Privacy Policy
This Privacy Policy explains what Idirleon FZ LLE ("we", "us", or "Idirleon FZ LLE") collects when you use the Casana AI mobile app and our backend services (together, the "Service"), what we do with that data, and the choices you have. It is written to be readable in plain English; precise legal terms appear where required.
If you have questions, contact us at idirleonfzlle@gmail.com.
1. The short version
| Data we collect | Your email or OAuth provider id, your display name, the room photos and product photos you upload, the AI-generated images we render for you, subscription status, and product-analytics and error signals about how the app works. We also maintain basic service logs such as IP address, app version, OS, endpoint, and response status. |
|---|---|
| How we use it | To run the Service: storing your rooms, generating restyles / describe edits, signing you in, operating subscriptions, fixing bugs, and improving how the app works. |
| Who we share with | A small set of service providers: Heroku for application hosting, Cloudflare R2 for file storage, OpenAI for AI image processing, Apple and Google for sign-in, RevenueCat and Apple for subscriptions, and PostHog for product analytics and error monitoring. We do not sell your data. |
| Your rights | You can correct or delete your account and content in the app and can request access to or a copy of your information. UAE residents are protected under the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021); users in the EU/UK have GDPR rights; California residents have CCPA/CPRA rights — see Section 6 below. |
| Children | You must be at least 13 to use the Service. |
2. Who we are
The Service is operated by Idirleon FZ LLE, a Free Zone entity established in the United Arab Emirates. For privacy questions, requests, or complaints, reach us at idirleonfzlle@gmail.com.
3. Information we collect
a. Account information
When you create an account we collect, depending on how you sign up:
- Email/password sign-up. Your email address, an optional display name, and a salted password hash (we never store your password in plain text).
- Sign in with Apple. The opaque user identifier Apple gives us, your email if you choose to share it (real or Apple's private-relay address), and the name you choose to share on first sign-in.
- Sign in with Google. The opaque user identifier Google gives us, your email, and your Google-account display name.
b. Your content
As you use the Service you may upload room photos (when you scan a room) and product photos (when you snap an object to place in a room). We also generate and store AI-edited derivatives — restyled images, described edits, and persona renders — alongside your originals. You can delete any of these at any time from inside the app.
c. Designs, themes, and preferences
We store the choices you make in the Service: which themes you applied, prompts you typed into the describe feature, personas you created, products you saved, and your settings (accent palette, dark mode).
d. Subscription / billing
If you start a subscription, billing is processed by Apple through In-App Purchase on iOS and subscription status is managed through RevenueCat. We receive identifiers and records needed to verify the purchase, such as product, transaction, trial, renewal, cancellation, and expiration information. We do not receive your credit-card number or full billing address.
e. Automatically collected
When the app talks to our backend we record minimal request logs needed to operate the Service: source IP, user-agent / OS, app version, the API endpoint hit, response status, and a request id. These logs are retained for up to 30 days and used for security, abuse prevention, and debugging.
f. Product analytics
We use PostHog to understand how the Service is used, diagnose errors, and improve the onboarding and purchase experience. PostHog receives:
- Your account identifier and, after account creation, account properties such as email address, display name, guest status, and sign-in provider.
- Screen views, app lifecycle events, taps on identified controls, feature usage, onboarding and subscription-funnel events, and limited event properties such as selected plan, product id, and displayed price.
- Technical error information such as JavaScript errors, stack traces, app version, device / OS information, and related diagnostic context.
We do not intentionally send room or product photos, image URLs, design prompts, passwords, authentication tokens, or payment-card information to PostHog. Session replay is not enabled. PostHog analytics are used for our legitimate interests in understanding and improving the Service, subject to the rights and choices described in Section 6.
g. Marketing communications
We do not currently enroll users in a marketing mailing list. We may send transactional messages needed to operate the Service, such as password-reset, account, security, billing, or material service notices. If we introduce marketing communications, we will request any consent required by law and provide an unsubscribe mechanism.
4. How we use your information
- To deliver the Service: store your rooms / designs, run the AI-edit pipeline, render your saved looks, sign you in, surface affiliate products you can place in a room.
- To operate accounts: verify identity, recover access, process subscriptions, send transactional email (receipts, security alerts, important changes).
