Privacy Policy

This Privacy Policy explains what personal data we collect when you use KWAL Cabinet Studio (app.kwal.design) and this website (kwal.design), why we collect it, and what rights you have. We process personal data in accordance with the EU General Data Protection Regulation (GDPR).

1. Data controller

KWAL design — Sollenberg 37, 1654 Huizingen, Belgium, VAT BE 0865 626 812.
Contact for all privacy matters: hello@kwal.design.

2. What data we collect

Account data

When you create an account, we collect your e-mail address and authentication data. Authentication is handled by Supabase (our authentication and database provider). We do not see or store your password in readable form.

Project data

Your cabinet designs, room layouts, material choices and generated exports are stored so you can access them across sessions. This data is stored in our Supabase database and is linked to your account.

Payment data

Payments are processed entirely by Lemon Squeezy as Merchant of Record. Your payment card details are collected and processed by Lemon Squeezy — not by us. We receive only order-related information needed to credit your account (such as your e-mail address, product purchased and order status). See Lemon Squeezy's Privacy Policy for how they handle payment data.

Technical data

Like most websites, our hosting infrastructure processes IP addresses and basic request logs for security and reliability purposes. [If analytics are added later, list the tool and data collected here.]

3. Why we process this data (legal bases)

• Performance of a contract — account management, storing your projects, delivering exports, crediting purchases (Art. 6(1)(b) GDPR).
• Legitimate interest — security, abuse prevention, service reliability (Art. 6(1)(f) GDPR).
• Legal obligation — bookkeeping and tax records related to sales (Art. 6(1)(c) GDPR).

4. Processors and recipients

We share data only with the service providers needed to run the Service:

• Supabase — authentication, database and storage of account and project data.
• Vercel — hosting of the website and application.
• Lemon Squeezy — payment processing, invoicing and tax handling as Merchant of Record.
• Google Cloud — server-side generation of PDF documents.

Where these providers process data outside the European Economic Area, transfers are safeguarded by EU Standard Contractual Clauses or an equivalent adequacy mechanism. We do not sell personal data to anyone.

5. Cookies

The marketing site at kwal.design sets no advertising or cross-site tracking cookies. The application at app.kwal.design uses strictly necessary cookies / local storage for authentication and session management. The Lemon Squeezy checkout may set cookies required to process your payment.

6. Retention

We keep your account and project data for as long as your account exists. When you delete your account, your personal data and projects are deleted within 30 days, except for order records we must keep for tax and bookkeeping purposes (retained for the legally required period, currently 7 years in Belgium).

7. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased ("right to be forgotten");
• receive your data in a portable format;
• restrict or object to certain processing.

To exercise any of these rights, e-mail us at hello@kwal.design. We respond within 30 days. You also have the right to lodge a complaint with the Belgian Data Protection Authority ( gegevensbeschermingsautoriteit.be) or your local supervisory authority.

8. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the latest version, and material changes will be announced via the Service.