Privacy Policy — RoomGPT

Last updated: 26 May 2026

This Privacy Policy explains how Hbrothers L.L.C., trading as Hbro Studio ("we," "us," "our"), collects, uses, shares, and protects personal data when you use the RoomGPT mobile application (the "Service").

This policy is specific to RoomGPT. It does not cover any other application we publish.

1. Quick summary

2. Who we are

Controller

Hbrothers L.L.C., trading as Hbro Studio 412 W 7th St, Clovis, NM 88101, United States Email: info.hbrothers.llc@gmail.com Website: https://www.hbro-studio.com

Hbrothers L.L.C. is the data controller for personal data processed in connection with RoomGPT.

EU Representative (Article 27 GDPR)

We have appointed the following representative in the European Union under Article 27 of the EU GDPR. EU-based users may contact this representative directly on all questions concerning the processing of their personal data:

Thibault Mundele Rua Pinto Ferreira 56, 1D 1300 Lisbon, Portugal Email: info.hbrothers.llc@gmail.com

UK Representative (Article 27 UK GDPR)

We are in the process of appointing a UK representative under Article 27 of the UK GDPR. In the interim, UK-based users may contact us at info.hbrothers.llc@gmail.com for all questions concerning the processing of their personal data. This section will be updated once the UK representative is in place.

Privacy contact

For any privacy-related question or to exercise the rights described in Section 10, contact us at: info.hbrothers.llc@gmail.com

We do not have a formal Data Protection Officer, because RoomGPT's processing does not fall within the categories listed in Article 37(1) GDPR. The address above is our designated privacy point of contact.

3. What this policy covers

This policy applies only to the RoomGPT iOS application and the services provided through it. It does not cover other apps we publish, or third-party websites or services that RoomGPT may link to.

4. Account model

RoomGPT can be used in two modes:

• Anonymous mode. You can use RoomGPT without creating an account. In this case, we identify your device with an anonymous Firebase identifier so that we can deliver the Service and track your free-tier usage. We do not know who you are.
• Signed-in mode. You may choose to sign in. In that case we collect your email address so that we can recognise you across devices and link your subscription to your account.

You can move between modes by signing in or signing out at any time.

5. What data we collect

5.1 Data you provide to us

• Email address — only if you sign in. Used to identify your account.
• Room photos — the images you upload to be processed by the AI room-design feature.
• Subscription and payment status — whether you have an active subscription, the plan (weekly or yearly), trial status, and renewal dates. Note: Apple processes the actual payment. We never see your card number or full payment details.
• Support correspondence — if you email us, we keep your message and our reply to handle your request.

5.2 Data collected automatically when you use the Service

• Anonymous user identifier — a Firebase-generated ID associated with your device.
• Device and technical data — device model, operating system version, app version, language, country, IP address, time zone, network type.
• Usage data — features used, generations created, free-tier counters, screens viewed, errors, crash diagnostics.
• Advertising identifiers — only if you grant App Tracking Transparency permission and (for EU/UK users) you also accept the consent banner described in Section 8.

5.3 Sensitive data

We do not collect special-category personal data (Article 9 GDPR), such as health, biometric, political, religious, or sexual-orientation data. Room photos are pictures of interior spaces and are not used to identify individuals.

6. Why we process your data and on what legal basis

You have the right to withdraw any consent you have given at any time, without affecting the lawfulness of processing carried out before withdrawal. You can withdraw push notification consent in the app settings, and ad-tracking consent in the privacy section of the app and in iOS settings.

7. Sub-processors and third parties

To run RoomGPT we use the following sub-processors. Each one processes personal data on our instructions under a written agreement.

We do not sell your personal data. We do not share your room photos with third parties for advertising or training purposes.

8. Cookies, SDKs, and consent (EU/UK users)

RoomGPT does not use website cookies. It does use third-party software development kits (SDKs) and identifiers that are functionally equivalent to cookies for the purposes of the EU ePrivacy Directive and the UK PECR.

We classify each SDK as either strictly necessary or non-essential.

