English Türkçe العربية

Unempty Privacy Policy

Effective date: [FILL: effective date]
Version: 1.0-draft
Operator ("we", "us"): Photoreal3d LLC, a company registered in the Ras Al Khaimah Economic Zone (RAKEZ), United Arab Emirates. [FILL: licence number]. [FILL: registered address].
Contact for privacy requests: [FILL: privacy@unempty.app or support@unempty.app]

Summary

This table is a plain-language overview. The full sections below control if there is any difference.

1. Who we are

Photoreal3d LLC ("Photoreal3d", "we") operates the Unempty iOS app and the website unempty.app. We are the data controller for the personal data described in this policy (under GDPR and UK GDPR terminology) and the "business" under the California Consumer Privacy Act.

• Registered office: [FILL: RAKEZ address, Ras Al Khaimah, UAE]
• Privacy contact: [FILL: email]
• [LAWYER] Data Protection Officer: we believe no DPO is mandatory under GDPR Art. 37 (no large-scale monitoring or special-category processing), under UAE PDPL (Art. 10 requires a DPO for high-risk / large-scale processing) or under KSA PDPL. Confirm, and decide whether to appoint one voluntarily.
• [LAWYER] EU representative (GDPR Art. 27) and UK representative (UK GDPR Art. 27): we are established outside the EU/UK and offer the app to people there. Unless the "occasional processing" exemption applies, we must name a representative here. See §12.

2. What we collect, and where it comes from

We collect only what the app needs to work. We never ask for your name, phone number or address.

We do not collect: your photo library (we use Apple's out-of-process picker, so the app never sees photos you did not pick), your contacts, precise or coarse location, your device's advertising identifier, or any health, financial or biometric data.

3. How we use your data, and on what legal basis

What we never do: train or fine-tune AI models on your photos or results; use your rooms in our marketing or screenshots (our marketing images come from rooms we photographed ourselves); sell or rent your data; show advertising; build profiles for advertising; share your photos with anyone except the processors in §4.

Quality testing. Our internal quality test set ("eval set") contains only photos we took ourselves. We do not add users' photos or results to it. If we ever want to, we will ask you separately with a clear opt-in that is not bundled with anything else. (Spec 001 FR-20 says reported results are "excluded from any future eval set"; that wording must not be read as permission to include unreported ones — flagged as item A6 in apple-review-checklist.md.)

4. Who we share data with (processors)

We share data only with the companies below, each of which processes it on our instructions under a data-processing agreement. None of them may use your data for their own purposes except as stated.

We do not use any advertising SDK, social-media SDK or data broker.

Authorities: we may disclose data if a law, court order or lawful request obliges us to, or to protect the safety of a person or the integrity of the service. We will tell you when the law lets us.

Business transfer: if Photoreal3d LLC is sold or merges, your data may move to the new owner under this same policy; we will notify you in the app before that happens.

5. AI processing and your consent

Before your first upload, the app shows a consent sheet that names Google, lists exactly what is sent (photo, room type, notes), states the purpose and links to this policy. Nothing leaves your device until you tap Allow. If you tap Not now, you can still browse the app but cannot generate images.

Withdrawing consent. Settings → AI processing → Off. Generation stops until you turn it back on; nothing already generated is affected. [OWNER/spec] This toggle is proposed in spec 001 §8 Q12 and item A4 of the review checklist; if it does not ship in T-043, change this paragraph to "email us to withdraw consent" before publishing.

What the AI does with your photo. Google's model reads your photo and our instructions and returns a new image. Google's paid API does not use your content to train its models (§4). Google keeps a short-term log for abuse detection. Our server keeps the result and the technical scores described in §2.

Provenance marks. Every image Google generates carries an invisible SynthID watermark (Google Gemini API documentation, read 2026-09-05). We never remove it. Free-tier results also carry a small visible "Made with Unempty AI" mark; listing exports carry a visible "Virtually staged" label by default. Together these are how we mark AI-generated images as required by the EU AI Act (Regulation (EU) 2024/1689) Art. 50(2), applicable from 2 August 2026: machine-readable in the pixels, and visible on anything meant for a listing. Marking is not personal data about you and is never used to identify you; it says of the image itself that it was generated by AI. Our Terms §6 explain what it means for you when you publish a result.

Automated decisions. The app makes two automated calls that affect what you see: it proposes a room type and mode (you can change both), and it runs a structure check that may reject a result (you are not charged and can retry). Neither produces legal or similarly significant effects on you (GDPR Art. 22). [LAWYER] confirm.

