Privacy policy

1. Who we are and our role

Legal business name

Pecalium Pty Ltd

Trading name

Asterlyn Space

ABN

28 701 425 434

Location

Queensland, Australia

Privacy contact

legal@pecalium.com

We hold information in two different roles.

• For your account, billing, support, security and our website, we decide what is collected and why. We are responsible for it (the “controller”).
• For the pictures, drawings and project details you upload, including photos of your customers' homes, you decide what goes in and why. We process it on your behalf (the “processor”), under our data processing addendum.

2. What we collect

Account and team details

• your name, email address and business name;
• your password (stored hashed, never readable), two-factor and passkey settings;
• your team, its members and their roles, and invitations; and
• your plan, credit balance and subscription history.

Pictures and design content

• photos of kitchens and rooms, and plans and drawings;
• the zones, colours, materials and finishes you set on a drawing;
• reference pictures, colour samples, textures, logos and product pictures you upload;
• project names and notes; and
• the renders we generate for you, and any feedback you give on them.

Pictures can contain personal information by accident: people, belongings, a street address, mail on the bench or photos on the fridge. Please leave out anything you do not need in the picture.

Payment information

Payments are handled by Stripe. We receive the payment status, plan, invoice details, billing name and address, tax details, and your card type and last four digits. We never receive or store your full card number.

Technical and security information

• IP address, browser, device and operating system;
• sign-in events, pages and features used in the app; and
• errors, logs and security records.

Website and marketing information

• emails you send us and forms you fill in; and
• on our public website, pages visited, referring sites and ad campaign data collected by cookies (see section 9).

3. How we use it

We use information where we reasonably need it to:

• set up and run your account and team;
• read your drawings and photos, and generate renders with the colours and materials you chose;
• save your projects so they are there when you come back;
• handle subscriptions, credits, payments and tax;
• give you support and find and fix faults;
• check and improve the quality of renders (see section 5);
• prevent fraud, misuse and security incidents;
• enforce our terms and deal with copyright complaints;
• send you service, security, billing and legal notices;
• measure and advertise our website, and send marketing emails where the law allows; and
• meet our legal, tax and accounting obligations.

4. AI processing

Asterlyn Space uses artificial intelligence to read your drawings and generate renders. To do that, some of what you upload has to be sent outside our own systems.

For each render, that can include:

• the drawing or photo you uploaded;
• reference, material and colour sample pictures;
• the colours, materials and finishes you chose; and
• the instructions the Service builds from your choices.

We send this to OpenRouter, Inc. (United States), which passes it to Google's Gemini models. Your name, email address and billing details are not included in what we send.

Every request is set to use OpenRouter's Zero Data Retention routing and to refuse any provider that collects data. That means it only goes to Google endpoints that do not keep the content once they have answered and do not use it to train models. We only send what is needed to produce the result you asked for.

If we change or add an AI provider, we will update our subprocessors list first.

5. We do not train AI on your pictures

We do not use your pictures, drawings, renders or other content to train or fine-tune any AI model, ours or anyone else's. If that ever changes, it will only be with your separate and clear agreement.

We do use stored renders and the drawings they came from to test our own quality checks, so we can show that a change to the Service makes renders better before we turn it on. That is testing our software, not training a model. Those tests use the same AI provider under the same no-retention settings described above, and nothing leaves that arrangement.

6. Our staff looking at your work

When you ask for help, or when we are tracking down a fault, abuse or a security issue, a small number of our staff can open your projects. They can see the drawings you uploaded, the renders the Service made, what was asked for on each render and what it cost. To see exactly what you see, they can also view the app as you. Every time they do, it is logged.

Only staff who need it have this access. It is used to run and fix the Service and for nothing else, and it is covered by the same confidentiality as everything else we hold.

7. Who we share it with

We do not sell personal information. We share it only:

• with the service providers that run Asterlyn Space for us: hosting, storage, AI, payments, email and monitoring. They are listed on our subprocessors and security page;
• with members of your team, according to their roles;
• where you ask us to;
• with Google, Meta and LinkedIn, for visitors to our public website only (see section 9). They do not receive anything from inside the app;
• with professional advisers, insurers, regulators, law enforcement or courts, where the law requires or allows it, or to protect our legal rights;
• to look into fraud, a security incident, misuse or a copyright complaint; and
• as part of a sale or restructure of our business, subject to the law.

