Privacy Policy

This policy explains how DIY AI (“we”, “us”) handles personal data when you use the website and app. We are a sole trader in the United Kingdom, trading as DIYai.app.

Data controller: DIY AI, a sole trader in the United Kingdom, trading as DIYai.app. Contact: support@diyai.app.

How the product stores your data

DIYai.app is cloud-backed. You can browse as a guest or sign in with email and password, Google, Facebook, Microsoft, or Apple:

• Guests — profile preferences, projects, toolbox, snags, passport items, safety progress, and similar content stay in this browser (localStorage / IndexedDB) until you clear site data or sign in.
• Signed-in accounts — the same homeowner data syncs to your account in our hosted database and file storage (Supabase). The first time you sign in on a device, any guest data already on that device is uploaded once into your account so you can continue across devices. Signed-in sessions may also keep a local cache on the device for performance.

What we collect

Depending on how you use DIYai.app, we may process:

• Account identity from email and password or from Google, Facebook, Microsoft, or Apple sign-in (such as name, email, and provider user id), plus a session we maintain so you stay signed in. Passwords are hashed and stored by our authentication provider (Supabase); we do not store your password in this app.
• Profile and preferences you enter (display name, optional photo, email you add, postcode, home type, skill level, merchant preference, units, accessibility settings, and notification preferences when those features are enabled).
• Project, toolbox, snag, safety, and Home DNA data you create, including photos you upload of rooms, products, or receipts, and Design Studio images you generate.
• Plan and entitlements on your account (for example Free, Pro, or Ultra, and whether banner ads have been removed), including admin adjustments made before Stripe checkout is live.
• Support, affiliate, sponsor, trade, and press form submissions (name, email, message, and any screenshot you attach).
• Technical data that our hosting and edge providers (Vercel / Cloudflare) may log, such as IP address, user agent, and request times, to operate and secure the service.

We do not run our own analytics cookies. When Google banner ads are enabled for guests and Free accounts, Google may set advertising cookies — see our Cookie Policy. Pro, Ultra, and ads-removed accounts do not load those banners.

Lawful bases

We process personal data under UK GDPR on these bases:

• Legitimate interests — to provide the DIY coaching product, keep the service secure, and review partner or support requests.
• Contract — when you create an account or ask us to provide the service, and when paid Pro / Ultra features or ad-removal purchases are taken through Stripe.
• Consent — where you opt in to marketing emails from Account, or where non-essential cookies (such as advertising cookies from Google ads) require consent under UK PECR.
• Legal obligation — if we must keep records for tax, safety, or a lawful request.

Processors and transfers

We use service providers who may process data on our behalf:

• Vercel — hosting and application delivery.
• Cloudflare — CDN, DNS, and edge protection in front of the site.
• Supabase — authentication (Google / Apple), database, and file storage for signed-in homeowner data and public form submissions.
• Google (Gemini) — AI coaching and design features you request.
• Google (AdSense) — horizontal banner ads when enabled for Free / guest users.
• YouTube / Google — optional tutorial video search.
• Stripe — Pro / Ultra subscriptions, one-time ad removal, invoices, and the customer billing portal.

Some providers are based outside the UK. Where that happens we rely on UK-approved transfer mechanisms (such as the UK Extension to the EU-US Data Privacy Framework or standard contractual clauses) as offered by the provider.

Retention

Guest data in the browser remains until you clear site data or until it is migrated into your account on sign-in. Signed-in homeowner data and form submissions are kept in our UK/EU hosted database and storage for as long as needed to operate the service (admin settings currently target around 24 months). Billing records held by Stripe may be kept longer where tax or consumer law requires it. We will shorten or extend retention if the law requires it.

Your rights

Under UK GDPR you can ask us to:

• access the personal data we hold about you
• correct inaccurate data
• erase data in certain circumstances
• restrict or object to certain processing
• receive a copy of data you provided (data portability), where applicable

Signed-in users can delete their account from Account. That removes homeowner data from our database and storage, and cancels an active subscription. To receive a copy of the personal data we hold (a subject access / portability request), email support@diyai.app from the address on your account and we will send it from our admin tools. Billing records held by Stripe may be kept longer where tax or consumer law requires it. You can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

Children

DIYai.app is intended for homeowners aged 18 or over. We do not knowingly collect data from children.

We do not sell your data

We do not sell personal data. Some product links may be affiliate links — see our Affiliate disclosure. That does not involve selling your personal information to retailers. Google ads (when shown) are served by Google under their own terms and may use cookies as described in the Cookie Policy.

Changes

We will update this page when our practices change. The date at the top is the latest version.