Privacy Policy

1. Who we are

Layoutr is a browser-based floor plan tool: you upload or draw a floor plan, set the scale, and place furniture at real-world sizes. It is a trading name of Van Dijk Ontwikkeling, a sole proprietorship registered in the Netherlands under Chamber of Commerce number 42036550.

We are the controller of the personal data described in this policy. Purchases are the exception: paid plans and AI credits are sold by a separate seller of record, which is its own controller for the sale it makes to you (section 5). Our contact details are at the end of this page.

2. What we collect and why

We collect only what the service needs.

Account data

When you create an account we store your email address, a hashed password, and basic account state: your plan, your AI credit balance, sign-in timestamps, and the number of failed sign-in attempts, which lets us lock an account temporarily after repeated wrong passwords. We need this to sign you in, keep your account secure, and give you the right level of service.

Billing data

Paid plans and extra AI credits are sold by Sold through Link, LLC, the merchant of record. Link collects what it needs to take payment and issue your receipt and invoice: your payment details, your billing address and, where applicable, a VAT number. It decides for itself how it handles that data, so it acts as an independent controller rather than as a processor for us, and it is responsible for telling you about its own processing.

From the transaction we receive only your customer ID, your subscription ID and your billing status, meaning whether a subscription is active, past due or canceled. We use those to link your account to your purchase and unlock the right plan. We never receive or store your card details. We do also use Stripe Payments Europe, in a different role: as a processor on our behalf for billing, tax and invoicing administration (section 5).

Project data

Your floor plans, furniture placements and everything else in a project are created and kept in your browser (local storage), and you can save a project to your own device as a file. In ordinary use none of it reaches us and we store none of it on our servers. The optional AI features below are the one exception.

AI features (optional)

Two optional Pro features use artificial intelligence. AI-vision room detection sends the floor plan image you uploaded, so the rooms and walls in it can be detected. AI-powered furnishing sends your room's dimensions and layout, the furniture already placed, the short description you write and, where relevant, a cropped section of your floor plan.

Microsoft Azure OpenAI processes this on our behalf, only to generate your result, which is returned to your browser. We do not store it, and under Microsoft's Azure OpenAI Service terms it is not used to train AI models or shared with other customers. Both features are optional: the rest of Layoutr works without them, and without any project data leaving your device.

Email

If you subscribe to our emails, through the form on our website or during account registration, we record your email address and the preferences you chose: product updates, guides and blog posts, or both. We use them only to send you the emails you asked for. Our email provider Resend holds the mailing list on our behalf, and we keep no copy of it in the Layoutr database. Every newsletter carries a preferences link where you can change lists or unsubscribe entirely, effective immediately. Subscribing is optional and never required to use Layoutr.

Account emails, such as your welcome message and password resets, are not newsletters. You receive them because of something you did rather than because you subscribed, so they carry no unsubscribe link, and each one states why you received it.

The planner is built for desktop. If you open it on a phone, you can leave your email address to be reminded to try Layoutr on a computer, and we store that address only to send you that one reminder.

Feedback and feature requests

If you send us feedback or a feature request, we collect your message, an optional rating, your email address, and the version of the app you were using. We use this to reply to you and to improve Layoutr.

Bot protection

When you submit the subscribe form, Cloudflare Turnstile checks that you are a person and not an automated script. To do that, Cloudflare processes your IP address and signals about how you interacted with the page. Turnstile sets no tracking cookies and does not profile you across websites.

3. Cookies and analytics

We measure how Layoutr is used, and we set nothing for advertising.

Google Analytics

We use Google Analytics 4 on both layoutr.app and use.layoutr.app to understand how people use Layoutr. It records your approximate location (country and region, derived from an IP address that is not stored), your browser and device type, the pages you visit, and in-app events such as uploading a floor plan, setting scale, placing furniture and completing a purchase. Sessions are stitched across both domains so one report covers the whole journey.

Google processes this data under our instructions and it is never used for advertising. We do not enable Google's advertising features, remarketing audiences or cross-device tracking, we have no Google Ads account linked to our analytics property, and we do not advertise at all. Retention in GA4 is set to the shortest available, two months, and we use no fingerprinting or other tracking technology.

How to opt out

Analytics runs from your first visit, on the basis of our legitimate interest in understanding how Layoutr is used (section 4), and GA4 sets its persistent _ga cookies to tell sessions apart. You can opt out whenever you want: install Google's opt-out browser add-on, block analytics cookies in your browser, or email us and we will exclude you. Opting out costs you nothing, because every part of Layoutr works exactly the same either way.

The other cookies we set

Apart from analytics, our cookies are limited to what the service cannot work without, which is why they are exempt from consent: a sign-in cookie that keeps you logged in to the planner, and an anti-forgery cookie that protects the forms you submit. None of them measure you, and none of them are shared with anyone. Your theme choice, light or dark, is kept in your browser's own storage and never leaves your device.

4. Legal basis (GDPR)

Contract performance, Article 6(1)(b)

Everything needed to deliver the service you signed up for: your email address and hashed password to authenticate you, your plan together with the customer ID, subscription ID and billing status we receive from your purchase to give you the right level of access, and, when you use the optional AI features, the floor plan and details you provide to generate the result you asked for.