Strictly necessary (no consent required):

• Firebase Auth, Firestore, Storage — operating the Service
• Firebase App Check — anti-abuse protection
• Firebase Crashlytics and Firebase Logging — used solely for diagnosing technical errors and operating the Service. We do not use these tools for behavioural analytics, profiling, or advertising
• RevenueCat — running your subscription
• Apple StoreKit / APNs — payments and notification delivery

Non-essential (consent required for EU/UK users):

• Meta SDK — ad attribution and conversion measurement
• Apple Search Ads attribution

RoomGPT does not currently send marketing or promotional push notifications.

If you are in the EU or the UK, the first time you open RoomGPT you will see a consent banner that asks whether you accept the non-essential SDKs and tracking. We do not initialize these SDKs and we do not transmit any data to them before you give consent. You can change your choice at any time from the in-app privacy settings.

This consent operates independently of Apple's App Tracking Transparency (ATT) permission. Even if ATT is granted, we still require your explicit consent under the EU ePrivacy Directive / UK PECR before non-essential SDKs run.

9. International data transfers

We are based in the United States, and most of our sub-processors are also based in the United States. When personal data of EU or UK users is transferred outside the European Economic Area or the United Kingdom, we rely on the following safeguards under Chapter V of the EU GDPR / UK GDPR:

• EU-US Data Privacy Framework adequacy decision (Commission Implementing Decision (EU) 2023/1795 of 10 July 2023) for transfers to sub-processors that are certified under the framework (including Google LLC and Meta Platforms, Inc.).
• Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914 of 4 June 2021) for transfers to sub-processors that are not DPF-certified, supplemented by technical and organisational measures.
• UK International Data Transfer Agreement / UK Addendum to the EU SCCs for transfers from the United Kingdom.

You may request a copy of the safeguards in place for a specific transfer by contacting us at info.hbrothers.llc@gmail.com.

10. How long we keep your data

When the retention period ends, we either delete the data or anonymise it so it can no longer be linked to you.

11. Your rights (EU/UK/EEA users)

Under the EU GDPR and the UK GDPR you have the following rights:

• Right of access (Art. 15) — get a copy of the personal data we hold about you.
• Right to rectification (Art. 16) — correct inaccurate or incomplete data.
• Right to erasure / "right to be forgotten" (Art. 17) — have your data deleted.
• Right to restriction of processing (Art. 18).
• Right to data portability (Art. 20) — receive your data in a structured, machine-readable format.
• Right to object (Art. 21) — including to processing based on legitimate interest, and at any time to direct marketing.
• Right to withdraw consent (Art. 7(3)) — at any time, with no effect on the lawfulness of prior processing.
• Right not to be subject to automated decisions with legal effect (Art. 22). RoomGPT does not make decisions producing legal or similarly significant effects about you.
• Right to lodge a complaint with a supervisory authority — you can find your national supervisory authority at https://edpb.europa.eu/about-edpb/about-edpb/members_en. UK users can complain to the Information Commissioner's Office (ICO) at https://ico.org.uk.

To exercise any of these rights, write to info.hbrothers.llc@gmail.com. We will respond within one month, as required by Article 12(3) GDPR. We may ask you to confirm your identity before we act on a request.

12. Account deletion

You can permanently delete your RoomGPT account and the personal data associated with it from inside the app, under Settings → Account → Delete my account. The option is available whether you are signed in or using RoomGPT anonymously.

Deletion is irreversible and removes:

• Your account record (if signed in)
• Your uploaded photos and generated images
• Your subscription association
• The analytics and advertising identifiers we hold for you

Deletion completes within 30 days.

For abuse-prevention purposes only, we retain a minimal device-level record after deletion: a hashed device identifier (a hashed form of Apple's Identifier For Vendor or the Firebase Installations ID associated with your device) together with a flag indicating whether that device has already used its free-tier generation quota. This record contains no identifying content, is not used to re-create any account, and exists solely to prevent users from indefinitely resetting the free tier through repeated deletions. This minimal retention is based on our legitimate interest under Article 6(1)(f) GDPR in preventing service abuse, and falls within the exceptions to the right of erasure under Article 17(3) GDPR. The record is reset if you fully uninstall the app from your device.

