DIYKB, LLC (“DIYKB,” “we,” “us,” or “our”) operates the website located at diykbdesign.com and related services (collectively, the “Platform”). This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you visit our Platform, create an account, upload content, or otherwise interact with our services.

We are committed to protecting your privacy. Please read this policy carefully. By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Platform.

1. Information We Collect

1.1 Information You Provide Directly

Account Information: name, email address, phone number, ZIP code, and password when you register.
Profile Information: username, avatar image, and optional biographical details.
Uploaded Content: photographs of kitchens, bathrooms, outdoor spaces, or other rooms you upload for AI visualization.
Material Preferences: selections for countertops, cabinets, fixtures, lighting, colors, and other design choices.
Quote Requests & Lead Information: project scope, budget range, timeline, contact details, and any notes you submit when requesting a contractor quote.
Communications: messages, emails, or other correspondence you send to us or to contractors through the Platform.
Payment Information: if applicable, payment details are processed by our third-party payment processor and are never stored on our servers.

1.2 Information Collected Automatically

Device & Browser Data: IP address, browser type and version, operating system, device identifiers, screen resolution, and language preferences.
Usage Data: pages visited, features used, time spent on pages, click patterns, referring URLs, and search queries within the Platform.
Geolocation Data: approximate location derived from your IP address or, with your consent, precise location from your device to connect you with local contractors.
Image Metadata (EXIF): when you upload photos, we may extract metadata including GPS coordinates, camera model, timestamp, and orientation. This data helps us determine your service area and optimize image processing.
Cookies & Similar Technologies: see Section 5 below.

1.3 Information from Third Parties

OAuth Providers: if you sign in via Google or another OAuth provider, we receive your name, email address, and profile picture as authorized by you.
Analytics Providers: aggregated and de-identified data from analytics services.
Contractors & Partners: feedback, project status updates, or other information provided by contractors you engage through the Platform.

2. How We Use Your Information

We use your information for the following purposes:

Provide & Improve the Platform: generate AI visualizations, display your designs, operate the community feed, and improve our algorithms.
Contractor Matching: connect you with vetted contractors and showrooms in your area based on your project details and location.
Communications: send transactional emails (account verification, password resets, quote confirmations), service announcements, and, with your consent, marketing communications.
Safety & Security: detect and prevent fraud, abuse, and unauthorized access; enforce our Terms of Service; comply with legal obligations.
Analytics & Research: understand usage patterns, diagnose technical issues, and develop new features.
Legal Compliance: comply with applicable laws, regulations, legal processes, or enforceable governmental requests.

3. How We Share Your Information

We do not sell your personal information. We may share your information with:

3.1 Contractors & Showroom Partners

When you request a quote or use the “Apply to My Space” feature, we share relevant information with the matched contractor or showroom, including:

Your name and contact information
Project details, material selections, and generated visualizations
Your ZIP code or general location

You will be informed before any data is shared with a specific contractor.

3.2 Service Providers

We engage trusted third-party companies to perform services on our behalf, including but not limited to:

Cloud Infrastructure & Hosting: servers, databases, and content delivery.
AI Processing: image generation and analysis. Images are transmitted securely under enterprise data processing agreements.
Authentication: identity verification and secure login.
Email Delivery: transactional emails such as account verification and quote confirmations.
Error Monitoring: technical error tracking to maintain Platform reliability (no personal content is transmitted).

For a detailed list of our service providers, you may submit a request to privacy@diykbdesign.com.

3.3 Legal & Safety Disclosures

We may disclose your information if required by law, subpoena, court order, or government request, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others, investigate fraud, or respond to an emergency.

3.4 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you via email or prominent notice on the Platform before your information becomes subject to a different privacy policy.

4. Data Retention

Account Data: retained while your account is active. When you delete your account we remove your profile, saved designs and uploaded images (including the underlying image files). We retain billing and transaction records — including invoices, payments and token ledger entries — because tax and accounting law requires it, along with limited security and fraud-prevention records.
Uploaded Images: temporary uploads are removed after processing during normal operation. A daily cleanup also deletes temporary uploads once they are more than 24 hours old. Saved generations are retained while your account is active unless you delete them or request account deletion.
Quote & Lead Data: retained to support ongoing projects and contractor follow-up. We keep the identifying details of a quote request — your name, email address, phone number and street address — for 24 months after your last interaction with that request, after which we automatically remove them and retain only the non-identifying details. When you delete your account we de-identify your quote records rather than erase them: we remove your name, email address, phone number, street address, IP address and any free-text notes, and retain only non-identifying details (such as ZIP code, project type, budget range, timeline and material preferences) for market analysis. De-identified information is no longer personal information and is retained indefinitely. Copies already delivered to a matched contractor are controlled by that contractor; on a verified deletion request we notify them, but we cannot recall their copy.
Usage & Analytics Data: events describing how the Platform is used (pages viewed, features used, errors encountered) are retained with identifying context — such as your account ID, device identifier, approximate IP-derived location and referring source — for 24 months. After that the identifying context is removed and the de-identified events are retained indefinitely for product and market analysis.
Operational & Security Logs: retention periods vary by log type, service provider, and account configuration. We may retain particular security or audit records longer when needed to investigate abuse, prevent fraud, resolve disputes, or comply with law.
Aggregated/De-identified Data: may be retained indefinitely for analytics and service improvement.

