SolveMyRoom —
Privacy Notice

1. Who is responsible

SolveMyRoom is the trade name of 9441-2681 Québec inc., 12090 avenue Lamoureux, Montréal (Québec) H1G 5N2, Canada (telephone +1 514 993 8140, email info@solvemyroom.com), which operates SolveMyRoom and is responsible for the personal information it handles. The protection of personal information is the responsibility of our Person in charge of the protection of personal information. Contact: privacy@solvemyroom.com, or by mail at the address above, to the attention of the Person in charge of the protection of personal information.

2. What this notice covers

This notice explains how SolveMyRoom handles personal information on its website and app. At launch, SolveMyRoom is available to clients in the United States and Canada; sign-up is closed to people located in the European Union, the European Economic Area, the United Kingdom, Guernsey, Jersey, the Isle of Man, Gibraltar and Switzerland, and other countries will be opened later. Paid services are not yet available; when they open, they will be opened country by country. These texts are drafted with Québec and Canadian law in view. A person who takes part in a comprehension test or an interview without a SolveMyRoom account receives a separate information sheet before taking part, and takes part only after agreeing in writing; this notice also describes what we keep about them (§3, §7).

3. What we collect

Our hosting provider necessarily sees your IP address and the technical details of each request (§6).

4. Why we use it

• To provide the service you ask for: your Room Brief and Room Passport, matching with designers, conversations, bookings, projects, fit checks and recommendations.
• Once paid services open: to create payment pages for design services on the designer's Stripe account, collect our platform fee from the designer and invoice it, make refunds and follow payment disputes.
• To keep accounts and the platform safe: authentication, fraud and abuse prevention, investigating reports, enforcing the terms.
• To send you the emails that are part of the service (§9).
• To understand, in aggregate, where requests come from — never to change which designers you see or in what order.
• To meet legal obligations: accounting and tax records, evidence for sales taxes (your address and the project location), and the annual reports a platform operator must file on designers' sales.
• To follow up on finished projects: about 30 and 90 days after a project ends, the designer may ask you in the project conversation whether the room works as you wanted and whether a problem or decision about it remains. Answering is optional, the follow-up contains no commercial content, and it never changes a recorded outcome, decision or fit check.
• To improve SolveMyRoom through research interviews, only with your separate, express consent, given before the interview after you receive an information sheet; declining or stopping has no effect on the service; we never record interviews and keep only summarized notes.
• To check that our pages are understood: comprehension tests with a few people, only with their written agreement, given after they receive an information sheet; declining or stopping has no effect; nothing is recorded (no audio, video or screenshot of the person), and only coded summaries are kept.
• To study how the service works: the outcomes declared in a project (by you or the designer) and the follow-up answers are used only as aggregated statistics, in our reports and decisions; this use is announced in this notice and does not call for a separate consent box. Quoting you or using your answers in a published study requires your separate consent.
• To produce service statistics (for example the share of completed briefs or of accepted requests), in aggregate only, for our reports and our decisions about the service — never to rank, suggest or show designers, nor to change what you see.
• To run our tests: our team keeps an internal test log that identifies people and relationships only by their SolveMyRoom identifiers — never a name, email address, postal address, photo or conversation content. It records, for example, the origin of a relationship with a designer, support time, follow-up categories and interview summaries; it is never published or shared outside our team, and no service provider holds it (§6).

We ask for your separate consent (opt-in), unticked by default and separately from the terms, for anything optional: a research interview, quoting you, a published study, the use of your content in our marketing, a portfolio, and data used to train AI; you can withdraw it at any time. Publishing a SolveMyRoom client's room in a designer's portfolio is not currently offered. A research interview takes place only with your express agreement, recorded with its date (§3).

