Privacy Policy

Gardenly3D — operated by SmartFuture AB

Effective Date: November 7, 2026 Last Updated: November 7, 2026 Version: 1.4

1. Controller Identity and Contact Information

The controller of your personal data is:

SmartFuture AB (Swedish Aktiebolag) Organisation number: 559433-4954 SciencePark, Gjuterigatan 9, 553 18 Jönköping, Sweden

Product: Gardenly3D Website: https://gardenly3d.com Privacy contact: hello@gardenly3d.com

For any questions regarding this Privacy Policy or our processing of your personal data, please contact us at the above email address.

2. Data Protection Officer

SmartFuture AB is not required to appoint a Data Protection Officer (DPO) under Article 37 of the General Data Protection Regulation (GDPR), as our core activities do not involve regular and systematic monitoring of data subjects on a large scale, nor do they involve large-scale processing of special categories of data or data relating to criminal convictions and offences.

Accordingly, no DPO has been appointed. All data protection inquiries should be directed to hello@gardenly3d.com.

3. Categories of Personal Data Collected

We collect and process the following categories of personal data:

3.1 Account Data

Data you provide when creating and managing your account:

Full name
Email address
Password (stored in hashed form only)
Company or organisation name (if provided)
Country and language preferences
Account creation date and Terms of Service acceptance record (timestamp, ToS version, Privacy Policy version, DPA version, and user agent; the acceptance record does not include your IP address)

3.2 Payment and Billing Data

Data related to paid subscriptions:

Billing name and address
VAT number (if provided)
Payment method details (card type, last four digits, expiration date)
Transaction history, invoice records, subscription tier, and billing cycle
Currency preference

Note: Full payment card numbers are processed and stored exclusively by our payment processor, Stripe. SmartFuture AB does not have access to or store complete card numbers.

3.3 Design Content and Project Data

Data you create, upload, or store within the Service:

Garden designs, layouts, plans, and project files
3D models, textures, materials, and other design assets
Plant selections, annotations, notes, and project settings
Cost estimates and project configurations
Exported files (PDFs, images, videos, presentations)

3.4 Uploaded Files

Files you upload to the Service:

Photographs and images (site photos, backgrounds, overlays)
3D model files (.GLB, .GLTF, .DAE, and similar formats)
PDF documents (site plans, architectural drawings)
Custom textures and PBR materials

Uploaded photographs may contain personal data, including images of identifiable individuals, licence plates, or other personal information embedded in the image or its metadata (EXIF data such as GPS coordinates, camera information, and timestamps). See Section 5 for further information.

3.5 Usage Data

Data generated through your use of the Service:

Features and tools used, and frequency of use
Session duration and interaction patterns
Design actions performed (for product improvement purposes)
Error logs and crash reports
Search queries within the Service

3.6 Technical Data

Data collected automatically when you access the Service:

IP address
Browser type and version
Operating system and device type
Screen resolution
Referring URL
Pages visited and navigation paths within the Service
Date and time of access

3.7 Communication Data

Data from your communications with us:

Support requests and correspondence
Feedback and feature requests
Survey responses (if any)
Email communication records
Website waitlist registrations: email address, optional name and work description, waitlist status and registration date

3.8 Browser Storage Data

Data stored in your browser's local storage:

Authentication tokens (session identifiers stored via Supabase Auth)
Performance cache data (PBR material identifiers, containing no personal data)

The Service does not place cookies on SmartFuture AB-controlled application domains. See Section 13 for full details on browser storage and Stripe-hosted payment pages.

3.9 AI Feature Data

Data processed when you use AI-assisted features:

Design renders, scene descriptions, and related project context submitted for AI image generation.
Taxonomy prompts and generated plant visual-profile data used for plant-library enrichment.
AI outputs returned to the Service.

4. Purposes and Legal Bases for Processing

We process your personal data for the following purposes, relying on the legal bases specified under Article 6(1) of the GDPR:

4.1 Performance of Contract — Article 6(1)(b)

Purpose	Data Categories Used
Creating and managing your user account	Account Data, Technical Data
Providing the Gardenly3D design service and all its features	Account Data, Design Content, Uploaded Files, Technical Data
Processing payments and managing subscriptions	Account Data, Payment Data
Storing and synchronising your design projects	Design Content, Uploaded Files
Enabling data export and portability	Account Data, Design Content, Uploaded Files
Providing AI-assisted features when you choose to use them	Account Data, Design Content, Uploaded Files, AI Feature Data

