Legal

Data processing

What we do with the images and metadata you upload.

Last updated: June 2026

Processing flow

  1. You upload product images, catalogue pages, room photos, and metadata.
  2. Files are stored on encrypted-at-rest storage we control.
  3. For each visualisation we send the relevant product image, room image, and a textual prompt (with product metadata) to our AI provider over an encrypted connection.
  4. The AI provider returns a generated image which we store as a new asset and link to the visualisation record in our database.

AI provider

We currently use OpenAI (the gpt-4o and gpt-image-1 models) as our default AI provider. OpenAI processes the content we send to produce the generated visualisation and may, per their terms, log requests for a limited retention period for abuse prevention. Enterprise customers can request a bring-your-own-key configuration that routes inference through their own OpenAI account.

Sub-processors

  • OpenAI — AI inference and image editing.
  • MongoDB Inc. — Database hosting for account and visualisation metadata.
  • Vercel — Web hosting and serverless compute.

What is NOT sent to AI providers

  • Your account email or password.
  • Your billing information.
  • Demo visitor cookie IDs or hashed IP addresses.

Data residency

Default deployments run in the United States or European Union depending on your account region. Enterprise customers may request a specific region in their order form.

Deletion

When you delete content from the platform we delete it from storage immediately and from backups within 30 days. We can issue best-effort deletion requests to AI providers on your behalf where their APIs support it.

DPA

A Data Processing Addendum (DPA) is available for Growth and Enterprise customers on request. Email [email protected] to receive a copy.

Data processing | Foresee Commerce