Privacy notice

Last updated: 29 October 2026

This notice explains how personal data is processed on refabs.eu and in the REFABS application at app.refabs.eu (together, "REFABS"), under the EU General Data Protection Regulation (GDPR).

1. Controller

Company: BY 7 d.o.o.
Address: Tehnološki park 18, 1000 Ljubljana, Slovenia
Registration no.: 9481095000
Contact: info@refabs.eu

2. Data protection officer

We have not appointed a data protection officer, as we are not required to. For any question about your data, write to info@refabs.eu.

3. What we collect

Account data: your e-mail address, name and, if you sign in with Google, your Google profile name and picture; your account ID, role and sign-in times.
Content you create: house briefs, prompts and chat messages, uploaded images (sketches, floor plans, reference photos), the location and data of your parcel, and the designs, 3D models, renders, budgets and element lists generated for you.
Technical and usage data: IP address, browser and device information, server and security logs, generation logs, the screens and functions you use in the application, and daily usage counts.
Communication: what you write to us, for example in a support request.

4. Purposes and legal bases

Providing REFABS: your account, generating and saving your designs (Art. 6(1)(b) GDPR, contract).
Security and abuse prevention: bot protection, usage limits, logs, investigating faults and misuse (Art. 6(1)(f), legitimate interest).
Research and development: we use what users create on our servers, including prompts, briefs, uploaded images and generated designs, to improve REFABS and to train and evaluate our own AI models (Art. 6(1)(f), legitimate interest in developing our product). You can object at any time (section 9). Once content has been used to train a model, its influence cannot always be removed from that model, but it will not be used in further training after your objection or the closure of your account.
Support: when you ask us for help, for example in a support ticket, REFABS administrators can view your account and your projects to resolve it. Administrators may also do so when it is necessary to investigate a fault or misuse (Art. 6(1)(b) and (f)).
Marketing e-mails: news, product updates and offers about REFABS, sent to the e-mail address of your account where the law allows us to e-mail existing users about our own similar services, or with your consent (Art. 6(1)(f) or (a)). Every e-mail lets you unsubscribe, and you can also opt out by writing to us.
Analytics: understanding how REFABS is used, with Google Analytics, only if you accept analytics cookies (Art. 6(1)(a), consent; see section 10).
Legal obligations, for example accounting and answering lawful requests from authorities (Art. 6(1)(c)).

We do not sell your personal data, and we do not give your content to third parties for their own purposes.

5. Recipients and processors

We use these service providers. They process data on our behalf and only for the purposes above.

Authentication (sign-up, sign-in, account e-mails): Clerk, Inc., USA.
Hosting of the application and its database: Hetzner Online GmbH, Germany.
Network, content delivery and security: Cloudflare, Inc., USA (global network).
AI generation of designs, images and texts: OpenRouter, Inc., USA, and the AI model providers it routes requests to; TypeSafe; Higgsfield AI, Inc., USA, for renders and videos. They receive the content needed for a generation (for example your brief, prompt or images), not your account data.
Maps, place search and 3D surroundings: Google (Google Ireland Limited / Google LLC) and Cesium GS, Inc., USA.
Analytics, only with your consent: Google Ireland Limited.
Our e-mail service provider for marketing e-mails.

For cadastral parcel data we query the public records of the Surveying and Mapping Authority of the Republic of Slovenia (GURS). We send the parcel location or number, not your identity.

6. Transfers outside the EU/EEA

Some of the providers above are based in the USA or process data there. These transfers rely on the EU–US Data Privacy Framework where the recipient is certified under it, and otherwise on the European Commission's standard contractual clauses.

7. Retention

Account data and your content are kept for as long as your account is open.
When your account is closed, we delete them from our live systems within 30 days. Database backups are overwritten within a further 14 days.
Technical logs are kept only as long as needed for security and troubleshooting.
Data we must keep by law, for example accounting records, is kept for the period the law requires.
Analytics data is kept according to the retention set in Google Analytics, at most 14 months.

8. Children

REFABS is not intended for anyone under 18, and we do not knowingly collect their data.

9. Your rights

Under the GDPR you have the right to:

access the personal data held about you (Art. 15);
have inaccurate data rectified (Art. 16);
have your data erased, including by closing your account (Art. 17);
restrict processing (Art. 18);
data portability (Art. 20);
object to processing based on legitimate interest (Art. 21), including the use of your content for research, development and model training, and to marketing e-mails at any time;
withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before the withdrawal.

To exercise them, or to close your account, write to info@refabs.eu from the e-mail address of your account. We answer within one month.

10. Cookies

refabs.eu sets no cookies of its own. Cloudflare may set a strictly necessary security cookie (__cf_bm, 30 minutes) to tell people from bots.
app.refabs.eu uses strictly necessary cookies to keep you signed in (Clerk, for example __session, __client_uat and __client, for the length of your session or up to one year) and for bot protection (Cloudflare, for example __cf_bm and cf_clearance). The application also keeps some settings in your browser's local storage. These do not need your consent.
Analytics cookies (Google Analytics, _ga and _ga_*, up to 2 years) are set only after you accept them in the cookie banner. You can change your choice at any time.

11. Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work or place of the alleged infringement. In Slovenia this is the Information Commissioner (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si, www.ip-rs.si.

12. Changes

We update this notice when our processing changes. The date at the top shows the current version. We tell you about material changes by e-mail or in the application before they take effect.