1. Scope and who we are
This Privacy Policy applies to the GoGoSpace website, application, AI interior-design tools, and related support (the “Service”). The operator of the GoGoSpace Service (“GoGoSpace”, “we”, “us” or “our”) is responsible for deciding how the personal data described here is used.
For questions or requests, use our contact page or email info@gogospace.ai.
2. Data we collect
Account data
Your email address, account identifier, authentication and password-reset records, credit balance, account creation and update times, records of your acceptance of our Terms and confirmation of content rights, and related profile information. Passwords are handled by our authentication provider; we do not receive them in readable form.
Content and project data
Room photographs, sketches, reference images, design styles, written generation or refinement instructions, generated images, file metadata, project and job identifiers, job status, error information, and related timestamps. Images may contain personal data if they show identifiable people, addresses, possessions, artwork, screens, documents, or other private details.
Purchase data
Your purchasing email, selected credit pack, credits, amount, currency, payment status, transaction and Stripe Checkout identifiers, purchase timestamps, and any referral or campaign source associated with the purchase. Stripe receives and processes your payment method and billing information. GoGoSpace does not receive or store your complete card number or security code.
Support data
Your name, email address, enquiry category, subject, message, and any information you choose to provide when contacting us, together with our correspondence and steps taken to resolve the enquiry.
Technical and usage data
IP address, browser and device type, operating system, requested pages or API routes, referring page or campaign, dates and times, page views and interactions, approximate location, session and security events, job performance, diagnostic logs, and cookie or local-storage identifiers. This includes pseudonymous usage information collected through Google Analytics and Google Tag Manager. We do not intentionally send your name, email address, uploaded images, design instructions, or payment details to Google Analytics.
3. How and why we use data
We use personal data to:
- create and secure accounts, authenticate users, and recover access;
- upload images, create and refine designs, store projects, and provide downloads;
- process purchases, allocate or restore credits, provide transaction history, and handle refunds;
- send service messages such as purchase confirmations and password-reset emails;
- answer support, billing, technical, and privacy requests;
- monitor performance, diagnose errors, prevent fraud and abuse, and protect the Service;
- measure visits, traffic sources, page usage, and feature engagement; understand user journeys; and improve the Service;
- enforce our Terms, establish or defend legal claims, comply with law, and maintain required records; and
- understand aggregate Service performance and improve features without training on your customer images.
Depending on where you live, our legal grounds include performing our contract with you, taking steps you request before entering a contract, our legitimate interests in operating and securing the Service, compliance with legal obligations, and consent where the law requires it. If we ask for consent, you may withdraw it for future processing.
5. AI processing and model training
To fulfil a generation request, GoGoSpace retrieves the source image from private storage and transmits it, together with the relevant instructions and technical settings, through OpenRouter to OpenAI’s API. The generated image is returned to GoGoSpace and stored in your private project. A short-lived, signed link is used when the application displays or downloads a private image.
GoGoSpace does not use your uploaded or generated images to train its own AI models. OpenAI states that API inputs and outputs are not used to train its models by default unless the API customer opts in, and that default API abuse-monitoring logs may be retained for up to 30 days unless law requires longer retention. OpenRouter states that prompts and completions are not logged by default, while the underlying model provider’s practices also apply.
Provider practices and available controls can change. You can review the current official policies here:
Do not upload highly sensitive information or any image unless you are authorised to provide it to us and our service providers for AI processing. If an image includes another person or their personal data, you must have a lawful basis and any required permission. The Service is intended for interior-design visualisation, not for processing identity documents, medical information, financial records, or other sensitive records.
6. Retention
We retain data only for as long as reasonably necessary for the purposes described above, taking account of your account status, whether data is needed to provide the Service, legal limitation periods, security, dispute resolution, and accounting or regulatory obligations.
- Account, project, and image data is generally kept while your account remains active so you can access past designs, unless you delete it or ask us to delete your account.
- Terms and Privacy Policy acceptance records may be retained for up to seven years after account creation or closure, where reasonably necessary to demonstrate acceptance, enforce the Terms, resolve disputes, or establish or defend legal claims.
- Purchase and credit-ledger records may be retained for up to seven years, or longer where required, for tax, accounting, fraud prevention, refunds, and legal compliance.
- Support correspondence is kept for as long as needed to resolve the enquiry and maintain a reasonable record of the outcome.
- Security and diagnostic logs are kept for a limited period appropriate to troubleshooting, security, abuse prevention, and legal obligations.
- Google Analytics data is retained according to the retention settings in our Google Analytics property. User-level and event-level data is automatically deleted after the configured period, while aggregated reports may be retained for longer.
- AI-provider copies are governed by the provider practices described in section 5.
When data is deleted, limited copies may remain temporarily in protected backups or where retention is required by law. We isolate such data from ordinary use and delete or anonymise it when the applicable retention need ends.
7. International transfers
Our service providers may process data in Hong Kong, the United States, and other countries where they or their subprocessors operate. Those countries may have different data-protection laws. Where required, we use contractual and organisational safeguards designed to protect transferred data, while providers may also rely on transfer mechanisms available under applicable law.
8. Security
We use reasonable technical and organisational measures designed to protect personal data. These include encrypted network connections, private storage buckets, time-limited signed image links, account-based access controls, database row-level security, restricted service credentials, and payment processing through Stripe.
No online service can guarantee absolute security. You should use a strong, unique password, protect your email account, sign out on shared devices, and contact us promptly if you suspect unauthorised access.
9. Your rights and choices
Subject to applicable law, you may have the right to request access to or correction of personal data, ask for deletion, object to or restrict certain processing, withdraw consent, or receive a portable copy. Under Hong Kong’s Personal Data (Privacy) Ordinance (Cap. 486), you may request access to and correction of your personal data.
Submit a request through our contact page, choose the privacy request category, and use the email linked to your account. We may ask for information reasonably needed to verify identity and authority. We will respond within the period required by applicable law. Some data may be retained where necessary for legal obligations, security, fraud prevention, transactions, or legal claims.
You may also complain to the relevant privacy regulator. In Hong Kong, this is the Office of the Privacy Commissioner for Personal Data.
11. Children
The Service is not directed to children under 18, and they may not purchase credits or create an account without involvement of a parent or legal guardian where permitted by law. If you believe a child has provided personal data without appropriate permission, contact us so we can investigate and take appropriate action.
12. Changes to this Policy
We may update this Privacy Policy when our practices, providers, Service, or legal obligations change. We will post the updated policy and revise the effective date. If a change materially affects how we use personal data, we will provide reasonable additional notice and seek consent where required.
13. Contact
For privacy questions, data-access or correction requests, or account-deletion requests, use our contact page or email info@gogospace.ai. Please use the subject “Privacy request”.