Welcome to the KLAI privacy policy ("KLAI", "we", "us", "our"). This privacy policy explains what personal data we collect, how we use it, with whom we share it, and what rights you have regarding it when you use our web application and AI assistant for space analysis and design recommendations.
This privacy policy applies to all visitors of our website and to all users of the KLAI service, regardless of whether they use it as registered users or anonymously (as a guest).
The data controller within the meaning of the General Data Protection Regulation (GDPR) is:
The external service providers listed below (OpenAI, Anthropic, AgentSight, Bunny.net, Qdrant, Railway, Stripe, [SMTP provider]) act as processors / sub-processors, processing personal data on our behalf and in accordance with our instructions, based on their own data-processing agreements and/or terms of service. Google and Apple, when you use them to sign in, act as independent external authentication providers under their own privacy policies — they are not our sub-processors, but separate controllers for the data they process as part of the OAuth sign-in.
To use certain features (saving conversation history, purchased recommendations, etc.) you can register and sign in to a user account. The basic AI features are also available without registration, through an anonymous (guest) session.
During registration/sign-in we collect:
Sign-in via Google and Apple takes place through the OAuth protocol — KLAI does not see or store the password of your Google/Apple account.
If you forget your password, we send a password-reset link containing a time-limited token to the e-mail address you entered.
Anonymous (guest) use: If you use KLAI without registering, you are assigned a temporary, randomly generated guest identifier (e.g. guest_...) which is stored in your browser's local storage. This identifier does not contain and is not linked to your name, e-mail or other personal data, unless you subsequently register and thereby link an existing guest conversation to a newly created account.
When you use the AI assistant, the following may be collected and processed:
We do not ask or require users to share personal data in order to use the basic AI analysis; the e-mail address and payment data are collected only if you decide to purchase a recommendation/service.
| Form | Data | Purpose |
|---|---|---|
| Registration | First name, last name, e-mail, password | Creating a user account |
| Sign-in | E-mail, password | Access to the user account |
| Forgotten password | Sending a password-reset link | |
| Feedback | Free text, linked to the conversation identifier and, if you are signed in, to the user account | Improving the service |
We do not collect an address or payment card data through our web forms; payment data is processed directly through Stripe.
KLAI uses exclusively cookies that are necessary for the operation of the web application (authentication and security). We do not use cookies for marketing or analytics purposes.
| Cookie name | Purpose | Type |
|---|---|---|
| authjs.session-token / __Secure-authjs.session-token | Maintains the user's signed-in session | Necessary, HttpOnly |
| authjs.csrf-token / __Host-authjs.csrf-token | Protection against CSRF attacks during sign-in | Necessary, HttpOnly |
| authjs.callback-url / __Secure-authjs.callback-url | Redirection after sign-in via Google/Apple | Necessary, HttpOnly |
| authjs.pkce.code_verifier, authjs.state, authjs.nonce | OAuth sign-in security parameters (Google/Apple) | Necessary, HttpOnly |
| NEXT_LOCALE | Remembers the selected interface language | Necessary (functional), contains no personal data |
Since these are exclusively technically necessary cookies required for the operation of the service (sign-in, security, language), no prior consent via a cookie banner is required for them under the GDPR and ePrivacy rules. Because KLAI uses exclusively technically necessary cookies required for the operation of the application, no prior consent via a cookie banner is required for them.
| Key | Content | Purpose |
|---|---|---|
| guest_customer_id (localStorage) | Randomly generated guest identifier | Recognising an anonymous user across sessions without the need for registration |
| pending_conversation_id (sessionStorage) | Conversation identifier | Temporarily linking a guest conversation to a user account after OAuth sign-in (Google/Apple); deleted immediately after use |
This data is stored locally in your browser, does not directly contain personal data (name, e-mail) and serves exclusively functional, technical purposes.
KLAI currently does not use any web-analytics tools, user-behaviour tracking, or error-tracking tools (e.g. Google Analytics, Plausible, Microsoft Clarity, Meta Pixel, Sentry, Hotjar, PostHog).
KLAI uses artificial intelligence to analyse photos of spaces, furniture and materials and to generate design recommendations.
Our web application does not permanently store photos or conversation content locally in your browser.
We do not use your photos or other data to train our own AI models. Photos and data are sent to external AI service providers (OpenAI, Anthropic) exclusively to generate responses/analysis in real time. These providers process data according to their own terms of service, over which we have no direct insight or control. According to their currently applicable terms, data sent via the API is by default not used to train their models; for details we recommend reviewing their privacy policies.
We use the collected data to:
To provide the service we use the following external providers. Each of them processes data on our behalf, based on a data-processing agreement and/or their own terms of service:
| Provider | Role | Processing location |
|---|---|---|
| OpenAI | AI language model (API), message/image moderation, generation of text embeddings, fallback model for image analysis | USA |
| Anthropic (Claude) | AI language model (API), primary analysis of space/product/material photos, generation of recommendations and conducting the conversation | USA |
| AgentSight | Storage and tracking of conversation content (messages, analysis results, images) for the purpose of operating the service, gaining insight into conversations and improving it | Amsterdam, Netherlands (EU) |
| Bunny.net | CDN storage of photos uploaded by users | Frankfurt, Germany (EU) |
| Qdrant | Vector database, used exclusively for searching the internal catalogue of reference spaces (no storage of personal/user data) | Amsterdam, Netherlands (EU) |
| Railway | Hosting of the database (PostgreSQL), the AI agent service, the frontend and the Redis service | Amsterdam, Netherlands (EU) |
| Stripe | Payment processing | EU/USA (per Stripe terms) |
In addition, when you sign in via Google or Apple, those providers act as independent authentication providers (OAuth) under their own privacy policies; they are not our sub-processors, but separate controllers for the data exchanged during sign-in. The list of service providers may change from time to time in line with the development of the KLAI platform. An updated version of this Privacy Policy will always be published.
We do not sell, rent or trade your data. We do not share data with anyone other than the providers listed above, except:
Storage and hosting of the infrastructure take place within the EU (Netherlands, Railway). When the AI providers (OpenAI, Anthropic) process messages and photos, data may be transferred to the USA. Such transfers are protected by appropriate safeguards, including standard contractual clauses and/or the providers' participation in the EU-US Data Privacy Framework, in accordance with their data-processing terms.
We apply appropriate technical and organisational data-protection measures, including encryption of data in transit (HTTPS/TLS), restricted access to data by authorised personnel only, and storage within the EU. Passwords are stored exclusively in hashed form (bcrypt). Although absolute security cannot be guaranteed, we take reasonable steps to protect data against unauthorised access, loss or misuse.
In the event of a personal data breach, we will notify the competent authorities and, where legally required, the affected users, without undue delay, in accordance with the obligations under the GDPR.
In relation to your personal data you have the following rights:
To exercise these rights, contact us using the details provided in section 15.
KLAI is not intended for persons under 18 years of age. We do not knowingly collect personal data of minors below that age. If we learn that we have collected personal data of a minor without the appropriate consent of a parent/guardian, we will take steps to delete such data.
We may update this privacy policy from time to time to reflect changes in our service, technology or legal requirements. We will notify users of any significant change by posting on the website, with the date of the last update indicated at the top of the document. We recommend reviewing this page periodically.
For questions regarding the processing of your personal data or to exercise the rights from section 12, you can contact us at: support@klai.design.
You also have the right to lodge a complaint with the data-protection supervisory authority:
This privacy policy and the processing of personal data described in it are governed by the law of the Republic of Croatia and the European Union, including the General Data Protection Regulation (GDPR).