4.2 Legitimate Interests — Article 6(1)(f)

Purpose	Legitimate Interest	Data Categories Used
Responding to enquiries, requests, feedback, and support messages, including before you create an account	Responding to people who contact us and providing relevant, effective assistance	Account Data where applicable, Communication Data, Technical Data where needed to investigate an issue
Sending account, authentication, security, billing, subscription, quota, and other necessary service communications	Administering a secure, reliable service and keeping people informed about actions or changes affecting them	Account Data, Communication Data, relevant Technical Data and Usage Data
Delivering project-sharing invitations and related comment or access notifications requested by a Gardenly3D user or participant	Enabling requested collaboration and keeping the relevant participants informed	Contact details, Communication Data, relevant Design Content and access information
Maintaining security and preventing fraud, abuse, and unauthorised access	Security of our systems and protection of all users	Account Data, Technical Data, Usage Data
Analysing usage patterns to improve the Service	Product improvement and development	Usage Data, Technical Data
Diagnosing technical issues, bugs, and errors	Service reliability and quality	Technical Data, Usage Data
Enforcing our Terms of Service and Acceptable Use Policy	Protection of our rights and the rights of other users	Account Data, Technical Data, Usage Data
Aggregating and anonymising data for statistical analysis	Business planning and product development	Usage Data, Technical Data
Detecting and preventing spam and misuse of the Service	Platform integrity	Account Data, Technical Data, Usage Data

Our correspondence interests apply to relevant, proportionate communications that you can reasonably expect from your enquiry, relationship with us, or participation in a shared project. You do not need an account to contact us. We use only the information needed for that correspondence and consider its effect on the people concerned. The basis for communicating with you is separate from the basis for providing the underlying service, processing a payment, or retaining a legally required record.

These legitimate interests do not authorize unrelated promotional messages. Marketing communications, newsletters, and requested launch-waitlist notifications remain subject to consent as described in Section 4.4 and Section 19. We do not replace withdrawn or unavailable consent with legitimate interests for those purposes.

You have the right to object to processing based on legitimate interests, including correspondence. We will assess objections as described in Section 9.6; optional notification preferences and marketing withdrawal are described in Section 19. Contact hello@gardenly3d.com to raise an objection or ask about the interests we rely on.

4.3 Legal Obligation — Article 6(1)(c)

Purpose	Legal Obligation	Data Categories Used
Retaining financial and transaction records	Swedish Bookkeeping Act (Bokforingslagen 1999:1078) — 7-year retention	Payment Data, Account Data
Responding to lawful requests from authorities	Applicable Swedish and EU law	Varies by request
Complying with tax reporting requirements	Swedish tax law, EU VAT regulations	Payment Data, Account Data
Fulfilling data subject rights requests	GDPR Articles 15-22	All categories as relevant
Data breach notification	GDPR Articles 33-34	Technical Data, Account Data

Purpose	Data Categories Used
Sending marketing communications and newsletters	Account Data (email address, name)
Managing a requested launch waitlist and sending launch/availability notifications	Communication Data (email address, optional name and work description, waitlist status and registration date)

Where we rely on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. See Section 9.8 and Section 19 for details.

5. Photos and Uploaded Content Containing Personal Data

5.1 Your Responsibility as Uploader

When you upload photographs or other files to the Service, you are responsible for ensuring that:

You have obtained the consent of any identifiable individuals appearing in the photographs, or you have another lawful basis for uploading images containing their personal data.
You have the right to upload and use the photographs, including any personal data contained within them.
You understand that site-survey photo features may read EXIF metadata, including GPS coordinates, capture time, and camera heading, to place and orient photos on the plan. If you do not want location metadata used, remove it before uploading or remove/adjust the resulting survey metadata in the Service where available.

5.2 Our Processing of Uploaded Photos

SmartFuture AB processes uploaded photographs solely for the purpose of providing the Service (displaying them in your designs, rendering them, storing them). We do not:

Use facial recognition technology on uploaded photographs.
Analyse uploaded photographs to identify individuals.
Share uploaded photographs with third parties, except with our sub-processors as necessary to provide the Service (see Section 6).

For site-survey photo features, the Service may extract GPS coordinates, capture time, and camera heading from EXIF metadata and store those values as survey metadata so that photos can be positioned and oriented on the plan. The stored image file is re-encoded for Service use, which removes the original EXIF metadata from the stored image bytes, but the extracted survey metadata may remain attached to the project until you delete or edit it.

