Privacy Policy
What personal information Gardenroom Studio collects, why, who sees it, how long we keep it and your rights.
Last updated 10 October 2026
Who we are
Gardenroom Studio (“we”, “us”) runs the Gardenroom Studio service at https://3dgardenroomstudio.com. You can reach us at hello@3dgardenroomstudio.com. Gardenroom Studio is a trading name of Finnitrex Ltd, a company registered in England and Wales with number 16973401, whose registered office is 483 Green Lanes, London, England, N13 4BS.
This policy covers two groups of people. If you have an account with us, we are the controller of your account data. If you are a homeowner who sent an enquiry to a garden-room business through their website or widget, that business is the controller of your enquiry and we handle it on its behalf. The section “If you sent an enquiry to a business” explains how to reach them.
What we collect from account holders
| Information | Why we need it | Our lawful basis |
|---|---|---|
| Name, email address and a hashed password (we never store the password itself) | To create your account, sign you in and contact you about it | Contract |
| Sign-in details from Google, Microsoft or Apple, if you use them | To sign you in without a password | Contract |
| Session records: when you signed in, your IP address and browser type | To keep you signed in and to detect abuse | Legitimate interests (security) |
| Your workspace: business name, branding, team members and roles, website content, pictures, settings, API keys (stored hashed) and webhook addresses | To provide the service | Contract |
| Activity records: who changed what and when | To show you a history and to keep the service secure | Legitimate interests |
| Messages you send to the AI assistant and its replies | To answer you and carry out changes you approve | Contract |
| Billing details, handled by our payment provider, if you buy a paid plan | To take payment and keep records | Contract and legal obligation |
| Emails you send us | To reply and keep a record | Legitimate interests |
If you sent an enquiry to a business
When you use a garden-room designer or contact form powered by Gardenroom Studio, the form sends your name, email address, phone number if you gave one, your message, the garden-room design you made, and a record of your consent to that business. We also keep a one-way scrambled version of your IP address (not the address itself) so the business can spot abuse. The business named on the form decides what to do with your enquiry and is the controller of it. We process it for them to run the service, we do not use it for our own marketing, and we do not sell it.
To see, correct or delete your enquiry, or to object to how it is used, contact the business that you wrote to. If you cannot reach them, email us at hello@3dgardenroomstudio.com and we will pass your request on.
What we do not do
- We do not sell personal information.
- We do not use advertising or cross-site tracking cookies. See the Cookie Policy.
- We do not use your enquiries or your business data to train AI models.
- We do not make decisions about you that have legal effects by automated means.
Who we share it with
We use a small number of companies to run the service. They may only use personal information to provide their service to us. The list is kept in our Data Processing Agreement. In summary:
- Cloudflare, which hosts the web application, provides DNS and the secure tunnel to our server, and runs the Turnstile check that protects sign-up and enquiry forms from bots.
- Resend, which delivers our emails (sign-in links, enquiry notifications and confirmations). We send through its European (Ireland) region.
- Our servers, which run the database and the application programming interface.
- AI providers, only if you or your team use the assistant, described next.
- Stripe, or another payment provider, if you buy a paid plan.
- Professional advisers, and public authorities where the law requires it.
AI providers
The assistant can use the built-in model or a provider your workspace chooses: Anthropic, OpenAI or Google. When you use the assistant, your message, the conversation so far and the workspace information it needs to answer (for example, an enquiry you ask about) are sent to that provider. Do not include information in an assistant message that you would not want the provider to receive. You can choose not to use the assistant, and nothing else in the service depends on it.
Where your information goes
Some of our providers, including Cloudflare and the AI providers, process information outside the UK and the European Economic Area, including in the United States. When that happens we rely on an adequacy decision, such as the UK–US data bridge, or on approved safeguards like the International Data Transfer Agreement or standard contractual clauses, together with the provider’s own commitments.
How long we keep it
- Account data: for as long as your account exists, and a short period afterwards while we finish deleting it.
- Workspace data and enquiries: until you or the workspace owner delete them. Workspace owners can delete enquiries one at a time or delete the whole workspace.
- Billing records: for the period tax law requires, currently six years.
- Security and activity logs: for a limited period, then deleted or reduced to what is needed to investigate abuse.
- Emails you send us: for as long as needed to deal with your request and any follow-up.
When something is deleted it leaves our live systems straight away. Backups, where we keep them, are overwritten on a normal cycle.
How we protect it
Each business’s data is kept separate from every other business’s at the database level, not just in the application. Connections are encrypted, passwords are hashed, API keys are stored hashed, access is limited by role, and our application and database are not exposed directly to the internet; traffic reaches them through an encrypted tunnel. No system is perfectly secure. If a breach puts your rights at risk we will tell you and the regulator as the law requires.
Your rights
Under UK data protection law you can ask us to:
- tell you what we hold about you and give you a copy;
- correct anything that is wrong;
- delete your information;
- limit how we use it;
- give it to you in a form you can move to another service;
- stop using it where we rely on legitimate interests, or stop emailing you marketing at any time.
Email hello@3dgardenroomstudio.com and we will answer within one month. You do not have to pay a fee. We may ask you to prove who you are first. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113, though we would like the chance to put things right first.
Children
The service is for businesses and is not aimed at people under 18. We do not knowingly collect information from children. If you think we have, tell us and we will delete it.
Changes to this policy
If we change this policy in a way that matters we will tell account holders by email or in the app before it applies. The date below always shows the latest version.