Layroom keeps data collection to what the product actually needs. No advertising trackers, no third-party data brokers, no resale. The list below is the whole list.
Last updated 28 September 2026
Who the controller is
The data controller is Cristiano Soleti, a sole proprietor based in Italy operating the service at layroom.com. For any question about this policy, including requests to access or erase your data, write to [email protected]. We aim to reply within seven days.
Visiting the site without an account
Browsing layroom.com or using the editor without signing in does not require any personal data. The server logs the minimum needed to serve the page (your IP address, the user agent your browser sends, and the route you requested), retained for up to 14 days for security and debugging. We run no analytics or advertising trackers, so there is no cookie banner: the only cookies we set are strictly necessary or remember a choice you made (language, measurement units, dismissed editor hints).
Signing in with Google
If you choose to sign in with Google, we receive your email address, your display name, your profile picture URL, and your Google account identifier (the sub field). We store those in our Postgres database hosted in the EU and use them only to identify you, show your name in the account menu, and let you return to your saved work. We never post on your behalf and never request additional Google scopes.
Session cookies
When you sign in we set a single HTTP-only cookie containing a session identifier. The cookie is signed with an HMAC secret on the server. The matching session record in Postgres stores a hashed token, your user id, the issue time, and the expiry. Sessions expire after roughly 30 days of inactivity. Signing out deletes both the cookie and the server-side record. Signing in with Google also sets two short-lived cookies that protect the sign-in handshake; they are deleted as soon as it completes.
3D assets and uploads
Floor plan images and generated 3D models are stored in our Cloudflare R2 bucket (EU region) and served from a public R2 URL bound to your account. The files are scoped to your account and are not indexed by search engines. Deleting a piece from your library deletes the underlying object.
Payments
Layroom takes no payments today: paid plans are not on sale yet, so we collect no card, bank or billing details. When paid plans launch, this section will name the payment processor, say what data it receives and in what role, and add it to the subprocessors below. We will email account holders before that change takes effect.
Subprocessors we use
Google (OAuth sign-in only), Cloudflare R2 (object storage, EU region), Meshy (text-to-3D generation when you request it), and Hetzner (server hosting, EU region). Each of these is contractually bound by data-protection terms; we do not share data with anyone else.
Your rights under GDPR
You have the right to access the personal data we hold about you, correct anything that is wrong, ask us to delete it, port it elsewhere, restrict our processing, or object to it. Email the controller to exercise any of these rights. If you are in the EU you can also file a complaint with your national data-protection authority; for Italian residents that is the Garante per la protezione dei dati personali.
How long we keep things
Account data (profile, generated models, saved plans) stays until you ask for deletion or close your account. Sessions auto-expire after 30 days. Server logs roll off within 14 days. There are no billing records today because nothing is sold; once paid plans launch, invoice metadata (plan, amount, period) will be kept for the period Italian tax law requires (currently ten years for invoices).
Changes to this policy
If we change what we collect or who processes it, we will email account holders at least 14 days before the change takes effect and update the date below. Material reductions in scope (collecting less, removing a subprocessor) can take effect immediately.
Note: this policy is written by the operator in plain English and is not a substitute for legal advice.