Anonymised or aggregated data, and data we must retain under law (Section 10), will also be kept.

Please note that deleting your account does not cancel your App Store subscription. To cancel a subscription, go to iOS Settings → Apple ID → Subscriptions.

If you cannot access the in-app option, you can also email us at info.hbrothers.llc@gmail.com and we will process the deletion on your behalf.

13. Children

RoomGPT is rated 4+ on the App Store because it contains no objectionable content, but it is not directed at children. We do not knowingly process personal data of children under 16 (or the equivalent minimum age for digital consent in your country). If you are a parent or guardian and you believe your child has used RoomGPT, please contact us at info.hbrothers.llc@gmail.com and we will delete the data.

14. AI-generated content

RoomGPT uses generative AI models to produce design suggestions from the photos you upload. The output is generated automatically based on your input and the model's parameters. We do not use your room photos or your generations to train AI models.

15. Subscriptions and refunds

RoomGPT offers a free tier (a limited number of generations) and paid subscriptions on a weekly or yearly basis. Subscriptions are sold through Apple's App Store. Payments, billing, renewal, and refund requests are handled by Apple under your Apple ID terms. Refund requests must be submitted to Apple via https://reportaproblem.apple.com. We have no ability to issue App Store refunds directly.

EU and UK consumers should note that, under Article 16(m) of the EU Consumer Rights Directive (Directive 2011/83/EU) and equivalent UK law, the right of withdrawal from a digital content contract is lost once supply of the digital content has begun with your express prior consent. By starting to use RoomGPT's paid features after subscribing, you provide that consent.

16. Push notifications

RoomGPT only sends transactional push notifications — for example, "your generation is ready" or "your subscription will renew tomorrow." These are sent on the basis of our contract with you (Article 6(1)(b) GDPR) to every user who has granted iOS notification permission. We do not currently send marketing or promotional push notifications.

You can turn off notifications at any time by disabling notifications for RoomGPT in iOS Settings.

17. Security

We implement appropriate technical and organisational measures to protect personal data, including encryption in transit (TLS 1.2+) and at rest, access controls, App Check protection against unauthorised clients, and logging. No system is perfectly secure, and we cannot guarantee absolute protection. If we become aware of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and, where required, inform you directly, in accordance with Articles 33 and 34 GDPR.

18. California residents (CCPA / CPRA)

If you are a California resident, you have the right to:

• Know what categories of personal information we collect and the purposes for collection;
• Access the personal information we hold about you;
• Request deletion of your personal information;
• Correct inaccurate personal information;
• Opt out of any sale or sharing of personal information for cross-context behavioural advertising;
• Not be discriminated against for exercising these rights.

We do not "sell" personal information for money. We may "share" certain identifiers with Meta for cross-context behavioural advertising, but only after you have given affirmative consent in-app (see Section 8). To exercise your CCPA rights, email info.hbrothers.llc@gmail.com.

We retain personal information for the periods described in Section 10. We do not knowingly collect personal information of consumers under 16 without consent.

19. Other jurisdictions

If you are located outside the EU, the UK, or California, applicable local privacy laws may grant you similar rights (for example, Canada's PIPEDA, Brazil's LGPD, Australia's Privacy Act). You can exercise any such rights by writing to info.hbrothers.llc@gmail.com.

20. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the most recent change. If we make material changes, we will inform you through the app or by email before they take effect, where required by law.

21. Contact

Hbrothers L.L.C., trading as Hbro Studio Email: info.hbrothers.llc@gmail.com Website: https://www.hbro-studio.com

EU Representative (Article 27 EU GDPR): Thibault Mundele, Rua Pinto Ferreira 56, 1D, 1300 Lisbon, Portugal — info.hbrothers.llc@gmail.com UK Representative (Article 27 UK GDPR): appointment pending — contact info.hbrothers.llc@gmail.com in the meantime.