

Sunday House serves customers worldwide, and some of our processors operate outside the United Kingdom and the European Economic Area, including in the United States. Where personal data leaves the UK or EEA, we rely on one of the following safeguards:

• an adequacy decision covering the receiving country;
• the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum, together with a transfer risk assessment; or
• another lawful transfer mechanism permitted under UK or EU data protection law.

You can request a copy of the safeguard we rely on for a particular transfer by writing to support@sundhous.shop.

• Room briefs: passed through our servers to build your plan and prompts. We do not keep them in a database of our own. They appear in short-lived server logs only when a fault occurs, and those age out within 90 days.
• Generated outputs: held by our generation provider at a temporary link for up to 30 days so you can view and download them, then removed. Download anything you want to keep. We do not copy your outputs into storage of our own.
• Room photos: never stored by us. They stay in your browser only.
• Support and lead records: kept for 24 months from our last exchange.
• Billing and tax records: held by Stripe and kept for 7 years, as UK tax law requires.
• Security and server logs: kept for up to 90 days.

When a retention period ends we delete the data or irreversibly anonymise it. Backups age out on their own cycle, within 90 days.

If you are in the UK or the EEA, you have the right to access your data; to correct it; to have it erased; to restrict or object to processing, including processing based on our legitimate interests; to data portability; and to withdraw consent at any time. You also have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects — we make no such decisions.

If you are a California resident, you have the right to know what personal information we collect, use and disclose; to request deletion; to request correction; to opt out of sale or sharing; to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights.

Do Not Sell or Share My Personal Information. Sunday House does not sell personal information and does not share it for cross-context behavioural advertising, so there is nothing to opt out of. We do not collect sensitive personal information for the purposes that would trigger a right to limit its use. If this ever changes we will update this policy and provide an opt-out before the change takes effect.

To exercise any right, write to support@sundhous.shop from the address on your account, or use the contact form. We answer within 30 days, and we do not charge a fee unless a request is manifestly unfounded or excessive. We may need to verify your identity first. You may use an authorised agent where the law allows it.

We use strictly necessary cookies to keep you signed in, to protect forms and to keep the admin area secure. These do not need consent. Any analytics or preference cookie is optional and is only set if you agree.

The full list, purposes and lifetimes are in our Cookie Policy, along with how to change your choice or clear cookies in your browser.

Automated processing. Generating a room plan is automated, but it produces suggestions for you to review, not decisions about you. It has no legal or similarly significant effect and does not profile you.

Security. Data is encrypted in transit with TLS. Payment credentials never touch our servers. Provider keys and admin credentials are held server-side only, never in the browser. Access is limited to the people who need it, and admin sessions are signed, time-limited and rate limited. No online service can promise perfect security, but we notify you and the ICO of a qualifying breach within 72 hours of becoming aware of it.

Children. Sunday House is not for children under 13, and we do not knowingly collect their data. Users aged 13 to 17 need the consent of a parent or guardian, who must accept our Terms of Service on their behalf. If you believe a child has given us personal data, write to support@sundhous.shop and we will delete it.

Data protection enquiries: support@sundhous.shop, or SUNDAY HOUSE LIMITED, 86 Lawnswood Road Wordsley, DY8 5NA, England. Telephone +44 7168478734. Support hours are Monday–Friday, 09:00–17:00 Europe/London.

If you are unhappy with our response you can complain to the UK Information Commissioner's Office at ico.org.uk, or telephone 0303 123 1113. If you are in the EEA you may complain to your local supervisory authority. We would appreciate the chance to put things right first.

We review this policy at least once a year. Material changes are announced on this page and, where the change affects you meaningfully, by email before it takes effect.