PRIVACY POLICY
ARCHIBI AI PRIVACY POLICY
Effective Date: January 1, 2024
Last Updated: September 15, 2026
Uritect Inc. (“Uritect,” “Archibi,” “we,” “us,” or “our”) respects your privacy.
This Privacy Policy explains how we collect, use, disclose, store and otherwise process personal information when you use the Archibi AI mobile applications, websites and associated services (“Archibi” or the “Services”).
For the personal information described in this Policy, Uritect Inc. is generally responsible for deciding why and how the information is processed, except where an independent third party processes information for its own purposes.
Archibi uses third-party artificial-intelligence services, including Replicate and Black Forest Labs, to process AI-generation requests. Please read the AI Processing section carefully.
1. Information We Collect
The information we collect depends on how you use Archibi.
1.1 Account information
When you create or maintain an account, we may collect information such as:
your name;
email address;
user/account identifier;
authentication information;
account preferences;
subscription level; and
information received from an authentication provider if you choose Sign in with Apple, Google or another supported login method.
We do not need your full payment-card number to manage an Apple App Store or Google Play subscription. The applicable store handles payment details and may provide Archibi with transaction receipts, product identifiers, subscription status and related purchase information.
1.2 Photos, sketches, prompts and AI content
When you use Archibi’s AI functionality, we may collect and process:
photographs you upload;
camera images you choose to submit;
architectural sketches or drawings;
text prompts;
design selections and generation settings;
reference images;
information about the requested design style;
generated renders and other Outputs; and
technical metadata necessary to process the generation.
A photograph of a home or interior can itself contain personal information—for example, a person’s likeness, family photographs, an address visible in the image or other details about a private residence.
For that reason, Archibi prohibits uploading reasonably identifiable people without the permissions required under our Terms.
Archibi does not intend to use images to identify or authenticate people through facial recognition.
1.3 Saved projects and content
If you save a project, we may store the original images, generated renders and associated project information so that you can return to them later.
Under the assumptions for this Policy, originals and generated renders remain associated with your account until you delete them, delete the relevant project, or delete your account, subject to limited backup, security and legal retention described below.
1.4 Subscription, credit and transaction information
We may collect:
the plan you purchased;
billing interval;
purchase date;
transaction or order identifier;
store receipt/token;
subscription renewal and expiration status;
number of credits allocated;
number of credits consumed;
top-up purchases;
refund/cancellation status; and
general billing country or currency information supplied by the applicable merchant.
Where purchases are made directly from Uritect, our payment processor may process payment-card and billing information on our behalf. The direct-payment provider should be identified here once selected: [INSERT PAYMENT PROCESSOR].
1.5 Usage and device information
When you use Archibi, we or our service providers may automatically receive information such as:
IP address;
device type and model;
operating-system version;
app version;
language and locale;
approximate geographic area inferred from technical information;
Firebase or other installation identifiers;
dates and times of use;
features opened or used;
generation events;
session and performance information;
error information;
crash information, if crash reporting is enabled; and
security and fraud-prevention logs.
We do not collect precise GPS location unless a feature specifically requests it and you grant the required device permission.
1.6 Find a Pro information
If you use Find a Pro, we may process information needed to perform your search, such as a city, postal code, general area, type of project or type of Professional requested.
If you choose to contact or request contact from a Professional through Archibi, we may transmit the information you deliberately provide for that purpose to that Professional.
Once a Professional receives your information in their own capacity, their privacy practices may also apply.
1.7 Furniture and Decor Discovery
When you use a product-discovery feature, we may collect information about products or product categories you view or links you select.
If you leave Archibi for a retailer’s website or app, the retailer may collect information in accordance with its own privacy policy.
Some links may contain affiliate or referral information so a retailer can determine that the visit originated from Archibi.
1.8 Communications and support
If you contact us, we may collect your:
name;
email address;
message;
screenshots or attachments you voluntarily submit;
support history; and
other information reasonably necessary to respond.
