Layrax

隐私协议

最后更新：2026 年 8 月 5 日

Layrax（以下简称“我们”）尊重并依法保护你的隐私。本协议说明我们收集、使用、共享和保护个人信息的方式，适用于 Layrax 网站及相关服务（以下简称“本服务”）。本协议参照国际隐私法规（包括 GDPR 与 CCPA）起草。

本服务由 【请填写：公司全称】（注册号 【请填写：注册号 / 统一社会信用代码】，地址 【请填写：实体地址】）运营。如对本协议有任何疑问，请联系 privacy@layrax.com 或 contact@layrax.com。

1. 我们收集的信息

为提供 AI 室内装修设计服务，我们可能收集：

  • 账号信息：注册与登录所需的邮箱、昵称、头像、登录凭据与账号偏好。
  • 你上传的内容：户型图、CAD 图纸、房间或空间照片、提示词、风格偏好、项目备注等，用于生成设计方案。
  • 生成内容：由 AI 生成或辅助生成的设计方案、效果图、图纸、编辑记录与项目历史。
  • 支付与积分：订阅方案、订阅状态、积分余额与消耗、交易记录。
  • 设备与使用信息：设备类型、操作系统、浏览器、语言、IP 地址、页面浏览与功能使用情况（通过 PostHog 等分析工具收集）。

2. 我们如何使用信息与法律依据

  • 履行合同：处理你上传的内容以生成设计方案、图纸与渲染，管理你的账号、积分与订阅。
  • 合法利益：维护服务安全、排查问题、改进产品功能与性能。
  • 同意：在使用分析等非必要功能时，依据你的同意（详见 Cookie 协议）。
  • 法定义务：遵守适用法律与监管要求。

3. AI 处理与上传图像

你上传的房间、户型或图纸图像会被用于生成设计方案。视所用功能不同，处理通过以下三类链路之一进行：

  • （a）自托管模型：在我们运营的远程服务器上本地推理，数据不离开我们的控制范围，仅用于为你生成结果。
  • （b）平台采购的模型 API：我们通过 OpenAI、Anthropic 等官方 API 处理；此类链路优先选用默认不用于训练、且可签订零保留（Zero Data Retention）协议的 API 与企业账户。
  • （c）你自备的第三方 API Key：由你自行配置并直连第三方服务商；此类请求我们不经手缓存、不用于训练，处理条款以该第三方自身协议为准，请自行核对其数据处理做法。

间接个人信息提示：上传的实景图可能无意中包含人脸、门牌、证件或合同纸张等间接个人信息。我们不会自动脱敏，建议你在上传前自行遮挡。

模型训练与退出：为改进 AI 能力，我们可能将上传内容与生成内容用于训练、微调与评估模型（仅限上述 (a)(b) 链路；自备 Key 链路不涉及）。如不希望内容被用于训练，可发送邮件至 privacy@layrax.com 退出，我们将在 15 个工作日内处理，此后新数据不再用于训练；已参与历史训练的数据无法逆向逐一剔除，但我们会在合理可行范围内停止继续使用你的内容。我们不使用你的私密内容训练公开第三方基础模型，除非你明确同意。账号内「退出训练」开关将在后续版本上线。

删除：你可以在产品中主动删除自己的方案与项目；删除后数据进入清除流程（见第 7 条留存期限）。

4. 信息共享

我们不会出售你的个人信息。在以下情形下我们可能共享：

  • 服务商（子处理商）：云端托管、AI 模型与图像处理（含第 3 条 (b) 链路的模型 API）、支付处理、分析等服务商，受保密与数据保护约束。完整清单见《子处理商清单》。
  • 自备 Key 链路：你使用自己的第三方 API Key 时，相关数据直接发送至该第三方，我们不经手缓存，亦不对其处理行为负责，适用该第三方的隐私条款（见第 3 条 (c)）。
  • 法律要求：回应法律请求、防止欺诈或保护权利人与公众所必需时。

就加州 CCPA 而言，上述服务商以「服务提供商 / 处理者」身份接收信息并受相应合同约束，此类共享不构成 CCPA 意义上的「出售（sell）」或「共享（share）」。

5. 跨境数据传输

由于使用全球云与 AI 服务商，你的信息可能被传输至你所在国家或地区之外。我们按以下国别 / 地区机制处理：

  • EEA 与英国：优先将你的数据存储于欧盟境内（法国 / 德国 / 爱尔兰等 EU 区域）；确需出境时，依据欧盟委员会《标准合同条款》（SCCs, 2021/2022 模块）或英国《国际数据传输协议 / 附录》（IDTA / ITA），并完成传输影响评估（TIA）；如接收方所在国获欧盟充分性认定，则依赖该认定。
  • 美国加州：我们以 CCPA「服务提供商」身份处理信息并签署相应 DPA，该传输不构成出售或共享。企业版可启用 EU 单租户区域驻留（另行约定）。
  • 巴西：遵循 LGPD，通过 SCCs 或你的明确同意进行国际传输。
  • 韩国：遵循 PIPA 第 17 条，以 SCCs 或书面合同传输，并向你告知接收方信息。
  • 阿联酋：遵循 PDPL，仅向具备相当保护水平的接收方传输，并以 SCCs 作为保障。
  • 新加坡：遵循 PDPA 第 26 条，通过具备相当保护标准的约束性合同传输。
  • 中国：本服务为境外服务，不主动面向中国境内提供；若境内用户仍选择使用，其数据按上述 EEA → 第三国机制出境，我们不办理《个人信息保护法》项下的安全评估或标准合同备案，除非企业客户另行签署中国 DPA 附录。

