FeelsRight Privacy Notice

Effective date (provisional): 2026-05-09 Status: Draft — entity-identity fields pending OÜ registration Next review: on registration completion (estimated May–June 2026), then every 6 months thereafter

Privacy Notice

Effective date: 2026-05-09

1. Who we are

FeelsRight is operated by {{legal_entity_name}} OÜ ("we", "us", "FeelsRight"), an Estonian private limited company.

• Registered office: {{registered_office_address}}
• Registry code: {{registry_code}}
• Email: [email protected]
• Privacy queries: [email protected]
• Supervisory authority: Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, AKI), https://www.aki.ee/en

We are the data controller for the personal data described in this notice.

2. Scope

This notice covers personal data we collect when you:

• visit https://feelsright.ai or any sub-page
• receive a B2B partnership outreach email from us at a publicly listed business address
• correspond with us via email or any contact form
• use the FeelsRight recommender (room-photo upload feature)
• engage with us as a vendor, wholesale partner, designer referral partner, or distribution partner

3. What we collect and why

3.1 B2B outreach to business contacts

We send unsolicited business-to-business partnership emails to publicly listed business email addresses (e.g., info@, trade@, partnerships@).

• Categories of data: business contact details (name, role, work email, work phone), publicly listed organisation details (company name, registered address, wholesale program metadata).
• Sources: brand websites, B2B trade directories, public company registers, LinkedIn public profiles.
• Lawful basis: legitimate interest under GDPR Article 6(1)(f). We have documented a Legitimate Interests Assessment (LIA) covering necessity, balance against the recipient's rights, and data minimisation. The LIA is available on request to [email protected].
• Retention: until you opt out, or 24 months from our last interaction with you, whichever is sooner. Opted-out addresses are kept indefinitely on a suppression list to prevent re-contact.
• Recipients of your data: only our email-infrastructure providers (Google Workspace) and proxy / browser-automation providers (IPRoyal, CloakBrowser). No data is sold or shared with third-party marketers.

3.2 Website visitors

When you visit https://feelsright.ai we may log:

• IP address (truncated where possible)
• user-agent string
• pages visited and timestamps

• referring URL

• Lawful basis: legitimate interest in operating, securing, and improving the site.

• Retention: server logs retained for 30 days; aggregated analytics for 13 months.

3.3 Recommender users

When you upload a room photo to the FeelsRight recommender:

• Categories of data: the uploaded image, derived feature embeddings, anonymous session ID, country-level IP geolocation.
• Lawful basis: performance of a contract (Article 6(1)(b)) — providing the service you requested.
• Retention: uploaded images retained for 30 days for service improvement, then deleted; embeddings retained in anonymised form. Voice consultation data is covered by a separate, shorter 60-day retention rule — see §10 "Voice consultation data".
• No facial recognition: we do not detect, identify, or store any face data; if a face is in the photo, our pipeline ignores it for recommendation purposes.

3.4 Direct correspondence

If you email us, fill in a form, or reply to outreach:

• Categories of data: anything you choose to share — name, email, message body, attachments.
• Lawful basis: legitimate interest in responding to your enquiry, or performance of a contract if you become a partner.
• Retention: for the duration of the business relationship and 6 years thereafter (Estonian commercial code retention period).

4. International transfers

Some of our processors (Google Workspace) are based in or transfer data to the United States. We rely on:

• the EU–US Data Privacy Framework adequacy decision, where the processor is certified
• the European Commission's Standard Contractual Clauses (SCCs) where the processor is not DPF-certified
• supplementary measures including encryption in transit and at rest

Copies of relevant transfer mechanisms are available on request to [email protected].

5. Your rights

Under GDPR you have the right to:

• access the personal data we hold about you
• rectify inaccurate data
• erase your data ("right to be forgotten") subject to retention obligations
• restrict processing
• object to processing based on legitimate interest
• data portability for data we hold under contract or consent
• withdraw consent (where applicable)
• not be subject to automated decision-making with legal effects

To exercise any right, email [email protected]. We respond within 30 days.

If you are unsatisfied with our response, you may lodge a complaint with the Estonian Data Protection Inspectorate (https://www.aki.ee/en) or your local supervisory authority.

6. Opt-out from B2B outreach

To stop receiving partnership outreach:

• reply to any outreach email with the word STOP (or "UNSUBSCRIBE")
• email [email protected]

We action opt-outs within 7 days and add the address to a permanent suppression list. We do not require any reason, and you do not need to verify your identity.

7. Security

We protect your data with:

• TLS 1.2+ for all data in transit
• encryption at rest for stored content
• access controls limited to personnel with a business need
• annual review of processor security posture
• prompt incident-response process; we will notify the AKI within 72 hours of any reportable breach and notify you without undue delay if your data is materially affected

8. Sub-processors

We use the following sub-processors. The list is current as of 2026-05-09 and is updated when material changes occur.

To object to a specific sub-processor, email [email protected].

9. Children

FeelsRight is a B2B and home-furnishings recommender service not directed at children under 16. We do not knowingly collect data from children.

10. Voice consultation data

When you use FeelsRight's voice consultation feature ("Voice"), we process additional categories of personal data beyond the room photos and design preferences described in the rest of this notice.

What we process during a Voice session

• Voice audio captured by your device microphone during the session is streamed in real time to Google Cloud Vertex AI (EU multi-region) for speech-to-text and AI-generated responses. We do not record or store the raw audio waveform on our servers.
• Session transcripts (text representation of the conversation, produced by speech-to-text) are stored encrypted in our database.
• Memory facts that you and the AI explicitly mark as worth remembering across sessions (e.g. style preferences, layout decisions) are stored encrypted alongside the transcript.
• Cost and quality telemetry (token counts, session duration, tool-call counts, threshold-breach events) — these contain no speech content and are kept for product analytics in our EU PostHog instance.

How long we keep it

Voice consultation data follows a 60-day retention period, which is shorter than the 90-day window applied to other personal data described in this notice:

After deletion, encrypted blobs are hard-deleted by a nightly job and cannot be recovered.

Where it is stored and processed

• Storage & hosting: Hetzner Cloud (Germany, EU).
• AI processing: Google Cloud Vertex AI, pinned to EU multi-region (europe-west4 or europe-west1). We do not allow Voice traffic to be routed to non-EU regions.
• Real-time media: LiveKit (self-hosted on Hetzner Germany). No external sub-processor for media.
• Product analytics: PostHog EU instance (eu.posthog.com) — telemetry only, no speech content.

Sub-processors specific to Voice

Your rights for Voice data

You can at any time: - Delete a single Voice session via your dashboard. Deletion triggers immediate hard-delete of that session's transcript and memory facts. - Cancel the Voice plan. Cancellation triggers deletion of all your Voice data within 60 days. - Export your Voice transcripts on request to [email protected]. - Object to AI processing of your voice data. In that case the Voice feature cannot be provided to you, but other FeelsRight features remain available.

11. Changes to this notice

We may update this notice from time to time. Material changes will be communicated via the website and, where relevant, by email. The effective date at the top of this notice will be updated on each change.

11. Contact

• General: [email protected]
• Privacy / data protection: [email protected]
• Opt-out: [email protected]
• Postal: {{registered_office_address}}