5. Cookies & Tracking Technologies

We use the following categories of cookies and similar technologies:

Strictly Necessary: authentication tokens, session management, CSRF protection, and security cookies. These cannot be disabled.
Functional: remember your preferences, selected materials, and display settings.
Analytics: understand how visitors use the Platform, measure performance, and identify errors. We use privacy-respecting analytics that do not create cross-site profiles.

We do not use third-party advertising cookies or participate in cross-site behavioral advertising networks.

You can control cookies through your browser settings. Disabling strictly necessary cookies may impair Platform functionality.

6. Your Privacy Rights

6.1 Rights Under California Law (CCPA/CPRA)

If you are a California resident, you have the right to:

Know & Access: request disclosure of the categories and specific pieces of personal information we have collected about you.
Delete: request deletion of your personal information, subject to certain legal exceptions.
Correct: request correction of inaccurate personal information.
Opt Out of Sale/Sharing: we do not sell or share your personal information for cross-context behavioral advertising. No opt-out is necessary.
Non-Discrimination: we will not discriminate against you for exercising any of your privacy rights.
Limit Use of Sensitive Personal Information: you may request that we limit our use of sensitive personal information (such as precise geolocation) to purposes necessary to provide the Platform.

To exercise these rights, email us at privacy@diykbdesign.com. Where an account-settings control is available, you may also use that control. We will verify your identity before processing your request and respond within the time required by applicable law.

You may designate an authorized agent to submit requests on your behalf. We may require the agent to provide written proof of authorization and verify your identity directly.

6.2 Rights for All Users

Regardless of your location, you may:

Access and update your personal information through your account settings.
Delete your account and associated personal information at any time from Account Settings, subject to the exceptions described in Section 4. You may also request deletion by emailing privacy@diykbdesign.com.
Opt out of marketing emails by clicking the “Unsubscribe” link in any marketing email or updating your notification preferences.
Download a copy of your data in a portable, machine-readable format from Account Settings, or request one by emailing privacy@diykbdesign.com.
Withdraw consent for optional data processing at any time.

6.3 Do Not Track

We honor Do Not Track (DNT) browser signals. When we detect a DNT signal, we disable non-essential analytics tracking for that session.

7. Data Security

We implement industry-standard technical and organizational measures to protect your information, including:

Encryption in transit (TLS 1.2+) and at rest (AES-256) for all personal data and uploaded content.
Row-level security policies on our database ensuring users can only access their own data.
Secure authentication via OAuth 2.0 and bcrypt-hashed passwords.
Regular security audits and dependency vulnerability scanning.
Access controls limiting employee access to personal data on a need-to-know basis.
Automated rate limiting and abuse detection systems.

Despite these measures, no method of transmission or storage is 100% secure. If you become aware of any unauthorized access to your account, please contact us immediately at security@diykbdesign.com.

8. Children’s Privacy

The Platform is not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we learn that we have collected personal information from a child under 16, we will take steps to delete that information promptly. If you believe a child under 16 has provided us with personal information, please contact us at privacy@diykbdesign.com.

9. International Data Transfers

Our Platform is hosted in the United States. If you access the Platform from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction. By using the Platform, you consent to this transfer. We ensure that all data transfers comply with applicable legal requirements and that appropriate safeguards are in place.

10. Third-Party Links

The Platform may contain links to third-party websites, services, or applications that are not operated by us. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services before providing them with your information.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you as required by applicable law, such as by email or by posting a notice on the Platform. The “Last Updated” date above identifies when this policy was most recently revised.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy, please contact us:

Email: privacy@diykbdesign.com
Mail: DIYKB, LLC — Attn: Privacy, California, USA

If you are a California resident and are not satisfied with our response, you may file a complaint with the California Attorney General’s Office at oag.ca.gov.