Privacy

Vaya Privacy Policy

Last updated:

Welcome to Vaya. We value your trust and are committed to protecting your privacy and personal data. This Privacy Policy explains what information we collect, how we use and protect it, and who sees it, when you use our website and our interior design services.

Contents
  1. 01Information we collect
  2. 02How we use your information
  3. 03AI technology and image processing
  4. 04Who sees your data
  5. 05Protecting your pictures and private spaces
  6. 06Data security
  7. 07Your rights (control over your data)
  8. 08Who runs the platform and how to reach us
  9. 09Changes to this policy

Information we collect

We collect only what we need to design for you and keep your work:

Account information
Your email address, your name if you give it, and your password, which we store scrambled so that nobody can read it. If you sign in with Google we take only your name and email from it. We do not ask for a credit card to sign up.
What you upload and write
The pictures, sketches, plans, photos of your room, product photos and 3D model files you upload, the measurements, the descriptions, and your messages in the chat with the AI designer.
What we make for you
The plans, pictures, 3D rooms and versions of your design, and your notes on the project.
Credits and requests
Your balance and its history, your plan, your plan requests and what our team records when it activates them (the amount and a note).
Support
The help requests and complaints you send and our answers.
Technical data
IP address, browser type and sign-in times, to protect your account (limits on sign-in attempts, security alerts) and to keep you signed in. Your browser keeps cookies for your session, language and appearance, some of your choices on this device, and the two invite-link cookies described in the next point. We use no third-party tracking or advertising tools.
Invite links
These apply only while we have the invitation programme switched on. If you open an invite link from another client, your browser gets a cookie named iv_dev: a random number that carries neither your name nor your email, kept for one year; the link's owner gets the same cookie when they copy or open their own link. If you are not signed in, a second cookie, iv_ref, holds only the invite code for 30 days, so we know who invited you when you create your account. If you create your account through the link, the invitation record keeps the IP address you signed up from and that browser number; for the link's owner we keep the last 12 IP addresses and the last 12 browser numbers seen when they open My account or open or copy their link. The purpose is one: no one earns the reward by inviting a second account of their own. For that we compare these addresses and numbers, together with the email addresses, the IP addresses we already keep from the link owner's sign-up and payments, and the masked card number of the first payment. We never use them for tracking or advertising. If you delete your account we erase these IP addresses and browser numbers from your invitation records; only who invited whom and what credit was given stay, so a reward is never paid twice.

How we use your information

We use the data we collect only to:

Deliver the service
Design your room from what you send, build it in 3D and change the design as you ask.
Improve the platform
Look at how the tools are used so we can improve them and fix their faults.
Communicate
Email you about your designs (ready or failed), your plan and answers from support. You choose what you receive under My account → Email notifications.
Payment
You pay by card on Al Rajhi Bank's secure page; you type your card number at the bank and it never reaches us. For each payment we keep the amount, its outcome, the bank's references, the card type and its masked number (first six and last four digits), and your IP address at checkout (the bank requires it).

AI technology and image processing

We design with the help of AI models run by outside providers:

Who processes your request
Your descriptions, pictures and messages are sent over an encrypted connection to OpenAI (making pictures and text, reading pictures) and to Replicate (reading the depth of a room, building 3D models), solely to make your design.
What the providers keep
These providers process requests under their own terms and may keep them for a limited period (for example to prevent abuse) before deleting them under their own policies. Deleting your account with us does not delete what they kept of earlier requests.
Training
We do not use pictures of your spaces or rooms to train AI models.
Shared 3D pieces
Every 3D piece the platform makes for a design from your description is stored in the platform's library and may be offered in every client's catalogue and used in their designs. What they get is the 3D model itself (its shape and material) only, never your pictures, your name or your project. A piece made from your own photos — a product photo you upload, or the photos of your real room — stays yours alone: it is not offered in other clients' catalogue or used in their designs, and only you, the people you share the project with and the platform team can open its file.

Who sees your data

Vaya does not sell your personal data or the pictures of your spaces to anyone. Your data is seen or sent only in these cases:

Service providers
Those who run the platform for us: hosting (Render), the database (Neon), file storage (Cloudflare R2), email (Brevo), Google sign-in if you choose it, and the two AI providers named above, and card payments (Al Rajhi Bank). Each receives only what its service needs.
People you share a project with
Whoever joins through a share link you created sees the project and can edit it, including the 3D room, the plan, the name and the pictures. Your notes on the project stay yours alone. You can stop the link and remove anyone at any time.
The platform's team
Authorised staff see your account and projects when they help you, look into a complaint or protect the platform.
The gallery (your choice)
If you publish a design in the gallery, the pictures you choose, the description and your display name become public, and anyone signed in can start a project from a copy of the design. The copy holds the 3D room with its materials and pieces, the pictures you chose, and the generated picture the room was built from (which may show your room if you designed from its photos). It never holds what you uploaded — photos of your room, plans, sketches, photos of pieces, your own 3D models — nor your notes. Each copy gets its own files and stays with its owner. Unpublishing stops it from showing and deletes its shared files that no copy needs. Copies taken before 13 October 2026 may also hold the photos of your room, as this text said before.
Legal compliance
When required by law or in response to lawful requests from competent government authorities.

Protecting your pictures and private spaces

We know how sensitive the pictures and plans of your home are. The pictures and files you upload stay with your account: you see them, so do the people you share the project with, and our team when needed. We never show them to other clients or use them for marketing or as the platform's past work, unless you publish the design in the gallery yourself and agree to it. Files travel over an encrypted connection (HTTPS) and are kept by a storage provider that encrypts them.

Data security

We use encrypted connections, scrambled passwords, short sign-in sessions that renew, limits on sign-in attempts and security alerts for our team, to protect your data from unauthorised access, alteration or destruction.

Your rights (control over your data)

Your data is yours to control. At any time you may:

  • See and edit your data and the pictures you uploaded, from My account and your projects.
  • Delete a project: it moves to Deleted for 10 days, during which you can restore it, and is then deleted for good with its pictures, files and versions.
  • Delete your account from My account: we delete your projects, your uploaded files, your sessions and your account from our servers, and take what you published out of the gallery.
  • Choose which emails you receive, under My account → Email notifications.

What stays after a deletion: the history of your credits without your name (for accounting), security logs, support conversations, who invited whom and the credit it gave (without IP addresses or browser numbers), the 3D pieces already in the platform's library, copies others started from a design you published, and what the AI providers kept of earlier requests under their own terms.

Your data, your call

From My account you can edit your details, or delete your account and everything you uploaded.

Open my account

Who runs the platform and how to reach us

For any question about your privacy or a request about your data, write to us from Support in your account, or by email or phone:

Changes to this policy

We may update this policy from time to time to keep up with technical or legal developments; the date of the last change is shown at the top. We will tell you about any material change by email or through a clear notice on the platform.