5. Who sees your information

• Designers see what you send them and what your request contains: your first name, your country, the room, its measurements and your brief. They see your room photos only if you tick the separate sharing box, and you can stop sharing at any time; files you add to a project are visible to that project's designer. A designer never sees your last name, email address or exact address through SolveMyRoom; once paid services open, as the merchant, the designer can see in their own Stripe account the payment details described in §3.
• The public sees designers' public profiles and portfolios, and reviews — signed the way the reviewer chooses when publishing (first name and country, first name only, or "Verified client"; nothing is chosen in advance).
• Our team sees in the application only what its role needs; every team member uses two-step verification, money actions need a fresh re-authentication, and opening protected content (such as a reported message) requires a stated purpose and is logged without the content. No team role in the application can open private room photos. The people who administer our infrastructure (the operator) can technically access stored data; this access is limited to the operator. Our team also keeps the internal test log (§4) and uses follow-up answers and interview notes in the form described in §3; it does not open your conversations for this purpose.
• Service providers that process information on our behalf: Cloudflare (hosting and network, and forwarding of the messages you send to our contact addresses), the email provider of the mailbox where the person in charge receives those messages, Neon (database), Amazon Web Services (email delivery; private photo storage once activated), Stripe (once paid services open: payments made to designers' Stripe accounts, our platform fee, refunds and payment disputes — Stripe also processes some information under its own privacy policy, and may offer Link, its own saved-payment service, under its own terms; Link is not offered to consumers in Québec). Our internal test log, interview notes and comprehension-test summaries are not held by any service provider (§6). To answer a payment dispute, the designer, as merchant, may send the booking details and the relevant messages to Stripe and the card networks. We update this list before adding a new service provider.
• Video tools: consultations take place on the video tool chosen by the designer (for example Zoom, Google Meet or Microsoft Teams), under that tool's own privacy policy. SolveMyRoom does not record consultations, and no participant may record one without the explicit consent of all participants.
• Google, Apple or Facebook: if you choose to sign in with one of them, when offered, you sign in on that provider's own page, under its own privacy policy, and it learns that you signed in to SolveMyRoom. We send it nothing else: no account, room or project information. We do not load any tool from Google, Apple or Facebook (software kit, pixel or button) in our pages. If you use an Apple private relay address, our emails to you pass through Apple's relay. When you remove the Apple link or delete your account, we ask Apple to revoke it.
• Suppliers (Androf or any other) never receive your photos, address, conversations or project details.
• We do not sell personal information and we do not use it for advertising. We may disclose information when the law requires it.

6. Where your information is processed

Your information is processed outside Québec and outside Canada, including in the United States:

• Our main database is hosted by Neon on Amazon Web Services in the United States (Virginia, us-east-1).
• Our application runs on Cloudflare's global network: a request — including a photo you upload or view and the emails we prepare — is processed at the Cloudflare location that receives it, which may be in another country.
• Stripe processes payment information in several countries, including the United States.
• Emails are sent by Amazon Web Services in Canada (ca-central-1, Montréal area); the email service may scan messages to block spam and keeps a list of addresses that bounce. When photo uploads are offered, your private photos and files are stored there too (Amazon S3, Canada); before being stored, each image is processed by our application on Cloudflare's network, as described above.
• Designers you choose to work with may be located outside Canada; they receive only what is described in §5.
• Our internal test log, interview notes and comprehension-test summaries are kept as files on the operator's own computer, in Québec, outside any online service; written agreements to a comprehension test are kept on paper by the operator.

Before communicating personal information outside Québec, we must assess whether it will receive adequate protection and put written agreements in place with our service providers: we accept their standard data-processing terms and keep a copy of the version accepted.

7. How long we keep it

When your account is deleted, the account itself is de-identified (name and email address removed) and:

• for a client, we erase your rooms, your photos and files, and remove the messages, reviews and notes you wrote;
• for a designer, the public profile is deactivated and its photo, bio, city and region removed; published portfolio items are withdrawn and your files erased, except deliverables in your clients' projects; your display name, title, services, prices and country, your onboarding records and the messages you wrote in your clients' conversations are kept — the onboarding records for 3 years after the end of the relationship, the other items as part of your clients' history.

We keep what must remain: payment records (6 years), proof of acceptance (6 years after the end of our relationship), proof of consents, records of actions, and the other party's history (for example a designer's deliverables in a client's project). The entries about you in our internal test log and in interview notes are purged promptly.

8. Your rights

You can:

• access your information and get a copy in a structured, machine-readable format — "Export my data" in your account page (archive available for 48 hours); what our team keeps outside the product (the internal test log, interview notes) is not in this archive: ask us in writing (§1);
• correct your information — in your account page (except your email address: write to us) and Room Passport, or by writing to us;
• withdraw an optional consent at any time — in the privacy page — and your agreement to research interviews, by telling the interviewer or writing to us;
• delete a room, or your account — in the product (7-day period to change your mind);
• remove a link with Google, Apple or Facebook — in your Account page, as long as you keep another way to sign in. If you ask Facebook to delete the data it shared with us, Facebook sends us the request: we remove the Facebook link as soon as it arrives and, if your account was created with Facebook, we also start deleting your account as if you had asked for it (same 7-day period), except what the law requires us to keep. We give Facebook a status page and a confirmation code;
• ask us to stop disseminating information about you or to de-index it, where the law gives you that right;
• contact the person in charge (§1). We answer in writing within 30 days of receiving a written request. If you are not satisfied, you can make a complaint as described in §15.

