Privacy Policy
Last updated August 25, 2026 · Applies to the StoneSwap Design Studio at stoneswap.studio
This page explains, in plain language, what the StoneSwap Design Studio collects when you use it, why, who else sees it, how long it is kept, and what you can ask us to do about it.
Who you are dealing with
StoneSwap is the business behind this Design Studio. It decides what the Studio is for, and the information you give it is StoneSwap’s to use for the purposes described below.
StoneSwap.ai builds and operates the Studio for StoneSwap as its service provider. In privacy terms StoneSwap is the organisation accountable for your information and StoneSwap.ai handles it on StoneSwap’s behalf, under contract, only for the purposes set out here. If you ask either of us to do something with your information, we will pass the request to the other where that is needed to complete it.
Contact
Questions about this policy, or a request about your information, go to the person responsible for personal information for this Design Studio:
Matthew Stubbs · Privacy Officer, StoneSwap.ai
We answer privacy requests within 30 days, which is the deadline Canadian privacy law sets.
What we collect, and why
We only collect what the Studio needs to do its job. Nothing here is bought from a data broker — every item below either comes from you or is produced by your use of the Studio.
| What | Why we need it |
|---|---|
| The photograph of your property that you upload, plus anything you draw on it and any inspiration image you add | It is the picture the design is made from. A photo of a home is personal information: it can show your house, your street, your vehicle, your neighbours’ property and, through the file itself, when and sometimes where it was taken. We treat it that way. |
| Your name and email address | To create your account, sign you in, send you your design and its share link, and let StoneSwap answer you. |
| Your phone number (optional) | So StoneSwap or a participating dealer can reach you about your project if you asked them to. |
| Your ZIP or postal code | To confirm the Studio is available where you are, point you at the nearest dealer, and tell StoneSwap which regions its designs are coming from. |
| Business name and website, if you tell us you are a contractor | To set your account up for client work and to let StoneSwap recognise you as a trade customer. |
| Approximate location — the country and region our network provider works out from your IP address | To apply the regions the Studio is offered in, and to spot abuse such as one person opening many accounts. |
| Precise location — only if you grant your browser’s location permission when we ask | We ask once, to confirm you are inside the service area. We keep that single reading — the coordinates and the city and region they resolve to — on your account. It is one point in time, not a record of where you go, and it is deleted with your account. You can refuse; some parts of the Studio may then be unavailable. |
| Device and browser information — a device identifier we store in a cookie, a technical “fingerprint” of your browser’s settings, your IP address and your browser’s user-agent string | To keep you signed in, to protect the service against fraud and automated abuse, and to keep render counts honest. The fingerprint is stored as a one-way hash and is salted per brand, so it cannot be matched against any other brand’s Studio. |
| The designs you make — the products you chose, the notes you typed, the generated images, and an automatically written summary of the project | To show you your results, let you revisit and share them, and give StoneSwap an understanding of what people are designing and what those projects are worth. |
| Purchase records — what you bought, the amount, the currency, the tax and the payment reference | To add the credits to your balance and to keep the financial records the law requires us to keep. We never see or store your card number — the card is entered directly into our payment provider’s form. |
| Consent records — which boxes you ticked, the wording you agreed to, and when | So we can prove what you actually agreed to, and so you can hold us to it. |
We do not sell your personal information, we do not rent it, and we do not use it for advertising you around the internet.
Your photo and the AI
The images the Studio produces are made by an automated system. In the words shown on every result, share page and proposal sheet: AI-generated concept for inspiration only. Product appearance, colors and layout in this visualization are not guaranteed and may differ significantly from the actual products. A render is an idea of what a project could look like — it is not a photograph of your finished property, not a measurement, and not a promise about how a real installation will look.
To make it, we send our AI provider a link to your photograph (and to any drawing, inspiration image or product reference that belongs with it), and the provider fetches the image and returns a new one. That provider is named in the table below. StoneSwap.ai does not use your photographs to train AI models of its own.
A second automated pass looks at the before-and-after pair afterwards to write a short title, description, project type and an estimated project value for StoneSwap. That pass is not given your name, your email or your full postal code — it sees the pictures, the products and a city, region and country.
Automated safety checks. Uploads and prompts are screened automatically for content and behaviour that breaks the Terms. A check can refuse a render, and in serious cases it can suspend or delete an account. If that happens to you and you believe it is wrong, write to the contact above and a person will review it.
Who else sees it
StoneSwap. Your contact details, your project details and your designs are available to StoneSwap so it can respond to you and understand its own customers.
A participating dealer. If you used an in-store kiosk, or if your enquiry is passed to a dealer so they can quote your project, that dealer receives your enquiry and the design it relates to.
Anyone you send a share link to. A share link is a long, unguessable web address that anyone holding it can open without signing in. It shows the design and the products in it — not your name, email or phone number. It is hidden from search engines, and it stops working once the design is deleted. Treat it like a key: if you would rather it were not out there, delete the design.
