Privacy Policy

Cartelier is operated by Ravit Shoval, an individual sole trader based in Israel. There is no company behind Cartelier at this time, which means Ravit Shoval is personally the data controller for the purposes of the EU and UK GDPR, and the business responsible for personal information under California law.

You can reach us at ravit@cartelierai.com or support@cartelierai.com.

We have not appointed a data protection officer, and we are not required to.

This policy takes effect on 12 October 2026 and applies to the Cartelier website and web application at cartelierai.com.

Cartelier is currently in beta. The product changes often, and so will this policy. We will tell you when it does, as described under Changes to this policy.

We do not ask for and do not collect payment details, government identifiers, health information, precise GPS location, contacts, or camera and photo library access. Cartelier does not request access to your camera, your photo gallery or your device location. You choose and upload image files yourself.

We do not knowingly collect special category data under GDPR, such as information revealing health, religion, ethnicity or sexual orientation. Please do not upload images that reveal such information about yourself or anyone else.

When you upload an image of a room, or create a design in Cartelier, that image is sent to OpenAI, which processes it so that we can generate your design and identify products in it. OpenAI acts as our processor and handles the image on our instructions only.

Your images are not used to train AI models. Not ours, and not OpenAI's. We use OpenAI's API, where content submitted through the API is not used to train its models by default.

Your images are stored as part of your saved project history, so that you can come back to a project. They stay in your account until you delete the project or your account, or until the retention period below ends.

We do not publish your images, show them to other users, or use them in marketing.

If you are in the EEA or the UK, GDPR requires us to have a legal basis for each use.

We do not send newsletters or marketing emails. The only email we send is the one-time confirmation of your beta registration, plus any reply to a message you send us. We may send service messages, such as a security notice or a change to this policy.

We do not run advertising on Cartelier, we do not use your information for advertising, and we do not use retargeting or advertising pixels.

We do not make decisions about you by automated means that produce legal or similarly significant effects.

Cartelier uses cookies and browser local storage. Local storage works like a cookie: it keeps small pieces of data in your browser. Where this policy says cookies, it means both.

If you are in the EEA or the UK, analytics cookies are set only after you accept them in the cookie banner. Elsewhere, analytics cookies are on by default and you can turn them off. Wherever you are, you can change or withdraw your choice at any time through the cookie icon in the corner of every page. Withdrawing consent does not affect processing carried out before you withdrew it.

Google Analytics 4 is provided by Google. It collects an analytics identifier, your IP address, which Google truncates, your approximate location derived from it, and details of how you use the site. We have not enabled Google Signals, advertising features or data sharing with Google advertising products. You can also install Google's browser add-on to opt out of Google Analytics across all websites.

You can block or delete cookies in your browser settings. If you block strictly necessary cookies, you will not be able to sign in.

California law requires us to tell you how we respond to browser Do Not Track signals.

We honour the Global Privacy Control (GPC) signal. If your browser or extension sends GPC, we treat it as a request to opt out of any sale or sharing of personal information and we do not set analytics cookies.

We do not respond to the older Do Not Track (DNT) header, because there is no agreed standard for what it should mean. You can control analytics through our cookie banner instead.

We do not allow third parties to collect personal information about your activity across different websites through Cartelier.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have never done so.

We share information only with service providers who process it on our instructions:

We may also disclose information if the law requires it, to respond to a lawful request from an authority, or to establish or defend legal claims. If Cartelier is ever sold or transferred, your information may transfer with it, and we will tell you before that happens.

Cartelier is operated from Israel, and our providers are mostly in the United States. If you are in the EEA or the UK, your information is transferred outside your country.

Israel has an adequacy decision from the European Commission, which means transfers from the EEA to Israel are permitted without additional safeguards. For transfers to providers in the United States, we rely on the European Commission's Standard Contractual Clauses, together with the UK Addendum where the UK GDPR applies.

You can ask us for a copy of the safeguards we use.

We may keep information longer where the law requires it, or where we need it to establish or defend a legal claim.

If you are in the EEA or the UK, you have the right to:

• Access a copy of the personal information we hold about you
• Rectify information that is wrong or incomplete
• Erase your information, in the circumstances the law allows
• Restrict how we use your information while a dispute is resolved
• Object to processing we carry out on the basis of legitimate interests
• Portability: receive the information you gave us in a structured, machine-readable format
• Withdraw consent at any time, for anything we do on the basis of consent, such as analytics cookies

To exercise any of these, email ravit@cartelierai.com or support@cartelierai.com. We answer within 30 days. We may need to confirm who you are before we act, to make sure we do not disclose your information to someone else.

There is no charge, unless a request is clearly unfounded or excessive.

You can also complain to your local data protection authority. In the UK that is the Information Commissioner's Office.

This section applies if you are a California resident, under the CCPA as amended by the CPRA.

What we collect. In the past 12 months we have collected these categories of personal information:

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the past 12 months. We do not sell or share the personal information of anyone, including minors under 16.

Your rights. You have the right to know what we collect and how we use it, to request a copy, to request correction, to request deletion, and to limit the use of sensitive personal information. We do not use or disclose sensitive personal information beyond the purposes permitted without a right to limit.

How to exercise them. Email ravit@cartelierai.com or support@cartelierai.com. We confirm receipt within 10 business days and answer within 45 days, extendable once by a further 45 days if we tell you why. You may use an authorised agent, who must provide written permission from you.

No discrimination. We will not deny you service, charge a different price or give you a lower quality of service because you exercised a privacy right.

Opt-out signals. We honour the Global Privacy Control, as described above.

Cartelier is not for children. You must be at least 16 years old to create an account or use the service.

We do not knowingly collect personal information from anyone under 16. If we learn that we have, we delete the account and the information promptly. If you believe a child under 16 has given us personal information, email ravit@cartelierai.com and we will remove it.

We protect your information with encryption in transit, access controls on our systems, and providers who maintain their own security programmes.

No service can promise perfect security. If a breach affects your personal information and is likely to put your rights at risk, we will tell you and the relevant authority as the law requires.

We will update this policy as Cartelier develops. The effective date at the top always shows the current version.

If a change materially affects how we use your information, we will tell you by email or through a notice in the product before it takes effect, and where the law requires it, we will ask for your consent again.

For anything in this policy, including a request to exercise your rights:

• ravit@cartelierai.com
• support@cartelierai.com