6. International transfers

Your data is stored in Ireland (Supabase). It is transferred outside the EU/UK/UAE/KSA/Turkey when:

• Google processes your photo (Google may use facilities in any country, including the US);
• RevenueCat processes purchase data (US);
• Supabase support staff or sub-processors access data from outside the EU;
• [FILL] Sentry / support email provider, if outside the EU.

Safeguards we rely on [LAWYER — confirm each]:

Because Photoreal3d LLC is itself in the UAE, the transfer from the EU to us (the controller) also needs a mechanism. [LAWYER] Options: Art. 49(1)(b) (necessary for the contract with the user) for the core service, or SCCs are not available controller-to-self; confirm the position and the wording. Note that the data itself sits in Ireland and we access it from the UAE.

7. How long we keep data

Account deletion. Settings → Delete account & data calls our delete-account function, which removes your account rows, projects, jobs, credit ledger, reports and every stored file (originals, results, exports) within 24 hours, deletes your RevenueCat customer record and your PostHog person together with its events, and deletes your authentication user. If a generation is still running when you ask, the deletion completes automatically as soon as it has finished. It works for anonymous accounts too. Deleting the app alone does not delete server data; an anonymous account you never delete keeps its data until you delete it [LAWYER/OWNER] — consider an inactivity rule (e.g. purge anonymous accounts with no activity for 12 months) and state it here. Unused credits and active subscriptions are forfeited on deletion; cancel the subscription with Apple first, or it will keep renewing (Terms §8).

8. Your rights

You can exercise any right below from Settings (delete, withdraw AI consent, analytics toggle) or by emailing [FILL: privacy email]. We answer within one month (GDPR/UK GDPR; extendable by two months for complex requests), 45 days (CCPA, extendable once), 30 days (Turkey KVKK Art. 13), or the shorter period local law sets. We may ask you to prove you control the account (for anonymous accounts, this means making the request from inside the app). We do not charge for requests unless they are manifestly unfounded or excessive.

Everyone: access a copy of your data; correct it; delete it; object to or restrict processing based on legitimate interest; withdraw consent at any time (without affecting earlier processing); receive your photos and results in a portable format (they are already saved to your Photos when you tap Save); complain to a supervisory authority; not be discriminated against for exercising these rights.

EU/EEA (GDPR) — rights under Arts. 15–22. Supervisory authority: the authority in your member state (list: edpb.europa.eu), or the Irish Data Protection Commission where data is hosted [LAWYER — lead authority does not apply to a non-EU controller; users complain to their local authority]. Our EU representative: [FILL / LAWYER, §12].

United Kingdom (UK GDPR / Data Protection Act 2018) — same rights; complaints to the Information Commissioner's Office (ico.org.uk). Our UK representative: [FILL / LAWYER].

California (CCPA/CPRA) — see §11.

United Arab Emirates (Federal Decree-Law No. 45 of 2021, PDPL) — rights to access, correction, erasure, restriction, objection to automated decisions, data portability and to withdraw consent; complaints to the UAE Data Office. [LAWYER] confirm the PDPL applies to Photoreal3d LLC as a RAKEZ (non-financial free zone) entity — the law excludes only DIFC and ADGM regimes — and whether its executive regulations are in force (not confirmed as of 2026-09-05 [unverified]).

Saudi Arabia (PDPL, Royal Decree M/19 as amended by M/148; in force 2023-09-14, grace period ended 2024-09-14) — the law applies to "processing of personal data related to individuals residing in KSA by any means by any entity outside KSA" (DLA Piper summary, updated 2026-02-11). Rights to be informed, access, obtain a copy, correction, destruction; complaints to SDAIA. [LAWYER] confirm whether registration on SDAIA's National Data Governance Platform or a local representative is required for a foreign controller, and the consent wording needed for our processing.

Turkey (Law No. 6698, KVKK) — rights under Art. 11: learn whether your data is processed, request information, learn the purpose, know the recipients in Turkey and abroad, request correction or erasure, object to results produced by automated analysis, claim compensation for unlawful processing. Requests per the Communiqué on Application Procedures (in writing or via a method the Board accepts). [LAWYER/OWNER] (a) A Turkish-language information notice ("aydınlatma metni") meeting Art. 10 must be shown to Turkish users — the TR localisation of this policy should be reviewed for that; (b) determine whether we must register in VERBIS via a Turkish representative (Art. 16) or fall under an exemption.