Legitimate interest, Article 6(1)(f)

Protecting our forms from spam and automated abuse with Cloudflare Turnstile, limited to the minimum data needed to tell people and bots apart. Keeping the service reliable and secure, for example through server monitoring and diagnostics. And handling the feedback and feature requests you send us, so we can reply and improve the product. Also understanding how Layoutr is used through Google Analytics 4, so we can improve it. We have weighed this against your rights: your IP address is not stored, there is no advertising or profiling of any kind, retention is set to the shortest GA4 offers, and you can object at any time as described in section 3.

Consent, Article 6(1)(a)

Any marketing email you subscribed to, and the reminder email you can request on mobile. You can withdraw your consent at any time through the preferences link in any email or by asking us, and withdrawing does not affect the lawfulness of processing carried out before you withdrew it.

5. Who else is involved

Processors acting on our behalf

These companies process personal data for us, under our instructions, to deliver the service.

Microsoft Corporation (Microsoft Azure) provides cloud hosting, database storage of your account data, service monitoring, and the AI processing behind our optional AI features (Azure OpenAI). Microsoft processes this data under its data processing terms and is certified under the EU–US Data Privacy Framework. Under the Azure OpenAI Service terms, data sent to the AI is not used to train AI models. See privacy.microsoft.com.

Stripe Payments Europe handles our subscription billing, tax and invoicing administration: Stripe Billing, Stripe Tax, and the dashboard we run Layoutr's plans from. Stripe processes billing data on our behalf under a data processing agreement. This is separate from the sale itself, which Link makes as an independent controller. Stripe's US affiliate, Stripe, Inc., is certified under the EU–US Data Privacy Framework. See stripe.com/privacy.

Google LLC provides analytics only (Google Analytics 4). We run no advertising products: no Google Ads, no conversion measurement for ads, and no Google Ads account linked to our analytics property. Google processes analytics data on our behalf under its data processing terms and is certified under the EU–US Data Privacy Framework. See policies.google.com/privacy.

Cloudflare, Inc. provides bot protection for our forms (Cloudflare Turnstile), processing limited technical data such as your IP address on our behalf to tell people and automated scripts apart. Cloudflare is certified under the EU–US Data Privacy Framework. See cloudflare.com/privacypolicy.

Resend (Resend, Inc.) delivers our email and holds our mailing list. It sends our account and security emails, newsletters and reminder emails, processing the recipient address and message content to deliver each one, and it holds the list itself: your email address, the lists you opted into, and your unsubscribes. Resend processes all of this on our behalf under a data processing agreement. See resend.com/legal/privacy-policy.

The seller of your purchase

Sold through Link, LLC is the merchant of record for anything you buy from us, and it is not one of our processors. It sells to you in its own name, issues your receipt and invoice, and decides for itself how it handles the data it collects to do that, so its own terms and privacy notice apply to the purchase alongside ours. Bring any question about a payment, an invoice or a refund to us anyway, and we will sort it out with Link where only the seller can act.

Transfers outside the EEA

Sold through Link, LLC is established in the United States, so buying a paid plan involves a transfer of your billing data to the United States, made by Link on its own account as the seller. Our own processors above are either established in the EU or, where they are US companies, certified under the EU–US Data Privacy Framework, which is the transfer mechanism we rely on for them.

We do not sell your data, and we share it with no one beyond the companies named in this section.

6. How long we keep your data

We keep your account data for as long as your account exists. Deleting an account is not yet a self-service feature, so email us and we will do it. Your data is then removed from our systems permanently and immediately: we use no soft deletion and no deferred removal.

Your purchase record sits with Link rather than with us, so a deletion request about the purchase goes to Link, and we are happy to help you make it. Such a request also cancels any subscription you have and erases the data held in our Stripe objects for you, which means the customer ID, subscription ID and billing status go with it.

If you subscribe to our emails, your address and list preferences stay in the Resend mailing list until you unsubscribe or ask us to remove them. Unsubscribing marks your address as opted out, which is what stops us from emailing you again. If you would rather have the record removed altogether, ask us and we will delete it.

We keep feedback and feature requests for as long as we need them to act on them. Data sent to our AI features is not retained by us at all.

7. Your rights

Wherever you live, you can ask us for a copy of the data we hold about you, have inaccurate data corrected, have your personal data deleted, receive your data in a machine-readable format, or object to processing in certain circumstances. That includes analytics, which you can opt out of at any time as described in section 3. For email, you can withdraw your consent through the preferences link in any newsletter or by asking us.

To exercise any of these rights, email us. If you live in the European Economic Area, you may also lodge a complaint with your national data protection authority, such as the Dutch Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

8. Changes to this policy

We update this policy when the service changes. The date at the top of this page always reflects the current version, and continued use of the service after a change means you accept the updated policy.

9. Contact

Email us at [email protected]. One address covers everything: a question about this page, a request about your data, or anything to do with a payment, an invoice or a refund. Where only the seller of record can act, we arrange it with Link for you.