2. Why We Use Personal Information
We use personal information where reasonably necessary to:
create and administer accounts;
authenticate users;
provide AI image generation and editing;
store and retrieve projects;
deliver subscription benefits and credits;
process and verify transactions;
provide Find a Pro and Furniture Discovery functions;
respond to support requests;
communicate important service, security or policy information;
detect fraud, unauthorized access and abuse;
enforce our Terms of Service;
diagnose crashes and technical problems;
understand how Archibi is used;
improve usability and product performance;
develop new features using aggregated or appropriately de-identified information;
comply with legal obligations;
establish, exercise or defend legal rights; and
protect users, Uritect and third parties.
Where consent is required, we rely on consent. Where applicable law recognizes other lawful grounds, processing may also occur because it is necessary to provide the service you requested, comply with law, or pursue a legitimate business purpose that does not override applicable privacy rights.
Canadian privacy guidance emphasizes that consent should be meaningful—that users should understand the nature, purposes and consequences of processing—and generally calls for stronger, express consent where information or uses are sensitive or outside reasonable expectations.
3. AI Processing by Replicate and Black Forest Labs
This is an important part of Archibi.
Archibi currently uses FLUX.2 [max], developed by Black Forest Labs, through Replicate.
When you ask Archibi to generate or edit an image, Archibi may send the following to AI providers:
your uploaded photograph, image or sketch;
your text prompt;
reference images;
generation parameters;
and related technical information required to fulfill the generation.
These parties may process the information outside Canada.
Replicate. Replicate states that, by default, for predictions created through its API, prediction inputs, outputs, output files and logs are automatically removed approximately one hour after the prediction completes. This provider-side deletion does not delete Archibi’s independently stored copy of your upload or generated render.
Black Forest Labs. BFL’s current public Privacy Policy says its services may receive prompts, reference files, uploaded content and generated outputs. It also states that inputs, tasks and outputs submitted to its services may be used to train and improve its AI models after safeguards such as minimization and de-identification. BFL notes that content processed under an enterprise customer agreement may instead be governed by that agreement.
Therefore, unless and until Uritect has provider terms that expressly establish different treatment, you should understand that content sent for AI processing may be subject to provider service-improvement or model-improvement processing as permitted by the applicable provider agreement.
Uritect itself does not use your privately stored photographs or renders to train a Uritect-owned AI model unless you separately and affirmatively opt in to such a program.
Before Archibi sends personal information in an upload to a third-party AI provider, we will obtain explicit permission where required. Apple’s current app-review policy specifically requires disclosure and explicit permission before personal data is shared with third-party AI.
If you do not consent to this AI processing, you should not submit content to the AI-generation features. Other non-AI features may remain available where technically possible.
4. Information About People in Uploaded Images
You must not use Archibi to upload photographs containing reasonably identifiable people unless you have the permission or other lawful authority required for AI processing.
An incidental person in the background of a building, landscape, garden or public-area photograph may be included only if that person is not reasonably identifiable.
The fact that a photograph was taken in public does not automatically make processing an identifiable person’s likeness appropriate.
BFL currently requires the developer submitting an image to have the necessary rights and permissions concerning a person’s likeness and expressly prohibits uploading images of individuals without consent.
Archibi’s AI tools must not be used to submit images, videos or personal data relating to people under 18 while the applicable upstream provider restriction remains in effect.
5. Analytics and Firebase
Archibi uses Google Analytics and Firebase for analytics and application infrastructure.
Depending on which Firebase components Uritect enables, Google may process information such as device identifiers, IP addresses, authentication information, app-installation identifiers, crash information and usage/performance events.
Google describes Firebase customers as generally responsible for their end users’ information, while Google generally acts as a processor/service provider for applicable Firebase services. Firebase services can operate on global Google infrastructure; Firebase Authentication is currently described as operating from U.S. data centres.
Google Analytics permits standard properties to set user-level and event-level retention to 2 or 14 months. Uritect’s recommended Archibi configuration is 2 months for user/event-level analytics data unless a longer period becomes reasonably necessary and is appropriately disclosed. Aggregated reporting can behave differently from user/event-level retention.
We do not intentionally send the contents of your private photographs or AI prompts to Google Analytics as analytics event parameters.
6. Payments
Purchases made through the Apple App Store are processed by Apple, and purchases made through Google Play are processed through Google’s applicable payment systems.
Uritect may receive transaction information needed to confirm your purchase and entitlement but ordinarily does not receive the full payment-card number used for an App Store or Google Play transaction.