Canada (PIPEDA) — rights of access and correction; complaints to the Office of the Privacy Commissioner. [LAWYER] Quebec Law 25 additional requirements (privacy officer named, privacy impact assessment for transfers outside Quebec) [unverified].

GCC other (Qatar, Kuwait, Bahrain, Oman) — Qatar Law No. 13 of 2016, Bahrain PDPL Law No. 30 of 2018, Oman Royal Decree 6/2022, Kuwait CITRA regulations [unverified, not researched]. [LAWYER] decide whether the general rights section suffices at launch.

9. Security

• All traffic uses HTTPS/TLS. Photos are uploaded to a private bucket through a short-lived signed URL tied to your session.
• The app never contains AI-provider or database service keys; every generation goes through our server with your authenticated session.
• Row-level security in our database means each account can read only its own rows.
• GPS metadata is stripped on your device before upload.
• Access to production data is limited to [FILL: number] named people at Photoreal3d LLC with two-factor authentication.
• If a breach affecting you occurs, we will notify the competent authority within 72 hours (GDPR/UK GDPR Art. 33), the UAE Data Office and SDAIA within the periods they set [LAWYER] (KSA: 72 hours [unverified]), and you without undue delay where the risk to you is high.

10. Children

Unempty is not directed at children. You must be at least 13, and at least 16 if you live in an EU/EEA country that has kept the GDPR default (GDPR Art. 8(1): lawful from 16; member states may lower it to no less than 13). The UK sets 13 (Data Protection Act 2018 s. 9 [unverified today — ICO page not reachable]). [LAWYER] provide the per-country table for the EU launch storefronts (DE 16, FR 15, ES 14, IT 14, PT 13 — from memory [unverified]) and confirm the ages for UAE, KSA and Turkey (KVKK has no specific digital consent age; Turkish Civil Code majority is 18 [unverified]). If we learn we hold data of a child below the applicable age without a parent's consent, we delete it; email [FILL] to tell us.

We do not knowingly sell or share the personal information of anyone under 16 (CCPA).

11. California privacy notice (CCPA/CPRA)

[LAWYER] The CCPA applies to for-profit businesses that "have a gross annual revenue of over $25 million", "buy, sell, or share the personal information of 100,000 or more California residents or households", or "derive 50% or more of their annual revenue from selling California residents' personal information" (California AG, page updated 2026-08-28). We expect to be below all three thresholds at launch; we provide this notice anyway and follow its rules voluntarily. Confirm and revisit when revenue or user counts approach the thresholds.

Categories of personal information collected in the last 12 months (Cal. Civ. Code §1798.140(v)): identifiers (account id, Apple user id, hashed Apple id, email if you share it, analytics id, IP address); commercial information (purchases, credits); internet or electronic activity (app usage events, server logs); audio/electronic/visual information (your room photos and the images we generate); inferences (detected room type — an inference about the photo, not about you). Sensitive personal information: none intended; a photo could incidentally show something sensitive — we use it only to generate your image.

Sources: you, your device, Apple, RevenueCat. Business purposes: those in §3. Disclosed to service providers: those in §4. Sold or shared for cross-context behavioural advertising: none, never. We do not use or disclose sensitive personal information for anything other than providing the service. Because we do not sell or share, no "Do Not Sell or Share My Personal Information" link is required [LAWYER] confirm; we honour Global Privacy Control signals to the extent they reach an app [LAWYER].

Your rights: know, delete, correct, opt out of sale/sharing (not applicable), limit use of sensitive PI (not applicable), non-discrimination. How to exercise: in-app (Settings) or [FILL: email]; an authorised agent may act for you with written permission. We respond within 45 days. Retention: §7.

Other US states (Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and others): equivalent rights where those laws apply to us; thresholds not assessed [LAWYER].

12. Representatives and authorities

13. Changes to this policy

We will post changes here with a new effective date. For material changes (new processor, new purpose, new retention), the app shows a notice on next launch and, where the law requires it, asks for your consent again. Previous versions: [FILL: link to /privacy/archive on unempty.app].

14. Contact

Photoreal3d LLC, [FILL: address], RAKEZ, Ras Al Khaimah, United Arab Emirates. Email: [FILL: privacy email]. Support: [FILL: support email] / unempty.app/support.