Privacy policy
Floormap is a floor plan editor. It needs an account and it stores what you draw, and nothing beyond that. This page explains, in plain words, what is collected, why, who else sees it and how to get rid of it.
Last updated 1 September 2026
Who is responsible
The controller of your personal data is TODO Company B.V., TODO Street 1, 1000 AA Amsterdam, The Netherlands, registered with the Dutch Chamber of Commerce under TODO (VAT TODO). For anything about your data, write to TODO@example.com. We have no data protection officer: the scale and nature of the processing does not require one under art. 37 GDPR.
What we process, and why
| Purpose | Data | Legal basis |
|---|---|---|
| Your account | Name, email address, avatar URL, and the id of the Google or Discord account you signed in with. | Performance of a contract (art. 6(1)(b) GDPR): there is no app without an account. |
| Your houses and plans | Everything you draw: walls, rooms, doors, furniture, lighting, wiring, Wi-Fi access points, floor names and descriptions. | Performance of a contract (art. 6(1)(b) GDPR). |
| Staying signed in | Session token, IP address and browser user agent at sign in. | Performance of a contract, and our legitimate interest in keeping accounts secure (art. 6(1)(b) and (f) GDPR). |
| Paying for an extra house | Stripe checkout session id, payment intent id, amount and currency. Card details are handled by Stripe and never reach our servers. | Performance of a contract, and a legal obligation to keep the records (art. 6(1)(b) and (c) GDPR). |
| AI room furnishing | The shape of the room and the items in it, sent to Anthropic when you press the button. No name, email or account id is sent along. | Performance of a contract, on your request (art. 6(1)(b) GDPR). |
| Home Assistant connection | The address of your Home Assistant instance, an access token that is encrypted at rest with AES-256-GCM, and the names and areas of the entities it exposes. | Performance of a contract, on your request (art. 6(1)(b) GDPR). Only you can set it up and only you can see it. |
| Keeping the site up and honest | Aggregated page views and loading times, without cookies and without a profile of you. Server logs with IP addresses for abuse handling. | Legitimate interest in a working, non abused service (art. 6(1)(f) GDPR). |
Providing this data is not a legal requirement, but without an account and without a plan there is nothing to show you, so it is necessary to use the service.
Who else sees it
Your plans are never sold, never shared with advertisers and never used to train anyone's model. The only parties that touch your data are the ones that run parts of the service for us, under a processing agreement:
- Hosting provider - Runs the application and the MySQL database that stores your account and your plans. (TODO (EU region))
- Stripe - Takes card payments for extra houses. Card details go to Stripe, never to us. (Ireland and the United States (EU standard contractual clauses))
- Anthropic - Runs the AI that furnishes a room when you ask it to. It receives the room shape and the furniture in it, not your account details. (United States (EU standard contractual clauses))
- Vercel Analytics and Speed Insights - Counts page views and measures loading speed. Cookieless and aggregated, no profiles. (United States (EU standard contractual clauses))
- Google and Discord - Only if you sign in with them. They confirm who you are and pass on your name, email and avatar. (United States (EU standard contractual clauses))
Where a processor sits outside the European Economic Area, the transfer runs on the European Commission's standard contractual clauses. We hand data to authorities only when the law obliges us to.
How long it is kept
- Account
- Until you delete your account. Deletion is immediate and takes your plans with it.
- Plans
- Until you delete the house, or your account.
- Sessions
- 30 days after the last sign in, or immediately when you sign out.
- Payments
- 7 years for the invoice and payment records, because Dutch tax law (art. 52 AWR) requires it. These records survive account deletion, stripped back to the amount, the date and the invoice number.
- Backups
- Database backups are kept for 30 days and then overwritten.
- Server logs
- Server logs with IP addresses are kept for 14 days for security and abuse handling.
Your rights
The GDPR, in the Netherlands the AVG, gives you the following rights. Two of them you can exercise yourself, right now, on the account page.
- Access - Ask what we hold about you. The account page exports the lot as JSON, straight away.
- Rectification - Correct anything wrong. Your name and email come from your login provider, so change them there.
- Erasure - Delete your account from the account page. It removes your plans, sessions and logins immediately.
- Restriction - Ask us to freeze processing while a complaint or correction is being sorted out.
- Portability - The JSON export is machine readable and yours to take anywhere.
- Objection - Object to anything we do on the basis of legitimate interest.
- No automated decisions - Nothing here profiles you or decides anything about you automatically.
For anything the account page does not cover, email TODO@example.com. We answer within one month, as art. 12 GDPR requires. If you are not happy with the answer you can complain to the Autoriteit Persoonsgegevens, or to the supervisory authority of the EU country you live in.
Cookies
Only the cookies needed to keep you signed in, so no consent banner is asked for and none is needed. The cookie statement lists every one of them.
Security
Traffic runs over HTTPS. Your Home Assistant access token is encrypted at rest and never sent to the browser. Every query for a plan checks that the plan is yours before it returns a single row. Signed in pages are kept out of search engines.
Should a data breach put your rights at real risk, we report it to the Autoriteit Persoonsgegevens within 72 hours and tell you as well, as art. 33 and 34 GDPR require.
Children
The service is not aimed at children under 16. If you believe a child gave us data, email us and we will delete the account.
Changes
When this policy changes the date at the top changes with it. Changes that matter to you are announced in the app before they take effect.