If Uritect offers direct web purchases, payment information will be processed by [INSERT DIRECT PAYMENT PROCESSOR] in accordance with that provider’s privacy policy.
7. Hosting and Infrastructure Providers
Archibi uses cloud-hosting, storage, database and network providers to operate the Services.
Production version before publication:
Primary hosting/storage provider: [INSERT PROVIDER AND RELEVANT REGION(S)].
Our service providers are authorized to process information only for applicable service purposes and subject to contractual, security or legal requirements appropriate to their role.
Canadian privacy guidance provides that organizations remain accountable for personal information transferred to third parties for processing and should use contractual or other measures to provide an appropriate level of protection.
8. Who We Share Information With
We may disclose personal information to the following categories of recipients.
AI service providers. Replicate, Black Forest Labs and providers necessary to fulfill AI-generation requests.
Cloud and technology providers. Hosting, databases, storage, authentication, security, content-delivery and other infrastructure services.
Analytics and diagnostic providers. Google Analytics and applicable Firebase services.
Payment and app-store providers. Apple, Google and [DIRECT PAYMENT PROCESSOR, IF ANY].
Support and communications providers. Services we use to receive and respond to customer communications: [INSERT SUPPORT/EMAIL PROVIDER IF APPROPRIATE].
Professionals. When you deliberately ask to contact or be contacted by a Professional through Find a Pro.
Retailers. When you voluntarily visit a third-party retailer through Furniture Discovery.
Professional advisers. Lawyers, accountants, insurers, auditors and similar advisers where reasonably necessary.
Authorities and legal recipients. Where we reasonably believe disclosure is required by law, valid legal process, or necessary to protect rights, safety or security.
Business transactions. Information may be disclosed in connection with a merger, financing, restructuring, sale of assets or acquisition, subject to appropriate confidentiality protections and applicable law.
We do not sell private photographs or generated project content as a data-broker product.
We do not disclose private project photographs to advertisers for behavioral advertising.
9. International Processing
Uritect is based in Canada, but some service providers operate in the United States and other countries.
Your personal information may therefore be processed or stored outside your province or country of residence.
Information processed in another jurisdiction may be subject to that jurisdiction’s laws and may be lawfully accessible to courts, law-enforcement agencies or governmental authorities in that jurisdiction.
Canadian privacy regulators recognize that cross-border processing can be used but emphasize that the Canadian organization remains accountable and should provide transparency and appropriate contractual or other protections.
10. How Long We Keep Information
We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, to provide your account and Services, to comply with legal requirements, and to resolve disputes, prevent fraud and enforce agreements.
Our proposed production retention schedule appears below in this report. It should be technically validated before this Policy is published.
In general:
account and saved-project information is retained while your account is active;
original images and generated renders saved to your account are retained until you delete them or delete your account;
deleted content may persist temporarily in backups;
transaction records may be retained for accounting, tax, fraud-prevention and legal purposes after account deletion;
security information may be retained where necessary to investigate abuse or protect the Services; and
third-party processors may maintain information under their own applicable retention schedules.
Replicate’s default API-prediction retention is approximately one hour, but Archibi’s own copy remains until deleted according to Archibi’s retention practices.
11. Deleting Individual Photos, Projects and Renders
Where the app provides the functionality, you may delete an original upload, project or generated render from within Archibi.
Deletion removes the content from normal active-account access. Residual copies may remain temporarily in protected backups and logs and may be retained where required for security, legal obligations or dispute resolution.
Deleting Archibi’s stored copy does not necessarily reverse processing that was already completed by an AI provider.
12. Account Deletion
You may request deletion of your Archibi account through the in-app account-deletion feature.
Android and web users will also be provided with an external account-deletion request page at:
[INSERT PUBLIC ACCOUNT-DELETION URL]
You may also contact [email protected] if you encounter a problem with the deletion process.
When an account-deletion request is validly completed, we will delete or de-identify personal information associated with the account except information that we reasonably need or are legally required to retain, for example:
transaction and tax records;
records necessary to prevent fraud or repeated abuse;
security incident records;
records required by law; or
information necessary for an existing legal claim.
Apple currently requires apps offering account creation to permit users to initiate deletion from within the app, while Google requires both an in-app mechanism and a web-based deletion option for covered apps.