Our service providers. These companies process information on our instructions to make the Studio work. Each one gets only what its job needs:
| Provider | What it does | What it receives |
|---|---|---|
| fal.ai | Generates the images | Your photograph and any reference images, plus the text instructions for the design |
| Stripe | Takes payment for credit packs | Your email address, the amount and your card details, which you enter into Stripe’s own form |
| Resend | Sends our email | Your email address and the contents of the message we are sending you |
| Cloudflare | Delivers and protects the site | Your IP address and request details, and the approximate country and region derived from them |
Everyone else: no. The only other times we would hand your information over are when the law requires it, when we must to protect our rights or someone’s safety, or if the business is sold or reorganised — in which case it stays subject to a policy at least as protective as this one.
Where your information is kept
The Studio runs on servers in the United States, and the service providers listed above may process your information in the United States and other countries. That means your information is subject to the laws of those countries, and courts or authorities there may in some circumstances be able to require access to it. We use providers that commit to protecting it under contract, and we send each of them only what their job needs.
How long we keep it
Photographs and designs. StoneSwap chooses how long the Studio keeps them, between 5 and 365 days. For this Studio it is 365 days from the day a design is created. When that time is up an automatic job deletes the design, the image it produced and the photograph it was made from — from our servers and from our storage provider. If you want to keep an image, download it before then.
Your account. Your name, email, phone, postal code and location stay on your account for as long as the account is open. Delete the account and they go (see below).
Enquiries you send to StoneSwap. An enquiry is a business record of StoneSwap’s. Enquiries tied to your account go when you delete the account. One made without an account — at an in-store kiosk, for example — is kept until you ask StoneSwap to remove it, or until it is no longer needed for the purpose it was collected for.
What survives a deletion, and why. A short list, and the reason for each:
- Purchase records, because financial and tax law requires them. They record what was bought and for how much against an opaque account reference and the reference our payment provider uses — not your name or address.
- A one-way hash of your email address, for one purpose only: making sure a deleted account cannot be reopened to claim free renders again. It cannot be turned back into your address.
- The IP address, device reference and country the account was created from, for the same anti-abuse reason.
- The project summaries described above, as StoneSwap’s business data, with the link to you and your postal code stripped out first.
Everything else goes: your name, email address, phone number, postal code, location, profile picture, photographs, designs and saved uploads.
Your rights and choices
- See what we hold. Ask at the address above and we will tell you what information about you exists and where it came from.
- Correct it. Contractors can update their business details in Settings. For anything else that is wrong — your name, phone number or postal code — write to us and we will fix it.
- Delete it. You can do this yourself: open the menu, choose Settings → Account → Delete My Account. That erases your designs, the photographs behind them, your saved uploads and your enquiries, and strips the personal details from your account. Any credits you still hold are forfeited, and the short list under “what survives a deletion” above remains.
- Stop marketing email. Turn off Settings → Email Notifications to switch off non-essential mail from the Studio, and tell StoneSwap at the address above if you no longer want to hear from the brand itself. Essential messages — sign-in links, password resets, receipts and the delivery of a design you asked for — still get sent, because they are part of the service rather than marketing.
- Withdraw the location permission. Revoke it in your browser’s site settings at any time. Some parts of the Studio may stop working, because it needs to know it is allowed to serve you where you are.
- Take it with you. Ask and we will send you your account information in a portable file.
- Complain. If we have not put something right, you can complain to a regulator. In Canada that is the Office of the Privacy Commissioner of Canada; in Quebec it is the Commission d’accès à l’information; several provinces have their own commissioner. In the United States, your state Attorney General.
If you are in Canada, these rights come from PIPEDA and, in Quebec, from the province’s Law 25 — including the right to know that automated processing was used and to have a person look at a decision it made about you.
If you are in the United States, several states give residents comparable rights to know, delete and correct, and to opt out of the sale or sharing of personal information for advertising. We do not sell or share personal information for advertising, and we handle requests from US residents through the same contact and the same 30-day commitment.
Cookies
We do not use advertising cookies and we do not track you across other websites. There is no “accept all” banner because there is nothing optional to accept: the cookies below are the ones the Studio needs to work safely.
| Cookie | What it is for | How long |
|---|---|---|
st_csrf |
Security. It proves a form or button was submitted from this site and not from a malicious page somewhere else. | Until you close the browser |
ss_device |
Recognises this device, so free renders and account limits cannot be farmed by opening account after account. | 2 years |
st_sess_… |
Keeps you signed in after you log in. It holds a random token, not your details. | 30 days |
The same device identifier is also mirrored into your browser’s local storage so it survives a cookie clear — it is used for the same anti-abuse purpose and nothing else. Clearing your site data removes both.
How we protect it
Traffic is encrypted in transit. Each brand’s Studio has its own separate database, and one brand’s Studio can never read another’s. Names, emails, phone numbers and business details inside enquiry records are encrypted at rest with AES-256. Sign-in links and session tokens are stored only as one-way hashes, so even we cannot read them back. No system is perfectly secure, and if a breach ever put your information at real risk we will notify you and the regulators as the law requires.
Children
The Design Studio is built for adults planning work on a property and is not directed at children. We do not knowingly collect information from a child under 13. If you believe a child has given us information, write to the contact above and we will delete it.
Changes to this policy
If we change how the Studio handles your information we will update this page and the “last updated” date at the top. Where a change is significant, and the law requires your agreement, we will ask for it rather than assume it.
This policy is written to be read and understood rather than to be exhaustive. It describes how the StoneSwap Design Studio works today; it does not limit any right you have under applicable privacy law, and it is not legal advice.