Privacy Policy

Effective date: October 31, 2026

In short: We use your room photos only to create your designs. We do not use cookies, tracking or advertising, and we do not load fonts or scripts from third-party servers (exceptions only when you click: the PayPal button and tapping objects in a photo). You can delete any design at any time, and your account too; we then delete the image files as well. We automatically delete free designs after 14 days unless you have an active Plus plan. We do not sell or share your personal information.

1. Who is responsible

Vaydena – Softwarelösungen
Karl-Heinz Bicker
Biberstraße 27, 85354 Freising, Germany
Email: kontakt@vaydena.de

2. What we collect

Account

• Email address and password. We store the password only as a bcrypt hash, never in plain text.
• Optionally a display name (“What should we call you?”).
• Plan and term (Free, Plus or Business, and until when).
• One session per login. For each, we store a hash of the session key, the browser identifier (user agent) and the expiry date.
• Where needed, our internal notes on your account, for example about a support request or a payment. They are deleted with the account.
• Guest access (only when we have switched on “Free without signing up”): If you try NextLook without signing up, we create an anonymous guest account, without an email address, with a random placeholder ID and a session lasting at most 30 days. Your designs belong to this guest account. To prevent abuse, we count new guest accesses per IP address (as we do for login attempts). The guest account and its designs are deleted when you end guest access, otherwise automatically one day after the session expires, or after two days if you have not created a design. If you create an account from guest access, we move the designs to your account.
• Look & Style is not offered at present. No photos of people are needed for NextLook, and we ask you not to upload them (see section 9).

Your designs

• Room photo: The photo you upload. It is resized in your browser to at most 1600 pixels and re-saved as a JPEG. Embedded camera data (EXIF, such as a GPS location) is lost in the process.
• Brush mask: If you change only one area, the area you marked.
• Reference photo: If you borrow a style from an example image, that image.
• Design inputs: Room type, style, budget level and your note (at most 300 characters).
• Usage right: Whether a design was created during a Business period and may therefore be used commercially (Terms, section 6).
• Result: The generated image and a small preview image.

Abuse protection

• IP address when creating a design: We use it to limit free designs per internet connection and day and to credit back correctly after a failure.
• Login attempts: Email address, time, success and IP address. We use them to detect password guessing.
• Voice commands: Per account and day, only the number of requests, without content (see section 4, voice commands).

Payments

• Plan, amount, payment method (PayPal), booking date, number of designs booked and the email address at the time of booking.
• Payment through the PayPal button in your account: Chosen plan, amount, the order and payment ID from PayPal, payment status, the time of your consent to immediate start of service and the time of booking. With these we check with PayPal that exactly this amount was paid, and we activate Plus or Business automatically. We do not see your PayPal login details or payment method.

3. Why we use your information

• Providing the app, account, designs, plan and payments: to deliver the service you asked for.
• Abuse and cost protection and security of the service (IP limits, login attempts, server logs): our legitimate interest in keeping free use fair and protecting accounts from unauthorized access.
• Keeping booking records: to meet legal tax and accounting obligations.
• Account emails (for example a link to reset your password): to provide the service. We send no newsletters and no advertising.
• Reminder before Plus ends: A few days before your Plus period ends, we send you one email per period with the end date and your remaining design credit. For this we note for which period we have already reminded you.

4. How the AI processes your images

A generative AI image model creates the designs. We use it through the service kie.ai. For each design we send kie.ai:

• time-limited links (valid for 1 hour) to your room photo and, if used, to your mask and reference photo;
• a job description in text form. It contains your design inputs and your note, but neither your email address nor your name.

We copy the finished image to our own storage right away (see section 5). From then on, NextLook shows you only that copy.

Important: kie.ai may process your images outside the United States and outside the European Union. How long kie.ai keeps images and jobs, and whether it reuses them, depends on kie.ai’s own terms. We have no influence over that. Please upload only photos you are comfortable with. Photos should not show people, ID cards or documents, screens with personal data, or house numbers or license plates.

Voice commands, conversation and tapping

In Command mode you say or type what should change. This is what happens:

• Speech recognition: The microphone uses your browser’s speech recognition. It runs only after you tap the microphone button and stops after your sentence. Depending on the browser, it sends the recording to its provider for this (to Google in Google Chrome), which processes it under its own terms. We do not receive the recording, only the recognized text. Instead of speaking, you can also type.
• Analysis: We send your command as text and some details about the edit (area, room type, whether a marking, a reference photo or a result exists, names of recognized objects) to our server function. From there it goes to a language model (Google Gemini) that we use through kie.ai. For “ideas,” conversation mode and the numbered object list, a downsized copy of the current photo (at most 1024 pixels) is also sent, and in conversation mode also the last messages of the conversation (at most 6). Your email address and name are not sent.
• Photo for the language model: We place it in our non-public storage only for the duration of the request (signed link, valid for 10 minutes) and delete it right afterward. If a file is ever left over, we remove it automatically during later requests.
• What we store: We do not store commands, photos or answers from the language model, not even in logs. We only count how many voice requests your account makes in a day. This counter is deleted after 7 days.
• Room suggestion: If you upload an interior photo and have not yet chosen a room, we send a downsized copy (at most 1024 pixels) and the list of room types to the language model the same way. It returns only the matching room type. The previous point applies to the photo.
• Image steps: An image is created only after you confirm the plan with “Yes, go.” Each step is then a regular design, and the step’s text becomes its note. Everything above in this section and in section 6 applies.
• Tapping: When you tap an object, an AI model (SlimSAM) recognizes it directly in your browser. The photo does not leave your device for this. On the first tap, your browser loads the program from jsDelivr (cdn.jsdelivr.net) and the model (once, about 20 MB) from Hugging Face (huggingface.co). These providers receive technical data such as IP address and browser. Your browser keeps the model in its cache for later. If you do not use tapping, none of this is loaded.
• Read aloud: If you switch on “Read aloud,” the app uses your browser’s speech output. Depending on the voice, the browser may send the text to its provider.