5.3 AI-Assisted Features

When you use AI-assisted features, the Service may send the minimum necessary inputs to third-party AI providers:

AI image generation may send design renders, scene descriptions, plant/species context, and related prompt data to Replicate, Inc. in the United States.
Plant visual-profile generation sends OpenAI only the plant genus name together with fixed botanical instructions. These prompts contain no user, account, or project data.

AI providers process inputs and outputs solely to return the requested feature results. We do not use your content, prompts, or designs to train AI models of our own, and we do not authorize our AI providers to use your inputs or outputs to train their models. We do not permit users to submit sensitive personal data to AI-assisted features, and you should not include unnecessary personal data in prompts, images, or scene descriptions. International transfers are protected as described in Section 7. AI transparency and output limitations are described in Terms of Service Section 9.5.

5.4 Rights of Individuals in Uploaded Photos

If a third party (an individual depicted in an uploaded photograph) contacts us to exercise their rights under the GDPR (for example, the right to erasure), we will:

Notify you (the uploader) of the request.
Cooperate with you to facilitate the exercise of the individual's rights.
If necessary and where we have the technical ability to do so, remove or restrict access to the relevant content.

6. Sub-Processors

We use the following third-party service providers (sub-processors) to deliver the Service. Each sub-processor processes personal data only as necessary to provide their respective services and is bound by data processing agreements:

6.1 Current Sub-Processors

Sub-Processor	Purpose	Data Processed	Location of Processing
Supabase, Inc.	Database hosting, user authentication, file storage	Account Data, Design Content, Uploaded Files, Authentication Data	AWS eu-north-1 (Stockholm, Sweden) — EU
Sinch AB / Mailgun Technologies	Transactional email delivery (account verification, notifications, password resets)	Email addresses, email content	EU (Sinch is headquartered in Sweden)
Stripe Payments Europe, Ltd.	Payment processing, subscription management, invoicing	Payment Data, Account Data (name, email, billing address)	EU (Ireland) / United States
Vercel, Inc.	Application hosting, edge functions, content delivery	Technical Data, Usage Data, request metadata	EU (Frankfurt, Germany) / Global CDN edge nodes
Replicate, Inc.	AI image generation and AI image-verification features	Design renders, scene descriptions, prompt data, generated images	United States
OpenAI, L.L.C.	Plant visual-profile generation	Plant genus taxonomy prompts and generated visual-profile data; no user, account, or project data	United States
Cloudflare, Inc.	Object-storage backups, CDN, DDoS protection, edge routing	Backups of Service data; request metadata; IP addresses	EU / Global edge network / United States
SiteGround Spain S.L.	Support email hosting and mailbox services	Support communications, email addresses, message metadata	EU

6.2 Other Recipients

The Service uses a server-side geocoding proxy for location search. When you search for an address or place, the query is sent to Nominatim/OpenStreetMap to return matching map locations. Address queries may be personal data. We do not use Nominatim/OpenStreetMap for account hosting or project storage.

6.3 Notification of New Sub-Processors

We will notify users of any new sub-processors via email and/or in-app notification with at least thirty (30) days advance notice before the new sub-processor begins processing personal data. The current list of sub-processors is maintained at gardenly3d.com/en/subprocessors. If you object to a new sub-processor, you may terminate your account before the new sub-processor begins processing.

7. International Data Transfers

7.1 Primary Data Storage

Your primary data (account data, design content, uploaded files, and authentication data) is stored in the European Union, specifically in AWS eu-north-1 (Stockholm, Sweden), hosted by Supabase.

7.2 Transfers Outside the EU/EEA

Some of our sub-processors are based in or process data in the United States:

Vercel processes request data through a global content delivery network, which may include servers in the United States and other countries outside the EU/EEA. Vercel's primary computing facilities include locations in the United States.
Stripe processes payment data in both the United States and the European Union.
Replicate processes AI image-generation inputs and outputs in the United States when you use AI image features.
OpenAI processes plant genus taxonomy prompts and generated visual-profile data in the United States; these prompts contain no user, account, or project data.
Cloudflare may process request metadata and backup data in the United States and through its global network.

7.3 Safeguards for International Transfers

For any transfer of personal data to countries outside the EU/EEA that have not been granted an adequacy decision by the European Commission, we rely on the following safeguards:

Standard Contractual Clauses (SCCs): We have entered into, or our sub-processors have adopted, the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) as the primary mechanism for transfers to third countries.
EU-U.S. Data Privacy Framework (DPF): Where applicable, US-based sub-processors may rely on certification under the EU-U.S. Data Privacy Framework, providing an additional basis for data transfers to the United States.
Supplementary Measures: Where required, we implement supplementary technical and organisational measures (such as encryption in transit and at rest) to ensure an essentially equivalent level of protection for transferred data.

7.4 Transfer Risk Evaluation

We have evaluated the transfer risks associated with our sub-processors and determined that, with the safeguards described in Section 7.3, the transferred data receives protection that is essentially equivalent to that provided within the EU/EEA. Details of our sub-processors and their data locations are available on our Sub-Processors page.

8. Data Retention Periods

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:

Data Category	Retention Period	Reason
Account Data	Duration of account + at least 30 days after subscription cancellation or deletion request (Export Window), unless longer retention is required by law	Contract performance; reactivation grace period
Design Content and Uploaded Files	Duration of account + at least 30 days after account termination (Export Window), then permanently deleted	Contract performance; reactivation grace period
Payment and Billing Data	7 years from the end of the financial year in which the transaction occurred	Swedish Bookkeeping Act (Bokforingslagen 1999:1078)
Transaction Records and Invoices	7 years from the end of the relevant financial year	Swedish Bookkeeping Act
Usage Data	Up to 26 months from collection, then anonymised or deleted	Legitimate interest (product improvement)
Technical Data (server logs)	Up to 90 days, then deleted or anonymised	Security, debugging, abuse prevention
Communication Data (support tickets)	3 years after resolution, then deleted	Contract performance, dispute resolution
Browser Local Storage	Cleared on sign-out; no server-side retention	Strictly necessary for session management
Marketing consent records	Duration of consent + 3 years after withdrawal	Legal obligation (demonstrating valid consent)
ToS acceptance logs	7 years from acceptance date	Legal obligation, contract evidence
Data subject rights request records	3 years from completion of request	Legal obligation (demonstrating compliance)

8.1 Post-Termination Data Handling

When you cancel your subscription or terminate your account:

Your account remains in a suspended state for a grace period of at least 30 days (and no more than 90 days), during which you may resubscribe to restore full access without data loss.
During the grace period, you may request a copy of your data by emailing hello@gardenly3d.com.
After the grace period, Account Data, Design Content, and Uploaded Files are permanently deleted from production systems.
Payment and billing data is retained for the mandatory 7-year period under the Swedish Bookkeeping Act.
We may retain limited data necessary for legal compliance, dispute resolution, fraud prevention, and enforcement of our Terms of Service.

8.2 Anonymised and Aggregated Data

Anonymised data (data that can no longer be associated with an identified or identifiable natural person) is not personal data under the GDPR and may be retained indefinitely for statistical and analytical purposes.

As a data subject, you have the following rights under the GDPR. To exercise any of these rights, contact us at hello@gardenly3d.com. We will respond to your request without undue delay and in any event within one month of receiving the request, in accordance with GDPR Article 12(3). In complex cases or where we receive a large number of requests, we may extend this period by a further two months, in which case we will inform you of the extension and the reasons for it within the initial one-month period.

We do not charge a fee for exercising your rights, except where requests are manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act on the request.

9.1 Right of Access (Article 15)

You have the right to obtain confirmation of whether we process your personal data and, if so, to receive a copy of that data together with information about the purposes of processing, the categories of data, the recipients, the retention periods, and your rights. You may request this information by contacting us at the address above.

9.2 Right to Rectification (Article 16)

You have the right to have inaccurate personal data corrected and incomplete personal data completed. You can update most account data directly through your account settings in the Service. For data that cannot be updated directly, contact us.

9.3 Right to Erasure ("Right to Be Forgotten") (Article 17)

You have the right to request deletion of your personal data where:

The data is no longer necessary for the purposes for which it was collected.
You withdraw consent (where consent was the legal basis) and no other legal basis applies.
You object to the processing and there are no overriding legitimate grounds.
The data has been unlawfully processed.
The data must be erased to comply with a legal obligation.

We may retain certain data where we have a legal obligation to do so (for example, financial records under the Swedish Bookkeeping Act for 7 years), or where retention is necessary for the establishment, exercise, or defence of legal claims.

Upon receiving a valid erasure request, we will delete your personal data without undue delay, except for data subject to mandatory legal retention. Deletion across all systems and sub-processors may take up to sixty (60) days due to technical processing cycles.

9.4 Right to Restriction of Processing (Article 18)

You have the right to request that we restrict the processing of your personal data where:

You contest the accuracy of the data (restricted for the period needed to verify accuracy).
The processing is unlawful and you request restriction rather than erasure.
We no longer need the data but you need it for legal claims.
You have objected to processing (restricted pending verification of whether our legitimate grounds override yours).

When processing is restricted, we will store the data but not process it further (except with your consent, for legal claims, for the protection of another person's rights, or for important public interest reasons).

9.5 Right to Data Portability (Article 20)

You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller without hindrance, where:

The processing is based on consent or contract performance; and
The processing is carried out by automated means.

To exercise this right, contact us at hello@gardenly3d.com. We will provide a copy of your data within one month of receiving the request, free of charge, in structured, commonly used, and machine-readable formats. The export will include account information, user profile data, design project data, and uploaded files.

Individual design projects can also be exported one at a time directly from the Service using the per-project export feature. Bulk account-level export is provided on request rather than as a self-serve action so that we can verify the requester's identity and protect the design data of other users on shared accounts.

9.6 Right to Object (Article 21)

You have the right to object to the processing of your personal data where the processing is based on our legitimate interests (Article 6(1)(f)). Upon receiving your objection, we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defence of legal claims.

You have an absolute right to object to the processing of your personal data for direct marketing purposes at any time. If you object, we will cease processing your data for direct marketing immediately.

9.7 Right Not to Be Subject to Automated Decision-Making (Article 22)

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

See Section 12 for our current disclosure on automated decision-making.

Where we process your personal data based on your consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

You can withdraw consent for:

Marketing communications: by clicking the "unsubscribe" link in any marketing email, or by contacting us at hello@gardenly3d.com.

10. Right to Lodge a Complaint

If you believe that our processing of your personal data infringes the GDPR or applicable data protection law, you have the right to lodge a complaint with a supervisory authority.

The lead supervisory authority for SmartFuture AB is:

Integritetsskyddsmyndigheten (IMY) (The Swedish Authority for Privacy Protection) Box 8114 104 20 Stockholm, Sweden Email: imy@imy.se Phone: +46 8 657 61 00 Website: https://www.imy.se

You also have the right to lodge a complaint with the supervisory authority in the EU/EEA Member State of your habitual residence, your place of work, or the place of the alleged infringement.

We would appreciate the opportunity to address your concerns before you contact the supervisory authority. Please contact us at hello@gardenly3d.com so that we can try to resolve the matter directly.

11. Whether Data Provision Is Statutory, Contractual, or Voluntary

11.1 Contractual Requirement

The provision of Account Data (name, email address, password) is a contractual requirement necessary to create an account and use the Service. If you do not provide this data, we cannot provide the Service to you.

The provision of Payment Data is a contractual requirement for paid subscriptions. If you do not provide payment information, you may still use the free tier of the Service (if available) but cannot access paid features.

11.2 Statutory Requirement

The retention of Payment and Billing Data for 7 years is a statutory requirement under the Swedish Bookkeeping Act (Bokforingslagen 1999:1078). We are legally obliged to retain this data regardless of your wishes.

11.3 Voluntary Provision

The provision of all other data categories (Design Content, Uploaded Files, Communication Data) is voluntary. You are not legally or contractually obligated to provide this data, but certain features of the Service require it to function.

The provision of consent for marketing communications is entirely voluntary and has no effect on your ability to use the Service.

12. Automated Decision-Making

As of the effective date of this Privacy Policy, SmartFuture AB does not engage in automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you, within the meaning of Article 22 of the GDPR.

Where AI-assisted features are made available within the Service, they generate suggestions and recommendations as design assistance tools for your consideration. They do not make decisions that have legal or similarly significant effects on you. You retain full control over whether to accept, modify, or reject any AI-generated suggestions.

If we introduce automated decision-making in the future, we will update this Privacy Policy and provide you with meaningful information about the logic involved, the significance, and the envisaged consequences of such processing, and ensure your right to obtain human intervention, express your point of view, and contest the decision.

13. Browser Storage

13.1 No Cookies

The Service does not place any cookies on your device on SmartFuture AB-controlled application domains. No cookie consent banner is shown because the Service itself does not use cookies.

Stripe-hosted checkout and billing portal pages are operated by Stripe on Stripe-controlled domains. Stripe may place cookies or similar technologies under Stripe's own privacy and cookie notices when you use those hosted payment pages.

13.2 Browser Local Storage

The Service uses your browser's localStorage across several categories:

Category	Examples	Purpose	Contains personal data?
Authentication tokens	`sb-*-auth-token`	Maintains your authenticated session. Strictly necessary for the Service to function.	No — session identifiers only
Content performance caches	Material catalog, 3D model catalog	Avoids re-fetching large read-only data on each page load.	No — published asset metadata only
Offline write resilience	Drawing write queue	Stores pending database writes temporarily while a sync is in progress or if connectivity is lost. Replayed to Supabase on reconnect. Cleared on sign-out.	Yes — may contain design metadata pending sync
Project context caches	Site survey read-through cache	Short-lived read cache of data already stored in Supabase, scoped by user and project ID. Cleared on sign-out.	Yes — mirrors server-side project data
Functional preferences	HUD positions, tool defaults, cost report scope, unit preferences, automation history	Remembers your tool settings and workflow preferences across sessions.	No — UI state only
Internal diagnostic data	Error event queues, debug logs	Buffers internal error reports before uploading to our diagnostics endpoint. Contains error messages and stack traces; no design content or personal data of third parties.	No personal data of third parties

All user-scoped entries are cleared when you sign out. None of this data is transmitted to third parties except as necessary to authenticate your session with Supabase or to upload internal diagnostic reports to our own endpoint.

13.3 Server-Side Preferences

Your account preferences (language, UI settings) are stored in your Supabase account record, not in your browser. They are governed by the data retention periods in Section 8.

13.4 Analytics

Marketing website (gardenly3d.com public pages, before login): When you visit public pages on gardenly3d.com, a lightweight script fires a single server-side request recording: page path, detected language, referrer URL (if any), and screen width. No cookies, no localStorage, no device fingerprinting, and no individual identification. Legal basis: legitimate interest (understanding which pages are visited and in which language — Section 4.2).

The authenticated application (after login): No client-side analytics scripts, tracking pixels, or advertising tags are used.

We do not use advertising networks, social media pixels, or cross-site tracking. If we introduce non-essential browser storage in the future, we will notify you under Section 18 and obtain any required consent before deploying it.

14. Security Measures

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

14.1 Technical Measures

Encryption in transit: All data transmitted between your browser and the Service is encrypted using TLS 1.2 or higher (HTTPS).
Encryption at rest: Data stored in our database and file storage is encrypted at rest using AES-256 encryption, as provided by our infrastructure provider (Supabase on AWS).
Authentication security: Passwords are hashed using industry-standard algorithms. We support secure authentication mechanisms provided by Supabase Auth.
Access controls: Access to production systems and personal data is restricted on a need-to-know basis and protected by strong authentication.
Infrastructure security: Our hosting providers (Supabase and Vercel) maintain comprehensive security programmes, including SOC 2 Type II compliance, regular security audits, and vulnerability management.
Secure payment processing: Payment data is handled by Stripe, which is PCI DSS Level 1 certified, the highest level of certification in the payment card industry.

14.2 Organisational Measures

Regular review of security practices and access controls.
Data processing agreements with all sub-processors.
Principle of data minimisation applied to all processing activities.
Regular monitoring for security incidents and anomalous activity.

14.3 Your Responsibility

You are responsible for maintaining the confidentiality of your account credentials and for all activity that occurs under your account. Please use a strong, unique password and notify us immediately at hello@gardenly3d.com if you suspect any unauthorised access to your account.

15. Data Breach Notification

15.1 Notification to Supervisory Authority

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, SmartFuture AB will notify the Integritetsskyddsmyndigheten (IMY) without undue delay and, where feasible, within 72 hours of becoming aware of the breach, in accordance with Article 33 of the GDPR.

Where notification is not made within 72 hours, the notification shall be accompanied by reasons for the delay.

15.2 Notification to Data Subjects

Where a personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, we will communicate the breach to affected data subjects without undue delay, in accordance with Article 34 of the GDPR.

The notification will include:

A description of the nature of the breach.
The name and contact details of our privacy contact.
A description of the likely consequences of the breach.
A description of the measures taken or proposed to address the breach, including measures to mitigate its possible adverse effects.

15.3 Breach Documentation

In accordance with GDPR Article 33(5), we maintain records of personal data breaches, including the facts relating to the breach, its effects, and the remedial action taken.

16. User-Uploaded Content — Privacy Considerations

16.1 Personal Data in User Content

The Service allows you to upload photographs, site plans, 3D models, and other files. These files may contain personal data of third parties, including:

Images of identifiable individuals.
Photographs of identifiable properties or addresses.
GPS coordinates and location data in image metadata (EXIF data).
Names or contact information in uploaded documents.

16.2 Your Obligations

When uploading content that contains personal data of third parties, you act as a data controller for that personal data. You are responsible for:

Ensuring you have a lawful basis (such as consent) for uploading and processing the personal data of third parties.
Informing the relevant individuals that their personal data is being uploaded to the Service.
Responding to data subject rights requests from those individuals, with our cooperation where necessary.

16.3 Our Role

SmartFuture AB acts as a data processor with respect to personal data contained in your uploaded content. We process such data solely for the purpose of providing the Service and in accordance with your instructions as embodied in your use of the Service.

16.4 Shared Designs

If you share your designs via a public link or with other users, any personal data contained in your uploaded content (including photographs of identifiable individuals) will be accessible to those with whom you share. You are responsible for ensuring that such sharing is lawful.

17. Children's Privacy

17.1 Age Requirement for the Service

The Service is intended for professional and commercial use by adults acting in a business capacity. You must be at least 18 years of age to create an account and use the Service. We do not knowingly collect personal data from individuals under the age of 18.

Under the Swedish Data Protection Act (Dataskyddslag 2018:218), which implements Article 8 of the GDPR, the digital consent age in Sweden is 13 years. However, because the Service is designed exclusively for professional business use and is not directed at children or consumers, we apply a minimum age of 18, consistent with our Terms of Service Section 2.2.

17.3 If We Discover Underage Users

If we become aware that we have collected personal data from an individual under the age of 18 without appropriate consent, we will take steps to delete that data promptly. If you believe that we have inadvertently collected data from a child under 18, please contact us at hello@gardenly3d.com.

18. Changes to This Privacy Policy

18.1 How We Notify You

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors.

Material changes (such as new categories of data collected, new purposes of processing, new sub-processors, or changes to your rights): We will provide reasonable advance notice before the changes take effect via email to the address associated with your account and/or through a prominent in-app notification. Where operationally necessary (for example, in response to a security incident or regulatory requirement), changes may take effect with shorter notice.
Non-material changes (such as clarifications, formatting changes, or updates to contact information): May take effect immediately upon posting the updated Privacy Policy on our website.

18.2 Version History

Version	Date	Summary of changes
1.0	March 2, 2026	Initial published version.
1.1	May 30, 2026	Expanded regional supplements (California CCPA/CPRA, UK GDPR), retention schedule, and provisions for photos and uploaded content.
1.2	July 2, 2026	Disclosed AI providers (Replicate, OpenAI) and additional recipients (Cloudflare backups, SiteGround support email, Nominatim geocoding); corrected the description of photo EXIF/location-data processing; clarified cookie-free operation and Stripe-hosted checkout cookies.
1.3	July 4, 2026	Clarified that plant-profile prompts contain no personal data; added a no-AI-training commitment; clarified that acceptance records do not include IP addresses; added this version history table.
1.4	November 7, 2026	Clarified legitimate interests for relevant enquiry, support, service, and requested project-sharing correspondence, including before account creation; distinguished the underlying service and payment bases; preserved consent for marketing and requested launch-waitlist notifications; updated privacy contact details.

Prior versions are available upon request at hello@gardenly3d.com.

18.3 Continued Use

Your continued use of the Service after the effective date of an updated Privacy Policy constitutes your acknowledgement of the updated policy. If you do not agree with the changes, you should stop using the Service and, if you wish, request deletion of your account and personal data.

19. Marketing Communications

We will only send you marketing communications (newsletters, product updates, promotional offers) if you have given us your explicit, freely given consent to do so, in accordance with Article 6(1)(a) of the GDPR and the Swedish Marketing Act (Marknadsforingslagen 2008:486).

Marketing consent is:

Optional: Not a condition of using the Service.
Granular: You can consent to specific types of communications.
Revocable: You can withdraw consent at any time.

19.2 How to Unsubscribe

You can withdraw your consent to marketing communications at any time by:

Clicking the "unsubscribe" link included in every marketing email.
Updating your communication preferences in your account settings.
Contacting us at hello@gardenly3d.com.

We will process your unsubscribe request promptly. Please allow up to 5 business days for the request to take full effect. Note that even if you unsubscribe from marketing, we will continue to send you transactional communications (such as payment confirmations, security alerts, and service notifications) that are necessary for the operation of your account.

19.3 No Third-Party Marketing

We do not sell, rent, or share your personal data with third parties for their own marketing purposes.

20. Third-Party Links

The Service may contain links to third-party websites, services, or resources that are not operated by SmartFuture AB. These links are provided for your convenience only.

We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party websites or services. We strongly encourage you to read the privacy policy of every website you visit.

The inclusion of a link to a third-party website does not imply endorsement of that website by SmartFuture AB.

21. California-Specific Disclosures (CCPA/CPRA)

This section applies to residents of California, United States, and supplements the information provided in the rest of this Privacy Policy, in accordance with the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (collectively, "CCPA").