Some United States state privacy laws treat the advertising cookies on our public website as “sharing” personal information for cross-context behavioural advertising. That applies only to website visitors, never to content inside the app. You can opt out as described in section 9.

8. Where it is stored and processed

We are based in Queensland, Australia. The app, its database, and the pictures and renders you upload are all hosted in Sydney on DigitalOcean.

Some information is processed overseas by our service providers:

• United States: pictures and instructions sent for AI processing (OpenRouter and Google), billing (Stripe), our website and DNS (Cloudflare), and website analytics and advertising (Google, Meta, LinkedIn);
• New Zealand: email delivery (SMTP2GO); and
• United States and European Union: logs and error monitoring (Better Stack).

Before we send personal information overseas, we take reasonable steps to make sure the recipient handles it consistently with the Australian Privacy Principles, using contractual, technical and organisational safeguards.

9. Cookies, analytics and advertising

In the app

The app uses only essential cookies, to keep you signed in, remember your settings and keep the Service secure. It runs no third-party analytics or advertising tracking, and nothing inside your projects is shared with advertisers.

On our public website

Our marketing website at asterlynspace.com uses Google Tag Manager to run Google Analytics, Google Ads, the Meta pixel and the LinkedIn Insight Tag. These set cookies and collect things like your IP address, device and browser, the pages you view and what you do on the site. We use them to measure traffic, see which campaigns work and show our ads to people who have visited the site.

You can opt out of Google Analytics with Google's browser add-on at tools.google.com/dlpage/gaoptout, manage ad preferences in your Google, Meta and LinkedIn account settings, or block or clear cookies in your browser.

10. Emails we send

We send essential emails about your account, security, team invitations, renders, payments, subscription changes, and changes to the Service or these documents. Marketing emails always include an easy way to unsubscribe, and unsubscribing does not stop the essential ones.

11. How long we keep it

We keep personal information only as long as we reasonably need it, or as long as the law requires.

• Account details are kept while your account is open.
• Projects, uploads and renders are kept while you have a plan, until you delete them.
• When a subscription ends, the team's projects, uploads and renders are kept for 90 days, then deleted.
• A free account that has never paid is deleted, with everything in it, once nobody has signed in to it for 90 days.
• Render attempts that fail are deleted after 14 days.
• Deleting a project, an upload or your account removes it straight away.
• Billing and tax records are kept for as long as Australian tax law requires.

Deleted information can remain in backups and logs for a limited period until they are overwritten. When we no longer need something, we delete it or remove what identifies you.

12. Information about other people

If you upload photos of a customer's home, or of anyone else, you are responsible for having the right to do so and for telling them how it will be used where the law requires. Keep identifiable people out of pictures where you can. If someone asks us about information you uploaded about them, we will usually refer them to you and help you respond.

13. Security and data breaches

We take reasonable steps to protect information from misuse, loss and unauthorised access. Those steps are described on our subprocessors and security page. No internet service can promise perfect security, so please use a strong password and turn on two-factor sign-in.

We take a suspected data breach seriously and will investigate and act on it. Where the Notifiable Data Breaches scheme or another law requires it, we will notify the people affected and the Office of the Australian Information Commissioner.

14. Children

Asterlyn Space is for people aged 18 and over. It is not directed to children, and pictures of children must not be uploaded. If we learn we hold a child's personal information, we will delete it.

15. Your rights and requests

You can ask to see the personal information we hold about you, and ask us to correct anything wrong or out of date. You can also ask us to delete it, or to stop using it for marketing. Write to legal@pecalium.com.

We may need to confirm who you are first. We will respond within 30 days. Where we can lawfully refuse a request, we will tell you why. If the law where you live gives you further rights, such as data portability or objecting to processing, you can use the same address.

For pictures and project details a cabinet maker or other customer uploaded about you, contact that business first. We will help them respond.

16. Complaints

If you think we have mishandled your personal information, write to legal@pecalium.com with enough detail for us to look into it. We will respond within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au, or to the privacy regulator where you live.

17. Changes to this policy

We may update this policy when the Service, our providers or the law changes. The current version and its date are always on this page. If a change materially affects how we handle your personal information, we will tell you by email or in the app before it takes effect, where reasonably practical.