Privacy Policy

1. Who we are

Moom is provided by Moom Studio, business ID 3574935-3, Päivärinnankatu 4 A 8, 00250 Helsinki, Finland (“Moom”, “we”, “us”). We are the controller of the personal data described in this policy.

Our affiliate Moom Stu Co., Ltd. in Thailand helps develop and run Moom and processes personal data for us under a written agreement. If you pay in Thai baht and your checkout or invoice names that company, it is the controller of your billing data for that purchase.

For privacy questions or requests, email hello@moom.studio.

2. What we collect

Account details

• Your name, email address, and company name if you give one.
• Your password, which our authentication provider stores in hashed form. We never see it.
• If you sign in with Google, your name, email address and profile picture from your Google account.
• Whether you agreed to receive product news, and when you accepted our Terms.

Content you upload or create

• Floor plans, PDFs, site photos and other references, your markups and notes, instructions you give the AI, and the 2D layouts, 3D models and exports made from them.
• Your content may itself contain personal data, for example names or addresses on drawings, or people in photos. Please upload only what you need.

Billing details

• Your plan, credit balance and usage history, and your billing name, address and VAT ID.
• Card and bank details are collected and held by our payment processor. We don’t receive full card numbers.

Usage and technical data

• Which AI actions you run and the credits they use.
• How long you are active in the workspace, in categories such as uploading, editing or reviewing.
• Your IP address, browser and device type in server logs, and security checks that protect sign-up and sign-in from bots.
• On our public pages (home, pricing, sign-in, sign-up and these legal pages): which pages you visit, how you arrived, for example from a search or one of our emails, and your approximate location and device, through Google Analytics (see section 11). Nothing inside the app or your projects is measured this way.
• Inside the app (your projects dashboard, the workspace and Account settings): which pages and buttons you use, and recordings of the screen around your model, through our usage analytics (see section 6). Your plans, models and anything you type are not recorded.

Support and collaboration

• Messages you send through the in-app support chat, with your email address and device type.
• Your team membership and the invite, share and partner links you create or use.

3. How we use it and why

Under the EU General Data Protection Regulation (GDPR), we use personal data only when we have a legal basis to do so:

We don’t sell your personal data or use it for third-party advertising.

4. How AI processes your content

When you run an AI action, such as finding an outline, generating or refining a model, or Edit with AI, the relevant plans, photos, notes and model data are sent to our AI provider to produce the result. Steps that don’t use AI, such as confirmations, direct edits, building the basic shell and exports, run on our own servers.

Our AI provider processes this data for us under a data processing agreement and does not use our customers’ data to train its models. It may keep requests for a limited time, currently up to 30 days, to run the service and monitor abuse.

AI results are suggestions for you to review. No decisions that have legal or similarly significant effects on you are made solely by automated means.

5. Improving Moom

To make reconstruction more accurate, we may use uploaded plans and photos, and the layouts and models made from them, to test and improve Moom. This includes building test sets, measuring accuracy and refining how we instruct AI models. Before we do, we remove account details such as your name and email, and we keep the data inside Moom and its processors.

This data is never sold, never shared with other customers, and never shown publicly. We don’t allow AI providers to train their general models on it.

You can opt out at any time: in Account settings → Privacy, switch off Help improve Moom. From then on, your content is no longer selected for this use, and copies already in our test sets are removed when you ask us to.

6. Usage analytics

To see where people get stuck, we use a product analytics service, hosted in the EU, inside the signed-in app: your projects dashboard, the workspace and Account settings. It records which pages you open, which buttons and menus you click, and a recording of the screen so we can replay how a session went.

• Not recorded: the 3D view and floor plan canvas (so your plans and models never appear in recordings), anything you type into a field, files you upload, and names and email addresses shown in Account settings.
• Not identified by name: the service receives a random code for your account, never your name or email address.
• Nothing stored on your device: it sets no cookies and uses no local storage.
• Never used on our public pages, on share links or for advertising.

