1. Introduction
This Privacy Policy explains how Koppe Digital OÜ, operating as Gridsnap ("we", "us", "our"), collects, uses, and protects your information when you use our floor plan editor at gridsnap.app and editor.gridsnap.app (the "Service").
We are committed to protecting your privacy. We collect only the information necessary to provide and improve the Service.
2. Information We Collect
2.1 Information You Provide
- Account information: When you create an account, we collect your email address and display name. If you sign in with Google, we also receive the profile picture URL Google provides.
- Floor plan data: If you sign in and sync a project to the cloud, we store that floor plan — and its version history — on our servers.
- Shared plans: Creating a share link uploads a copy of that plan so the link can be opened by anyone you send it to. Revoking the link (in the share dialog) deletes that copy.
- Communications: If you contact us for support, we collect the information you provide in your message. The in-app "Need help?" form attaches the current state of your plan by default, so we can see exactly what you see; there is a checkbox to send the message without it.
2.2 Information Collected Automatically
- Usage data: We may collect anonymous, aggregated information about how the Service is used (e.g., feature usage, page views) to help us improve the product.
- Device information: Browser type, operating system, and screen resolution may be collected for compatibility and performance purposes.
2.3 Information We Do Not Collect
When using the free editor without an account, your floor plans are stored locally in your browser's storage. We do not have access to this data — it never leaves your device unless you explicitly export or share it.
3. Payment Processing via Stripe
Paid subscriptions are processed by Stripe. Koppe Digital OÜ is the seller; Stripe is our payment processor.
- Your card details never reach us. Checkout happens on Stripe's own hosted page, and the browser never sends payment data through Gridsnap. We cannot see, store, or recover your card number.
- What we store about a subscription is deliberately minimal: a Stripe customer identifier, a subscription identifier, the plan you are on, its status, the current period end, and whether it is set to cancel. That is the whole record. We do not store your name as given to Stripe, your billing address, or your card details.
- Stripe collects the payment data it needs — card details, billing address, and information used for fraud prevention and tax — under its own privacy policy, as an independent controller for that data.
Invoices, plan changes and cancellation live in Stripe's billing portal, which you reach from Manage billing inside the editor. For details on how Stripe handles your data, see Stripe's Privacy Policy.
4. AI Features
Gridsnap's plan checks are a deterministic rule engine that runs in your browser — no data leaves your device for those. The optional AI features (the ✨ explanations and fix suggestions, Furnish, and generating a starting plan from a written brief) are different: they send text to OpenAI's API to produce the response. They are Pro features and they run only when you click one of those buttons; nothing is sent in the background.
What is sent is a short, plain-text summary, not your drawing:
- For an explanation or a fix, a compact description of only the items the finding refers to — for example "single door, 800 mm wide" — plus the names and floor areas of the rooms on that storey.
- For a generated plan, the brief you typed.
- For Furnish, a description of the room being furnished.
Your plan file, your underlay images, your account email and your identity are never sent. We do not use your plans to train any model. OpenAI's handling of API data is described in OpenAI's Privacy Policy.
We keep a count of AI usage against your monthly credit allowance, and — where you tell us a suggestion was wrong — the feedback you send, so the rules can be improved.
5. How We Use Your Information
We use the information we collect to:
- Provide, maintain, and improve the Service
- Manage your account and provide access to features
- Process transactions and manage subscriptions (via Stripe)
- Send transactional emails (account verification, password resets, subscription updates)
- Respond to support requests
- Analyze usage patterns to improve the product (using aggregated, anonymized data)
- Detect and prevent fraud or abuse
6. Data Storage and Security
Accounts, cloud-stored floor plans and share links are hosted on Cloudflare — the application runs as a Cloudflare Worker and the database is Cloudflare D1. The database's primary region is in the European Union.
Plans you have not synced stay in your browser's local storage. They are not uploaded, and we cannot see them.
We implement appropriate technical and organizational measures to protect your data, including encryption in transit (TLS) and at rest, access controls, and regular security reviews.
No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.
7. Data Sharing
We do not sell your personal information. We share data only with:
- Cloudflare: For hosting, authentication, the database and outbound email (as a data processor acting on our behalf).
- Stripe: For payment processing, as described in Section 3.
- OpenAI: For the optional AI features only, and only for the text described in Section 4.
- Law enforcement: Only when required by applicable law or valid legal process.
8. Cookies and Tracking
We use only essential cookies required for the Service to function (e.g., authentication session cookies). We do not use third-party advertising or tracking cookies.
Stripe may set cookies on its own hosted checkout and billing pages, for fraud detection and transaction management. Those are governed by Stripe's cookie policy.
To understand how the Service is used, we count a small number of anonymous, aggregate events — for example "a page was viewed", "a plan was exported", or "a share link was opened". These counters contain no personal data whatsoever: no cookies, no IP addresses, no device identifiers, and no timestamps finer than the calendar day. They cannot be linked to you or your plans. If your browser sends a Do Not Track or Global Privacy Control signal, the editor sends no analytics events at all.
We also count, on the same terms, which page on this website a visit began on and how it arrived — one of six broad categories such as "a search engine" or "a link from another site". This lets us see which of our own pages are worth writing more of. We store this only for the lifetime of the browser tab, in your browser's session storage rather than in a cookie; the referring address is used to pick one of those six categories and is never recorded or transmitted. Daily totals of these counts — a date, a page, a category and a number, and nothing else — are sent to Gridsnap's own analytics service. No account, project, plan or search term is ever included. The same Do Not Track and Global Privacy Control signals switch this off entirely.
9. Your Rights
Depending on your location, you may have the following rights regarding your personal data:
- Access: Request a copy of the personal data we hold about you.
- Correction: Request that we correct inaccurate or incomplete data.
- Deletion: Request that we delete your personal data and account.
- Export: Request a copy of your data in a portable format.
- Objection: Object to the processing of your data in certain circumstances.
- Restriction: Request that we restrict the processing of your data.
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. For payment-related data held by Stripe, you may also contact Stripe directly.
10. Data Retention
We retain your account data and floor plans for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are required by law to retain it (e.g., transaction records for tax purposes).
Cloud projects keep a limited number of recent revisions so you can roll a plan back; older ones are pruned automatically as new ones are made.
Stripe retains transaction data in accordance with its own retention policies and applicable tax and financial regulations.
11. Children's Privacy
The Service is not directed at children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
12. International Transfers
Our database's primary region is in the European Union, but our processors (Cloudflare, Stripe, OpenAI) operate globally, so your data may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place for international data transfers, in compliance with applicable data protection laws including GDPR.
13. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify registered users of material changes via email. The "last updated" date at the top of this page indicates when the policy was last revised.
14. Contact
If you have questions about this Privacy Policy or how we handle your data, contact us at: