Privacy Policy

1. Who we are and how to reach us

2. What we collect

• Account details: your email address and name, and, if you sign in with Google, the profile name and picture Google shares (through Amazon Cognito). We keep sign-in sessions and one-time sign-in links in our database.
• Your photos and designs: the yard photos you upload, the AI-generated designs, a cropped copy of your photo used for before/after comparisons, the style you pick, any notes you type and the project size you choose.
• Site details you choose to give: ZIP code (used to look up your USDA hardiness zone and climate), an optional street address, the shade map you draw and the approximate yard width. The street address is stored with the design only; it is not sent to our AI provider or to contractors.
• The no-account trial: a random guest ID in a cookie, and a keyed one-way hash of your IP address (never the address itself) so we can limit free trials per network.
• Purchases: your token balance and purchase history, shopping lists you unlock, and the Stripe customer and checkout IDs. Card details go straight to Stripe; we never see or store your card number.
• Referrals and email preferences: your referral code, who signed up through it, and whether you want product emails (and when we last sent one).
• Contractor introductions (only if you ask): your name, email, optional phone number, ZIP code and town, the project size, the design, and the exact consent text you agreed to with the time you agreed. See section 6.
• Technical data: our servers log requests (IP address, browser user agent, the page or API called, timing and errors) in Amazon CloudWatch. We count visits in aggregate; that count holds no personal identifiers. When a visit starts we also note the website that sent you (its domain only, for example google.com), any campaign tags in the link you followed (utm_source, utm_medium, utm_campaign, utm_content and source), whether that link carried a referral code (never the code itself), the page you arrived on, and whether the request came from an automated client such as a crawler (worked out from the browser user agent, which this record doesn’t keep). This record doesn’t include your IP address or any identifier, and we use it only to see which links bring people here.
• Business contacts (contractors): for the introduction feature we look up landscaping businesses near a ZIP code using Google Places and keep the Google place ID, the business name, its website, the contact email the business publishes on its own website, where we found it, and whether it has unsubscribed.

3. How we use it

• To run the Service: generate designs, keep your gallery, share pages you create, unlock purchases and manage your token balance.
• To send email you need: sign-in links and receipts. With your permission, occasional product emails (for example, “your free designs are back”), each with a one-click unsubscribe.
• To make introductions to contractors you ask for (section 6).
• To keep the Service safe and working: rate limits, abuse prevention, debugging and aggregate usage counts.
• To meet legal, tax and accounting obligations.

We do not use your photos or designs for advertising, and we do not train any AI model on them.

4. AI processing

To create a design, your photo, the style, your notes and the climate details for your ZIP code are sent to Google’s Gemini API. Google processes them to return the design. We use Google’s paid API tier; under its terms Google does not use this content to improve its products, but may keep it for a limited time to detect abuse. Google embeds an invisible SynthID watermark in the images it generates. Designs are AI concepts, not photographs of real work.

5. Who we share it with

We use these service providers, only to run the Service:

• Amazon Web Services (United States): hosting (Lambda, CloudFront), database (Aurora), file storage (S3), email (SES), sign-in (Cognito) and logs (CloudWatch).
• Google: the Gemini API (design generation), the Places API (finding contractors near a ZIP code, only when you ask for an introduction) and Google Sign-In.
• Stripe: payments, receipts and the billing portal.

Things you make public. When you share a design, its before/after page is public to anyone with the link. If you also tick “show it in the public gallery”, it is listed on our gallery and may appear in search engines. You can stop sharing at any time.

How images are stored. Uploaded photos and designs are kept in a storage bucket where each file has a long, unguessable address. Anyone who has that address can open the file, so treat a design link like any other link you share.

We may also disclose information if the law requires it, to protect our rights or users’ safety, or as part of a sale or merger of the business (the buyer would be bound by this policy).

6. Selling of personal information

If, and only if, you ask for quotes from local contractors, we sell your contact details to a contractor. Here is exactly what happens when you tick the consent box on a design:

• We send the design image, your town and ZIP code, the style and the project size to up to 8 local landscaping contractors. Your name, email and phone are not in that email.
• The first contractor who pays us a fee for the lead (currently $20) receives your name, email address and phone number so they can contact you about a quote. No other contractor receives them, and we do not sell them again.
• Contractors are independent businesses. We do not vet, license or endorse them, and we are not part of any agreement you make with one.

Under some US state privacy laws this is a “sale” of personal information. We only do it for a design when you ask, and we store the exact consent text you agreed to.

Opting out. Don’t tick the box, and nothing is sent. To opt out of a request you already made, or of any future sale, email privacy@idea-engine.studio; we will withdraw offers that have not been bought. We can’t recall details a contractor has already bought, but on request we will ask that contractor to delete them. Deleting your account deletes your introduction requests from our systems.

We do not sell or share personal information for cross-context behavioral advertising, and the Service runs no advertising pixels.

7. Cookies and similar storage

We only use first-party, functional storage:

• Sign-in session cookies (Auth.js), including its security cookies for the sign-in flow.
• la_guest, la_guest_hint and la_guest_design: the no-account trial, so your one free design can be claimed when you sign up.
• Browser storage for your theme, a referral code you arrived with, and when you were last active (so a visit is counted once).

No advertising or cross-site tracking cookies are used.

8. How long we keep it

• Account, designs, purchases and introduction requests: until you delete them or your account.
• Photos uploaded in the no-account trial: deleted automatically after 7 days unless you claim the design by signing up. Designs made in the trial that are never claimed are kept until we clear them; email us to have one deleted sooner.
• Server logs: about 30 days. Trial rate-limit records: swept daily once they are no longer needed.
• Payment records: kept by Stripe, and by us as our tax and accounting obligations require, even after account deletion.
• Deleted data can remain in encrypted database backups for a short period until those backups expire.

9. Your choices and rights

• Access and export: Settings → “Download my data” gives you a copy of everything tied to your account.
• Deletion: Settings → “Delete account” deletes your photos, designs, introduction requests, account and your saved payment details at Stripe. You can also delete single designs at any time.
• Correction: change your name in Settings, or email us.
• Product emails: one click in any of them, or the toggle in Settings.
• Sale of contact details: see section 6.

Anyone can make these requests, wherever they live, by emailing privacy@idea-engine.studio. We answer within 45 days and will not treat you differently for asking. We may need to confirm the request comes from the account’s email address.

10. Security

All traffic is encrypted in transit (HTTPS), access to our systems is limited to what is needed to run the Service, and card details are handled only by Stripe. No system is perfectly secure: see section 5 for how image links work. If a breach affects your personal information, we will notify you and the authorities as the law requires, including under Wisconsin law.

11. Children

The Service is for adults 18 and over and is not directed at children. We do not knowingly collect information from anyone under 18; if you believe a child has used the Service, email privacy@idea-engine.studio and we will delete it.

12. Where your data is processed

The Service is intended for users in the United States. Your information is stored and processed in the United States (AWS us-east-1) and by the providers in section 5.

13. Changes to this policy

We will update the date at the top when this policy changes, and email account holders before a material change takes effect.

14. Contact

Questions or requests: privacy@idea-engine.studio. See also our Terms of Service and Refund Policy.