Decofy

GDPR overview

GDPR is addressed explicitly rather than in passing. The privacy policy, in force since 9 June 2025, names its legal bases under both the EU and UK GDPR — contract performance, legitimate interests, consent and legal obligation — and grants access, rectification, erasure, portability and restriction rights, exercised by email or through in-app data controls. International transfers rely on adequacy decisions and standard contractual clauses. The minimum age rises from 13 to 16 where the GDPR applies, and breach notification is promised within 72 hours. Two gaps matter for European users: no Article 27 EU representative is designated and no data protection officer is named, for a company with no European entity or address. No data processing agreement is published or offered anywhere on the site.

Who owns the data?

Under the terms you keep all rights to the photos and prompts you upload and to the AI renders produced from them, and Decofy states plainly that it claims no ownership over either. In exchange you grant Decofy and its affiliates a worldwide, royalty-free, sublicensable licence to host, store, reproduce, modify and display that content, limited to three purposes: running the service, improving its models where you have consented, and showing anonymised examples in marketing unless you opt out. Feedback is treated far more harshly: anything you suggest becomes non-confidential and Decofy keeps a perpetual, irrevocable licence over it. Renders may also resemble other users' results and may not qualify for protection everywhere.

Reuse rights

Ownership and licence pull in opposite directions here, and it is worth reading both. Because you retain rights to your uploads and to the renders, you may reuse them without asking Decofy for permission. But the licence Decofy grants you over the service itself is restricted to personal, non-commercial use, and that narrower clause governs what you may legitimately do with the app. The terms also warn that AI output may echo publicly available data or third-party styles, and place the burden of diligence on you: run trademark and copyright checks before relying on a render commercially. On the input side, your images and prompts are processed to generate the design and hold chat context, and are not used to train public models unless you explicitly opt in.

Data retention & training

Hosting summary

The privacy policy states that data may be processed in Canada, the United States and the European Union, without naming a primary location or a hosting provider for the platform itself. Google Cloud is named, but for image analysis and storage rather than as the general host. Transfers between those jurisdictions rely on adequacy decisions, standard contractual clauses and encryption in transit and at rest. On security, the company describes TLS in transit, AES-256 at rest, zero-trust segmentation, role-based access control, regular penetration testing and a bug bounty programme, with breach notification to regulators and affected users within 72 hours. One technical caveat: the domain resolves to a Cloudflare anycast address, which identifies a content-delivery node and says nothing about where the origin servers sit. The company is registered in Washington State with no European entity, so European users should read the Canadian and US processing as the likely reality.