9. Emails

We send emails that are part of the service: security (password reset, password changed, account deletion, data export), bookings, cancellations and refunds, project and payment updates, new requests and messages, reminders, invitations (only to a person who asked for one), and decisions by our team. These service and security emails cannot be turned off; they stop when your account is deleted. We send no marketing email and no newsletter. If this changes, we will first ask for your separate consent, unticked by default, and any commercial message will identify SolveMyRoom (9441-2681 Québec inc.) and include a way to unsubscribe. When a follow-up message about a finished project (§4) is written in the project conversation, like any message it may trigger the usual message-summary email if you have not read it yet (the sender's name, the number of messages and a link — never the content). This follow-up contains no commercial content: it asks only about your room and never invites you to a new paid service, and our team sends no follow-up email of its own without your answer or your express consent.

10. Cookies and measurement

We use only essential cookies: your session, your Room Brief draft, your language and, if you sign in with Google, Apple or Facebook, two short-lived cookies that protect that sign-in (10 minutes) and keep a sign-up you have not finished (30 minutes). We do not use advertising or tracking cookies, and we do not use any audience-measurement tool. If we ever add measurement, we will ask for your choice first, with refusal as the default.

11. Security

Passwords and access tokens are stored as hashes; our team's two-step verification secrets are encrypted; every request is authorized on our servers; private photos are never served through a public address; every image is re-encoded by our servers; our team's access in the application follows the least privilege needed and is logged. Photos of your home are treated as highly sensitive information. No system is perfectly secure; if an incident creates a risk of serious injury, we will notify you and the competent authorities as the law requires.

12. Age

SolveMyRoom is not intended for people under 18.

13. Automated decisions

Other than security limits (for example temporarily refusing sign-in after repeated failures), the closing of sign-up according to the country you declare (§2) and, once paid services open, the availability of paid bookings according to the country declared in your account, SolveMyRoom makes no decision about you based exclusively on automated processing. Fit checks are calculations shown to you, not decisions about you; the designer directory is neutral and is not ranked by any supplier relationship. Service statistics and test measures are never used to rank, suggest or show designers.

14. Our governance policies and practices

This is a summary of the policies and practices that frame how we handle personal information. They are approved by our Person in charge of the protection of personal information.

• Roles. The Person in charge oversees the protection of personal information, decides on incidents and requests, and keeps our internal registers. In the application, each team role has only the permissions it needs, every team member uses two-step verification, and protected content is opened only for a stated purpose and logged. Designers are bound by the Designer Terms (§4 of those terms) for the information they receive.
• Retention and destruction. We keep information only for the periods listed in §7, then delete it, or keep only de-identified records or aggregates where §7 says so. A deleted account is erased when the deletion is finalized and removed from backups within 7 days.
• Confidentiality incidents. Any incident is assessed without delay: we contain it, record it in our register of incidents (kept at least 5 years), assess the risk of serious injury and, if that risk exists, notify the Commission d'accès à l'information du Québec and the people concerned.
• Requests and complaints. Requests to access, correct or delete information, and complaints, are handled by the Person in charge, who checks your identity without asking for more than needed, answers in writing and keeps a register of requests.
• New systems and service providers. Before a new information system or a new communication of information outside Québec, we assess the privacy risks; our service providers work under written agreements.

15. How to make a complaint

• Write to privacy@solvemyroom.com, or by mail to the address in §1, to the attention of the Person in charge of the protection of personal information. Describe your concern and, if you can, the account concerned.
• We acknowledge your complaint, check your identity without asking for more than needed, and examine your complaint.
• We answer you in writing within 30 days of receiving your complaint.
• If you are not satisfied with our answer, you can complain to the Commission d'accès à l'information du Québec (https://www.cai.gouv.qc.ca). If you live outside Québec, you may also contact the privacy authority where you live, for example the Office of the Privacy Commissioner of Canada.

16. Changes

If this notice changes, you will be asked to read the new version before you continue.