Version 1.0 · early access · 23 October 2026
Roomframe Privacy Policy
We’ll update this after legal review, and email account holders before any change takes effect.
1. Who we are
Roomframe is run by Nightframe Pty Ltd, ABN 87 703 357 608 ("Nightframe", "we", "us"). This policy explains how we handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
Contact for privacy: [email protected], subject "Privacy". Nightframe Pty Ltd, Sydney NSW, Australia.
2. What we collect
| From | What | Why |
|---|---|---|
| Website visitors | An access or demo request: name, email, company (optional) and your message. Where you came from: the campaign tags on the link, the referring site and the landing page. | To reply, set up access, and see which posts or links bring people in |
| Account holders and team members | Name, email, organisation, role, sign-in method (email code, password stored only as a one-way hash, Google, Microsoft or Sign in with Apple, which may give us a private relay email), sessions (device, browser, IP, times), invitations, settings | To run your account and keep it secure |
| Billing (paid plans) | Plan, billing email, business name and ABN (if given), invoices. Card details go straight to Stripe; we never see or store them. | To charge, invoice and meet tax law |
| Projects (your content) | Venue scans, photos, floor plans, uploaded models, logos and brand files, layouts, notes, exports, share-link settings. Photos may show people or other personal details that happened to be in the venue. | To provide the Service (clause 6.1 of the Terms) |
| Share-link viewers | Basic request logs (IP, browser, time, which link). No account or cookie is needed to view. | Security, abuse prevention, view counts for the sender |
| Roomframe Capture (iPhone) | Camera photos and LiDAR scans you take, laser measurements, device model and app version. No location tracking and no contacts. | To build your venue |
| Render Node (desktop) | Pairing details, computer name, GPU and OS details, job logs | To run bake jobs for your team |
| Support | What you send us | To help you |
We don't use advertising trackers or sell personal information. The website uses no cookies. The studio uses one sign-in cookie (rf_session), which is strictly necessary. Your day/night theme choice is stored in your own browser. We use Cloudflare Web Analytics on the website and in the app: it counts page views without cookies and without tracking you across sites.
3. People in your projects
You may capture venues where people, artwork or private details appear. You're responsible for having the right to capture and upload them. When you can, take venue photos without people in them, or blur faces before sharing. We only use project content to provide the Service for you. We never use customer projects or venues in our marketing without written permission.
4. How we use personal information
We use it to:
- provide, secure and support the Service;
- send service emails (sign-in codes, invitations, billing, security notices and changes to these terms);
- send early-access and launch news, if you asked for access or agreed to it. You can unsubscribe at any time;
- improve Roomframe using aggregated or de-identified usage;
- meet legal obligations.
We don't use your project content to train AI models.
5. AI features with your own key
If you connect an AI service with your own API key (for example Google Gemini), the images or prompts you choose are sent to that provider under your account and its terms. We don't send your content to AI providers otherwise.
6. Who we share it with (service providers)
We use these providers to run Roomframe. They handle data only on our instructions, or as needed to provide their service.
| Provider | What for | Where the data is |
|---|---|---|
| Amazon Web Services | Hosting, storage, cloud rendering, and transactional email through Amazon SES (sign-in codes, invitations and notices from [email protected]) | Sydney, Australia (ap-southeast-2) |
| Cloudflare | Network, security, DNS, privacy-friendly web analytics | Global edge network; it may pass through other countries |
| Stripe | Payments, invoices and tax | Australia and the United States |
| Google Workspace | Our support mailbox; Google sign-in, if you choose it | United States and other countries |
| Microsoft | Microsoft sign-in, if you choose it | United States and other countries |
| Apple | Distributing Roomframe Capture (App Store, TestFlight); Sign in with Apple, if you choose it | United States |
| Google Fonts | Website typefaces (until we self-host them); Google sees your IP address | Global |
| Public code CDNs (cdnjs, jsDelivr, unpkg) | Delivering open-source code libraries to your browser; they see your IP address | Global |
| AI providers you connect yourself | Only what you send, with your key | Per the provider |
We may also disclose information if the law requires it, to protect rights or safety, or to a buyer of the business, with notice to you.
Overseas disclosure (APP 8): some providers above store or access data outside Australia, mainly in the United States. We choose providers with strong security and contractual privacy protections.
7. Security
We take reasonable steps to protect personal information:
- encryption in transit;
- access limited to the people who need it;
- hashed passwords and session tokens;
- encrypted backups;
- monitoring.
No system is completely secure. If a data breach is likely to cause serious harm, we'll notify you and the OAIC under the Notifiable Data Breaches scheme.
8. How long we keep it
| Data | Kept for |
|---|---|
| Access and demo requests | 12 months after our last contact, or until you ask us to delete them |
| Account and projects | While your account is active. If you delete your account: kept 7 days so it can be restored on request, then permanently erased. After cancellation without deleting: read-only, with at least 60 days' notice before deletion (Terms clause 9.3) |
| Backups | Overwritten on a rolling cycle, up to 35 days |
| Billing and tax records | 5 years, as Australian tax law requires. Stripe keeps invoices for the same reason; a team's Stripe customer record is deleted when the team is erased |
| Audit and security logs | 30 days, then deleted (rotated daily) |
9. Your choices and rights
You can:
- ask to see or correct your personal information;
- download your data yourself at any time: Account, team & billing → Your profile → "Download my data" gives your account details, teams, sign-ins and preferences as a file. Team owners and admins can use Account, team & billing → Team → "Download team data" for a ZIP of every project (photos, scans, captures) and brand templates;
- delete your account yourself: Account, team & billing → Your profile → "Delete my account", or in the Roomframe Capture app. Team owners can use Account, team & billing → Team → "Delete this team". Deleting takes effect straight away: your access stops, client links turn off, API keys are revoked and any subscription is cancelled. Deleting your account also deletes teams where you're the only member. We keep everything for 7 days, so it can be restored if you email [email protected]. After that it is permanently erased, and leaves backups as they cycle. When your account is erased, we also remove your name and email from the projects of teams you worked in (project history, revisions, published client copies, capture records, client-link lists and logs); your past edits there are shown as "Deleted user". The team keeps its projects. Records the law requires us to keep, such as tax invoices, are kept for the time required;
- email us if you can't use the self-serve options, and we'll do it for you within 30 days;
- unsubscribe from non-essential emails using the link in each email.
Email [email protected]. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).
10. Children
Roomframe is for businesses and professionals aged 18 and over. We don't knowingly collect children's information, except where a child happens to appear in a venue photo a customer uploads (see section 3).
11. Changes
We'll post updates here with a new date. For significant changes we'll email account holders first.