21.1 Categories of Personal Information Collected

Under the CCPA, "personal information" includes information that identifies, relates to, or could reasonably be linked with a particular California consumer or household. In the preceding 12 months, we have collected the following categories of personal information:

CCPA Category	Examples	Source
Identifiers	Name, email address, IP address, account ID	Directly from you; automatically collected
Commercial Information	Subscription history, transaction records, billing information	Directly from you; from Stripe
Internet or Electronic Network Activity	Browsing history within the Service, interaction data, log data	Automatically collected
Geolocation Data	Approximate location derived from IP address	Automatically collected
Professional or Employment-Related Information	Company name, job title (if provided)	Directly from you
Inferences	Usage patterns, feature preferences (derived from usage data)	Derived from other categories

21.2 Purposes for Collecting Personal Information

We collect personal information for the business purposes described in Section 4 of this Privacy Policy, including providing the Service, processing payments, improving the Service, maintaining security, and (with consent) sending marketing communications.

SmartFuture AB does not sell your personal information as defined by the CCPA.

SmartFuture AB does not share your personal information for cross-context behavioural advertising as defined by the CCPA.

We do not have actual knowledge that we sell or share the personal information of consumers under 18 years of age.

21.4 Your California Privacy Rights

As a California resident, you have the following rights under the CCPA:

Right to Know: You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purposes for collection, and the categories of third parties with whom we share your personal information.
Right to Delete: You have the right to request that we delete your personal information, subject to certain exceptions (such as legal retention obligations).
Right to Correct: You have the right to request correction of inaccurate personal information.
Right to Opt-Out of Sale/Sharing: As we do not sell or share personal information for cross-context behavioural advertising, this right does not apply.
Right to Limit Use of Sensitive Personal Information: We do not collect or process sensitive personal information as defined by the CCPA beyond what is necessary to provide the Service.
Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights. We will not deny you the Service, charge you different prices, provide a different quality of service, or suggest that you will receive a different level of service for exercising your rights.

21.5 How to Exercise Your California Rights

To exercise your rights under the CCPA, contact us at:

Email: hello@gardenly3d.com

We will verify your identity before processing your request. Verification may require you to confirm account details or provide additional information. We will respond to your request within 45 days. If we need additional time, we will notify you of the extension and the reason.

You may designate an authorised agent to make a request on your behalf. The authorised agent must provide written proof of authorisation, and we may still require verification of your identity directly.

21.6 California "Shine the Light" Law

Under California Civil Code Section 1798.83, California residents may request information about our disclosure of personal information to third parties for their direct marketing purposes. As stated in Section 19.3, we do not share personal information with third parties for their own marketing purposes.

22. United Kingdom

This section supplements the main Privacy Policy for users located in the United Kingdom.

22.1 UK Supervisory Authority

For UK-based users, the Information Commissioner's Office (ICO) is the relevant supervisory authority in addition to IMY:

Information Commissioner's Office Wycliffe House, Water Lane Wilmslow, Cheshire SK9 5AF United Kingdom Website: ico.org.uk Helpline: 0303 123 1113

22.2 UK International Transfers

UK-to-US data transfers via US-based Sub-Processors are covered by the UK-US Data Bridge (adequacy regulation, effective October 2023) where the Sub-Processor holds valid certification, or by EU Standard Contractual Clauses supplemented by the ICO's UK Addendum as fallback. See the Sub-Processors list at gardenly3d.com/subprocessors for per-Sub-Processor transfer mechanisms.

22.3 Your UK Data Rights

Your rights under UK GDPR mirror those described in Section 9 (access, rectification, erasure, restriction, portability, objection, and automated decision-making). Contact hello@gardenly3d.com to exercise them.

23. Contact Information

For any questions, concerns, or requests related to this Privacy Policy or our processing of your personal data, please contact us:

SmartFuture AB Organisation number: 559433-4954 SciencePark, Gjuterigatan 9 553 18 Jönköping, Sweden

Privacy contact: hello@gardenly3d.com General contact: https://gardenly3d.com

For data protection complaints, you may also contact the Swedish supervisory authority:

Integritetsskyddsmyndigheten (IMY) Box 8114, 104 20 Stockholm, Sweden Email: imy@imy.se Phone: +46 8 657 61 00 Website: https://www.imy.se

This Privacy Policy was last updated on November 7, 2026. Version 1.4 — Effective November 7, 2026.

SmartFuture AB reserves all rights in and to this document. This Privacy Policy forms part of the agreement between you and SmartFuture AB for the use of the Gardenly3D service, together with the Terms of Service and any applicable Data Processing Agreement.