Privacy Policy

The data controller is SANTORINIA INVESTMENTS LTD, registered in Scotland, United Kingdom, at 8 Margaret Rose Crescent, Edinburgh, Scotland, EH10 7EZ, United Kingdom. For any privacy question, contact support@santinve.shop or +44 7945976527.

Cyclada is an online-only digital styling subscription. We do not sell, let or value property and do not handle rent or deposits.

• Account data you provide: name, email address and password credentials.
• Studio inputs: room descriptions, selections (room type, light, budget, style, purpose) and any room photos you choose to upload.
• Generated results: styling briefs, palettes, lighting plans and reveal previews created for you.
• Billing data: subscription plan, billing country and payment status. Card details are entered directly with Stripe — we never receive or store full card numbers.
• Support data: messages you send through the contact or partner forms.
• Technical data: IP address, device and browser type, and essential cookies (see our Cookie Policy).

Collection sources. We collect this data from the following collection sources: (1) directly from you when you create an account, describe a room, upload a photo or contact us; (2) automatically from your device and browser when you use the site; and (3) from our payment processor, Stripe, which returns your subscription status. We do not buy personal data from data brokers.

Cyclada is an AI styling tool, so this section sets out exactly how we handle your AI data:

• User input: the room descriptions, structured selections and example text you type as your user input are processed only to generate your styling plan and to run the studio. We do not publish your user input or share it beyond the processors listed below.
• Uploaded files: room photos and example data you upload are processed solely to produce your result and are cleared within 30 days after processing, or sooner if you delete them.
• Generated results: the briefs, palettes, lighting plans and reveal previews we generate are stored for your account so you can revisit and export them, and are deleted on request.
• AI provider: where an external AI provider is used to help generate results, only the minimum necessary input is sent to that AI provider to fulfil your request. We do notuse your user input, uploaded files or generated results to train Cyclada's or any AI provider's models, and we do not sell them.

• To provide the studio (generate briefs, visuals and exports) — performance of a contract.
• To take payment and manage subscriptions — performance of a contract.
• To provide support and respond to enquiries — legitimate interests and contract.
• To keep the service secure and prevent abuse — legitimate interests and legal obligation.
• Analytics and service improvement — consent (where required) or legitimate interests.
• We do not use your studio inputs, uploaded photos or generated results to train AI models.

Payments are processed by Stripe. When you check out, your card details are collected directly by Stripe under its own privacy terms. Cyclada does not see, receive or store your full card number, CVC or expiry. We receive only the subscription outcome (for example, active, past due, cancelled) and a masked card reference. If PayPal is enabled in the future, the same boundary applies to PayPal.

We share personal data only with processors that help us run the service, under contract:

• Hosting & delivery: Vercel (application hosting and CDN).
• Payments: Stripe (subscription billing).
• Database, auth & storage: Supabase (account, lead and uploaded-file storage).
• Email: our email provider for transactional and support messages.
• AI generation: where an external model provider is used to enrich results, only the necessary input is sent; no training on your data.

We do not sell your personal data. We may disclose data if required by law or to protect our rights.

Some processors are located outside the UK/EEA (for example, in the United States). Where data is transferred internationally, we rely on adequacy decisions or Standard Contractual Clauses (and the UK International Data Transfer Addendum) to protect it.

• Uploaded room photos and example data: cleared within 30 days after processing, unless you delete them sooner.
• Generated briefs and account data: kept while your account is active and deleted on request.
• Billing records: retained as required by tax and accounting law (typically 6–7 years).
• Support messages: kept for up to 24 months.

Depending on where you live, you may have the right to:

• Access a copy of your personal data.
• Correct inaccurate data.
• Delete your data (right to erasure).
• Restrict or object to processing, including direct marketing.
• Data portability.
• Withdraw consent at any time.
• Under CCPA/CPRA: know, delete, correct, and opt out of the sale or sharing of personal information, without discrimination.

To exercise any right, email support@santinve.shop. We respond within the timeframes set by applicable law.

We do not sell your personal information and do not share it for cross-context behavioural advertising. If this ever changes, we will provide a clear “Do Not Sell or Share My Personal Information” control and honour opt-out preference signals.

We use essential cookies to run the site and, with your consent where required, limited analytics to improve it. See our Cookie Policy for details and controls.

Cyclada produces styling suggestions automatically, but these are references you review — they have no legal or similarly significant effect on you. We do not carry out solely automated decision-making that produces such effects.

Cyclada is not for children. Under-13s may not use the service. Users aged 13–17 must have verifiable consent from a parent or guardian. We do not knowingly collect data from under-13s.

We use encryption in transit, access controls, and reputable processors. No method is perfectly secure, but we take reasonable technical and organizational measures and review them regularly.

Contact us first at support@santinve.shop. UK/EU users may also complain to a supervisory authority (in the UK, the Information Commissioner's Office). This policy is governed by the laws of England and Wales.