5. Service providers and where data is stored

• Website hosting: Hostinger. Hostinger delivers the pages of nextlook.vaydena.com. Technically necessary server logs are created (for example IP address, time, requested file).
• Database, file storage and server functions: Supabase. Account, designs, images and payments are stored in a Supabase project in the Frankfurt am Main (Germany) region. The images are in non-public storage. They can be retrieved only through short-lived, signed links that only you get after logging in.
• Email delivery: Hostinger. We send account emails through Hostinger’s mail server.
• AI image model and language model: kie.ai (see section 4).
• jsDelivr and Hugging Face, only if you tap an object: Your browser loads the program and recognition model from them once (see voice commands).
• PayPal, only if you pay with PayPal. PayPal processes the payment on its own responsibility and under its own privacy policy. We see only what PayPal shows us about the payment. We load the PayPal button in your account only when you click “Pay with PayPal – activated instantly”; only then does your browser fetch scripts from PayPal (paypal.com). PayPal receives technical device data (for example IP address and browser) as well as the amount and order number.

Transfers. We operate from Germany, and your data is stored in Germany (EU). By using NextLook you understand that your information is transferred to and processed in Germany and the European Union, and, by providers such as kie.ai, PayPal, jsDelivr and Hugging Face, in other countries, including the United States, which may have different data protection laws than your state or country.

6. How long we keep data and how it is deleted

Deleting a design: We delete the image files (photo, mask, reference, result, preview) as well as the note and the job description. What remains is only an entry without image and text (for example time, plan, room type, style). It continues to count toward your allowance so that deleting does not unlock a new free design.

Free designs after 14 days: If you have no active Plus, we automatically delete free designs (including bonus designs) 14 days after creation. This runs once a day and works exactly like “Delete design”: photos, mask, reference, result and preview, the note and the job description are deleted. The entry without image and text remains, for our statistics and your daily allowance. Designs you created with Plus or Business are not affected. While your Plus is active, your free designs are kept as well. We never delete a design that is still being generated. If you want to keep a free design, download the image beforehand.

Deleting your account (under “My account,” with your password): We first delete all your image files. Then we delete your account with all designs, sessions, login attempts and incomplete PayPal payments. Only the booking records of paid payments remain, because of legal retention obligations. They are then no longer linked to any account but still contain the email address from the time of booking.

At kie.ai: We cannot delete what kie.ai itself keeps (see section 4).

7. Storage in your browser

NextLook does not set cookies. To keep you logged in, the app stores your session key and a copy of your account details in your browser’s local storage (localStorage) (rw.token, rw.user). If you dismiss the prompt to install the app, it remembers that for 14 days (hf_install_snooze). Your settings for voice commands (“Read aloud,” “Conversation mode”) are remembered under rw-vc-tts and rw-vc-talk. So that the app starts faster and also opens offline, a service worker keeps the program files in the browser cache. Your photos and designs are not part of it. If you use tapping, your browser also keeps the recognition model there. This storage is strictly necessary for the service. When you log out, we delete the session key and the account copy. You can clear everything else in your browser settings.

We use no analytics or tracking tools, no advertising networks, no social media plugins and no fonts or scripts from third-party servers. The only exceptions are on your click: the PayPal button (section 5) and tapping objects (section 4, voice commands). Because we do not track you across sites, we do not respond to “Do Not Track” signals in any special way.

8. Your rights and choices

You can ask us for access to the personal information we hold about you, to correct it and to delete it. Under “My account” you can download your data as a file at any time (“Download my data”) and delete your account yourself. For anything else, send a message to kontakt@vaydena.de. We will not treat you differently for exercising these rights. If an authorized agent makes a request for you, we may ask for proof of authorization and of your identity.

Notice for California residents (CCPA/CPRA)

We do not sell your personal information and we do not share it for cross-context behavioral advertising. We do not knowingly sell or share the personal information of anyone under 16. In the past 12 months we have collected the categories described in section 2 (identifiers such as email address and IP address; commercial information such as plan and payment records; internet and device information such as user agent; and images you upload), for the purposes in section 3, and disclosed them only to the service providers listed in section 5. California residents have the right to know, access, correct and delete their personal information, to opt out of sale or sharing (not needed, since we do neither), to limit the use of sensitive personal information (we do not use it beyond providing the service) and not to be discriminated against for exercising these rights. To use these rights, email us at kontakt@vaydena.de.

Biometric information

NextLook does not collect biometric identifiers or biometric information. We do not recognize or identify people and do not store facial features. Look & Style, a feature that involved photos of people, is not offered at present. If it is offered again, we will update this policy first.

9. Photos of other people

NextLook is meant for rooms, exteriors and yards, not for people. Please do not upload photos in which other people can be recognized, and no photos of other people’s homes without the residents’ permission.

10. Children

NextLook is not directed to children under 13, and we do not knowingly collect personal information from children under 13. Only people who are 18 or older may create an account. If you believe a child has given us personal information, contact us at kontakt@vaydena.de and we will delete it.

11. Changes

If the service or the law changes, we will update this policy. The version published here applies, together with its effective date.