Important: deleting your Archibi account may not cancel an Apple or Google subscription. You should separately cancel your store subscription through the applicable store account if you do not want it to renew.
13. Children and Minors
Archibi is not designed as a children’s service.
Users aged 16 or older may create an account, subject to any higher age required by applicable law.
A person under 16 may use Archibi only where legally permitted and with the consent and supervision of a parent or legal guardian. Uritect may require verification of that consent.
However, because the AI provider currently used by Archibi prohibits submission of images, videos or personal information relating to individuals under 18, no user may submit personal information, photographs or likenesses concerning a person under 18 through Archibi’s FLUX-powered AI features.
This includes a user’s own image if the user is under 18.
Where appropriate, Uritect may disable AI upload features for accounts identified as belonging to minors.
If we learn that personal information from a child has been collected without consent or authority required by law, we will take reasonable steps to remove it.
Parents or guardians may contact [email protected] regarding a minor’s information.
14. Security
We use reasonable administrative, technical and organizational safeguards appropriate to the nature of information we process.
These measures may include access controls, authentication measures, encrypted transmission, restricted administrative access, monitoring and service-provider safeguards.
No online service, cloud system or method of electronic storage is completely secure. We therefore cannot guarantee absolute security.
You should maintain a strong password, protect access to your email and devices and notify us if you believe your account has been compromised.
15. Your Privacy Rights
Depending on where you live, you may have rights to:
ask whether we hold personal information about you;
access personal information we hold;
request correction of inaccurate information;
withdraw consent to certain processing;
request deletion;
object to or restrict certain processing;
request portability where applicable;
opt out of certain marketing communications; and
make a complaint to an applicable privacy regulator.
Withdrawal of consent does not invalidate processing that lawfully occurred before the withdrawal. If information is necessary to provide an AI feature, withdrawing consent to that processing may mean the feature can no longer be provided.
We may take reasonable steps to verify your identity before fulfilling a privacy request.
Requests may be sent to:
Privacy Officer
Uritect Inc.
[email protected]
Toronto, Ontario, Canada
Under PIPEDA’s accountability principle, an organization should designate responsibility for compliance with privacy obligations.
16. Marketing Communications
We may send transactional or service communications reasonably necessary to administer your account, including security notices, receipts, subscription information and important policy changes.
Where permitted, we may send promotional communications. You may opt out of promotional email using the unsubscribe mechanism or by contacting us.
Opting out of marketing does not prevent necessary account, purchase, security or legal communications.
17. AI Model Training and Product Improvement
Uritect may use aggregated or appropriately de-identified information to analyze and improve Archibi.
Under this draft policy, Uritect does not use private original photographs, sketches or generated projects to train a Uritect-owned generative AI model unless the user separately opts in.
This limitation does not necessarily determine what an upstream AI provider may do under its own applicable service agreement.
As explained above, BFL’s current public Privacy Policy states that content submitted to its services may be used for model training and improvement after safeguards, while certain enterprise-contract processing may be subject to separate terms.
Uritect should periodically review the Replicate/BFL contract governing Archibi so this disclosure remains accurate.
18. Third-Party Websites
Archibi may link to Professionals, retailers and other websites or services that Uritect does not control.
Once you leave Archibi or directly interact with an independent third party, the third party’s terms and privacy practices apply.
A link does not mean that Uritect controls the third party’s privacy practices.
19. Changes to This Privacy Policy
We may update this Privacy Policy when our products, providers, data practices or legal obligations change.
We will update the “Last Updated” date when we revise it.
If a change materially expands the purposes for which we use personal information, materially expands the categories of parties with which sensitive information is shared, or otherwise requires new consent, we will provide additional notice and obtain consent where required.
We may provide notice through Archibi, email or another reasonable method.
We will not rely only on a clause stating that users must continually check the Policy where applicable law requires meaningful notice or renewed consent.
Canadian privacy guidance recognizes that significant changes in privacy practices can require meaningful notice and, where appropriate, renewed consent.
20. Contact Us
For questions, access or deletion requests, complaints or other privacy matters:
Privacy Officer
Uritect Inc.
University of Toronto, Schwartz Reisman Innovation Campus 108 College St., Suite W754, Toronto,
Ontario, Canada
Email: [email protected]
Subject line: Privacy Request