Skip to content

Data Security

Where your data and your clients’ data are kept, what goes to AI and what happens when you cancel PRO. Briefly, with a link to the section of the terms of service or the privacy policy behind each part.

As of October 22, 2026

In short

Who runs Renovation Calculator AI

  • Marek Papis, sole proprietorship under Gmbi Marek Papis, ul. Pomorska 70 m. 10, 91-409 Lodz, Poland, Tax ID (NIP) 9820319917.
  • For data protection matters: airenovationcalculator@gmail.com. Requests for access to your data, its correction, deletion or a copy go to the same address.

Source: Terms of service, section 1, Privacy policy, sections 1 and 6

Where the data is kept

  • Accounts, projects and the client panel: Firebase database (Google Cloud) in the European Union, eur3 region (Belgium and the Netherlands).
  • Project photos and files: Firebase Storage, in the EU multi-region.
  • Websites and the client panel: Vercel, servers in Frankfurt (EU). Vercel is based in the USA.
  • Payments: Stripe. We do not store card data.

Source: Privacy policy, sections 5 and 8, Terms of service, section 5.1

Artificial intelligence

  • Only what you start yourself goes to AI: the photos and descriptions you send for AI Analysis. Client panel data is processed only by Google (Firebase) and Vercel.
  • The analysis sends the description or photo to OpenAI in the USA, under Standard Contractual Clauses.
  • We keep the description and the result of the analysis for 12 months from the analysis, then delete them. A result saved in a Project stays until you delete the Project or your account.

Source: Privacy policy, sections 2.1, 3.7 and 5.3

Your clients in the client panel

Got a link from a studio?

Your data in the panel (e-mail address, decisions and comments) is controlled by that studio, and we process it on the studio’s behalf. We delete it together with the Project.

  • You are the controller of your client’s data. We process it on your behalf.
  • The data processing agreement (Article 28 GDPR) is chapter 19 of the terms of service. You enter into it by creating your first client panel link. There is no separate document to sign.
  • Your client does not create an account: they open the link and enter their e-mail address. They view the items you selected, accept or reject them and add comments, but do not edit the Project.
  • A link works until the date you set, and you can revoke it at any time. Links are stored only as hashes.
  • The panel pages have no analytics or advertising cookies. The activity log records a shortened IP address.
  • We notify you of a personal data breach concerning the client panel no later than 48 hours after becoming aware of it.
  • When a Project or account is deleted, we delete the client panel data of that Project.

Source: Terms of service, chapter 19, Privacy policy, section 16

When you cancel PRO

  • You can cancel the monthly plan at any time in the Stripe Customer Portal. PRO stays active until the end of the current billing period.
  • Without PRO you cannot share Projects or create new client panel links.
  • After the first AI estimate, exporting your own Projects to PDF and XLS requires an active PRO Subscription. A private account exports to XLS only with PRO, a Company Account also without it. You can also get a copy of your data on request by e-mail (right to data portability, Article 20 GDPR).
  • Accounts with an active PRO Subscription and accounts from which PRO or Points were ever purchased are never deleted automatically. Other unused accounts are: a registered account after 30 days without activity, with a reminder e-mail after 20 days naming the deletion date 10 days later (anonymous accounts after 1 day, unconfirmed ones after 7). Signing in is enough to keep the account.

Source: Terms of service, sections 3, 4.3, 5.4 and 14, Privacy policy, sections 6 and 7

Safeguards

  • All connections are encrypted (HTTPS/TLS). Sign-in runs on Firebase Authentication with e-mail verification.
  • Card data is processed only by Stripe, under PCI DSS Level 1.
  • After too many wrong attempts a client panel link locks, and attempts are also limited per IP address, which makes links and e-mail addresses hard to guess.
  • Google Analytics and Microsoft Clarity run on the websites only after you consent in the cookie banner.

Source: Privacy policy, sections 4 and 10, Terms of service, chapter 19