- To keep the Service safe and reliable: detect abuse, debug errors, monitor performance.
- To comply with law: respond to legal requests, enforce our Terms of Service.
We do not use your room photos to train AI models — for ours or for anyone else's. See Section 5 for what the AI providers we use do with your photos.
5. Sub-processors and third parties
To run the Service we share specific data with the providers below. Each one is contractually limited to processing your data only on our behalf.
| Heroku (Salesforce) | Application hosting and request logs. US-based. |
|---|---|
| Cloudflare R2 | Object storage for your room photos and AI-rendered images. |
| OpenAI | We send your room photo plus a prompt to generate restyled or described variants. Per OpenAI's API terms, content sent through their API is not used to train their models. |
| Apple Sign In | Verifies your identity. Apple receives a request scoped to our app's bundle id. |
| Google Sign In | Verifies your identity. Google receives a token request scoped to our OAuth client id. |
| Apple App Store | Processes iOS subscriptions and provides purchase and subscription records. |
| RevenueCat | Verifies App Store purchases and manages subscription status and lifecycle events using our account identifier. |
| PostHog | Product analytics and error monitoring. Receives account properties, app interaction events, and technical diagnostics as described in Section 3(f); no room photos or design prompts are intentionally sent. |
| Amazon Product Advertising API | We query Amazon's catalog to surface affiliate-link products. We do not send your personal data to Amazon as part of these queries. |
We do not sell your personal information, and we do not use it for cross-context behavioural advertising.
6. Your rights
Regardless of where you live, you can:
- See and edit the information on your account from the in-app Settings screen.
- Download or delete a room (and every photo / design tied to it) from the room's hub.
- Delete your entire account from the in-app Settings screen, or submit an access, copy, correction, deletion, or objection request by emailing idirleonfzlle@gmail.com. We will respond within the period required by applicable law.
a. UAE residents (PDPL)
The United Arab Emirates Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, the "PDPL") gives you the right to be informed about how we process your personal data, to access and request correction or deletion of it, to object to or restrict processing, to request data portability, to withdraw consent at any time, and to lodge a complaint with the UAE Data Office. Send requests to idirleonfzlle@gmail.com and we will respond within the time period required by the PDPL.
b. EU / EEA / UK residents (GDPR)
Our legal basis for processing your information is the performance of our contract with you (delivering the Service you asked for), our legitimate interests in operating the Service securely, and your consent where required (for example, for non-essential analytics or marketing communications). You have the right to access, rectify, erase, restrict, or port your personal data, to object to processing, to withdraw consent at any time, and to lodge a complaint with your local supervisory authority.
c. California residents (CCPA / CPRA)
California residents have the right to know what personal information we collect, to request deletion or correction, to opt out of sale or sharing for cross-context behavioural advertising (we do neither), and to limit the use of sensitive personal information. Send requests to idirleonfzlle@gmail.com. We will not discriminate against you for exercising these rights.
7. Retention
We keep your account and the content you upload for as long as your account is active. When you delete a room, its photos and AI-rendered derivatives are removed from our active storage within 30 days, and from backups within 90 days. When you delete your entire account, all of your content is removed on the same schedule. Request logs are retained for up to 30 days. Billing records may be kept longer where required by law.
8. Security
We use industry-standard practices to protect your data: HTTPS for all traffic, salted password hashes (PBKDF2 via Django) for email/password accounts, and storage-level encryption at rest at our object storage provider. No internet service can guarantee absolute security; you are responsible for keeping your account credentials and device secure.
9. International transfers
We are based in the United Arab Emirates. To run the Service we transfer your data to the United States and other countries where our sub-processors are located. Where required by law — for example, GDPR transfers out of the EU/EEA, or PDPL transfers out of the UAE to jurisdictions without an adequacy decision — we rely on Standard Contractual Clauses or equivalent transfer mechanisms with the receiving party.
10. Children
The Service is not directed at children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact idirleonfzlle@gmail.com and we will delete it.
11. Changes to this policy
We may update this Privacy Policy from time to time. The "Effective" date at the top reflects the latest version. For material changes we will give you reasonable notice in-app or by email. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.
12. Contact
Questions, requests, or complaints? Email idirleonfzlle@gmail.com.