You can opt out at any time: in Account settings → Privacy, switch off Usage analytics. From then on, the analytics service isn’t loaded for your account.

7. Who can see your data

People you choose

• Share links: anyone with a project’s view-only link can view that whole project until you revoke the link.
• Teams: members of a team can open, edit and export the team’s projects, and the team owner can see members’ credit usage.
• Partner links: the partner who invited you can see which floors were used under the partner preview.

Service providers (processors)

We use these types of providers to run Moom. Each may use the data only to provide its service to us, under a written agreement. A current list of our service providers is available on request.

Our payment processor, and Google if you sign in with it, are also independent controllers of some data under their own privacy policies.

We may also disclose data when the law requires it, to protect our rights or users’ safety, or as part of a merger or sale of our business. In a sale, this policy would continue to apply to your data.

8. International transfers

Most of our providers store or process data in the United States. Where we transfer personal data outside the European Economic Area, we rely on the EU–U.S. Data Privacy Framework for certified providers, or on the European Commission’s Standard Contractual Clauses with additional safeguards where needed. To get a copy of the relevant safeguards, contact us.

9. How long we keep data

• Account data and content: for as long as your account is open. Deleted projects and floors stay restorable from your dashboard until your account is deleted or you ask us to erase them permanently. You can also delete a project permanently from your dashboard: its content is erased, and we keep only its name and usage facts with your billing records.
• Account deletion: email hello@moom.studio from your account’s address. We erase your account and content within 30 days, and copies in backups expire within a further 30 days. Team projects belong to the team, so they stay with the team after you leave it.
• Billing records: for as long as Finnish accounting and tax law requires, currently up to 10 years.
• Support conversations: while your account is open, then deleted with it.
• Usage analytics: screen recordings for up to 90 days, and page and click events for up to 12 months.
• Server logs and security data: for a short period, normally no more than 90 days.

10. Your rights

You have the right to:

• access your personal data and get a copy of it;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to our use of it, including use based on legitimate interests such as improving Moom;
• receive data you gave us in a portable format;
• withdraw consent at any time, for example to marketing emails.

Email hello@moom.studio to use any of these rights. We reply within one month, and may need to confirm your identity first. You can also export your models from the app, as your plan allows.

You can complain to a data protection authority. In Finland this is the Office of the Data Protection Ombudsman. You can also complain to the authority where you live or work.

11. Cookies and local storage

Moom uses only what it needs to work:

• a sign-in session cookie, and sign-in tokens stored in your browser;
• preferences stored in your browser, such as units, view settings and your last-opened floor;
• a security check from our bot-protection service on the sign-up and sign-in pages.

These are strictly necessary, so we don’t ask for consent for them. If you block them, sign-in and some features won’t work.

Analytics cookies, only with your consent

On our public pages (home, pricing, sign-in, sign-up and these legal pages) we use Google Analytics to understand how people find and use the site. Google Analytics sets its cookies (_ga and _ga_*, kept for up to 2 years) only after you click Accept in the cookie banner. Until then, or if you click Decline, it sets no cookies and sends Google only anonymous signals without identifiers. Google Analytics never runs inside the app or on share links.

Our usage analytics inside the app (section 6) sets no cookies and stores nothing on your device.

You can change your choice at any time with Cookie settings at the bottom of our public pages. We don’t use advertising cookies.

12. Security

We protect data with encryption in transit, access controls, and private file storage that is reachable only through Moom after a sign-in or permission check. Only staff who need access, for support or to fix problems, can open customer projects. No system is perfectly secure. If a breach puts your rights at risk, we will tell you and the authorities as the law requires.

13. Children

Moom is not intended for anyone under 16, and we don’t knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

14. Changes to this policy

We may update this policy as Moom changes. If the changes are significant, we will notify you by email or in the app before they take effect. The date at the top shows when this policy was last updated.