6. Cookie 与同类技术

我们使用 Cookie 及同类技术运行必要功能并进行流量分析。详见我们的 Cookie 协议。

7. 留存期限

我们在为实现收集目的所必需的期限内保留你的信息：

  • 账号信息：保留至你删除账号。
  • 上传内容与生成物：保留至你删除项目或账号；在生产系统中删除后 30 天内从活跃系统清除。
  • 备份数据：自删除请求之日起 90 天内从备份中擦除。
  • 运维与安全日志：不超过 12 个月。
  • 支付与税务记录：按法律要求保存（通常 7 年）。
  • 分析数据：以可识别形式保存不超过 24 个月。

删除账号后，我们将按上述周期删除或匿名化处理相关信息；超出必要保留期限的，我们将删除或匿名化。

8. 你的权利

根据你的所在地区，你可能享有：访问、更正、删除、限制处理、数据可携、反对处理，以及撤回同意的权利。加州居民还享有知情、删除、更正与退出「出售或共享」个人信息等权利。要行使上述权利，请联系 privacy@layrax.com；为核验身份，我们可能要求你提供账号邮箱等最少必要信息。

响应时限：GDPR 适用情形下，我们将在收到请求后 1 个月内答复（复杂情形最多延长 2 个月并说明原因）；CCPA 适用情形下为 45 天（最多再延长 45 天）。「退出模型训练」的请求将在 15 个工作日内处理（见第 3 条）。

申诉渠道：若你认为我们的处理侵害了你的权益，可向你所在地的数据保护监管机构投诉，例如爱尔兰数据保护委员会（DPC）、加州隐私保护局（CPPA），或你所在 EEA 成员国的监管机构（GDPR 第 77 条）。

9. 安全

我们采取合理的技术与组织措施保护你的信息，但互联网传输无法做到绝对安全。

10. 未成年人

本服务不面向 18 岁以下未成年人。如发现未成年人在未经监护人同意下提供了个人信息，请联系我们删除。

11. 变更

我们可能不时更新本协议，重大变更时会在本服务中提示。继续使用即视为接受更新后的协议。

12. 联系我们

  • 运营方：【请填写：公司全称】
  • 备案 / 注册号：【请填写：ICP 备案号 / 注册号】
  • 邮箱：contact@layrax.com（隐私事务：privacy@layrax.com）
  • 欧盟 / 英国代表与数据保护联系人（GDPR Art. 27/37）：privacy@layrax.com / 【请填写：欧盟代表名称与地址】

Privacy Policy

Last updated: August 5, 2026

Layrax ("we", "us") respects and protects your privacy. This Privacy Policy explains how we collect, use, share, and safeguard personal information, and applies to the Layrax website and related services (the "Service"). This policy is drafted to comply with international privacy laws, including the GDPR and the CCPA.

The Service is operated by [Please fill in: legal entity name] (registration no. [Please fill in: registration number], address [Please fill in: physical address]). For any questions about this policy, contact privacy@layrax.com or contact@layrax.com.

1. Information We Collect

To provide our AI interior design service, we may collect:

  • Account information: email, display name, avatar, authentication credentials, and account preferences needed to register and sign in.
  • Content you upload: floor plans, CAD drawings, room or space photos, prompts, style preferences, and project notes used to generate designs.
  • Generated content: AI-generated or AI-assisted designs, renders, drawings, edit history, and project history.
  • Payment and credits: subscription plan, status, credit balance and usage, and transaction records.
  • Device and usage information: device type, operating system, browser, language, IP address, page views and feature usage (collected via analytics tools such as PostHog).

2. How We Use Information and Legal Bases

  • Performance of a contract: processing your uploads to generate designs, drawings, and renders, and managing your account, credits, and subscription.
  • Legitimate interests: keeping the Service secure, troubleshooting, and improving features and performance.
  • Consent: for non-essential features such as analytics, based on your consent (see our Cookie Policy).
  • Legal obligations: complying with applicable laws and regulatory requirements.

3. AI Processing and Uploaded Images

Images you upload (rooms, floor plans, drawings) are used to generate designs. Depending on the feature, processing takes place through one of three chains:

  • (a) Self-hosted models: inference runs locally on remote servers we operate; the data never leaves our control and is used only to generate your results.
  • (b) Platform-procured model APIs: we process via official APIs such as OpenAI and Anthropic; for this chain we prioritize APIs and enterprise accounts that do not train on inputs by default and can sign Zero Data Retention (ZDR) agreements.
  • (c) Your own third-party API key: you configure and connect directly to the third-party provider; we do not cache these requests or use them for training, and the provider's own terms govern the processing — please review their data practices.

Indirect personal information: uploaded real-world photos may unintentionally contain faces, house numbers, ID documents, or contract papers. We do not auto-redact them; we recommend you blur or crop such details before uploading.

Model training and opt-out: To improve our AI capabilities, we may use uploaded and generated content to train, fine-tune, and evaluate models (chains (a) and (b) only; the bring-your-own-key chain is not involved). If you do not want your content used for training, email privacy@layrax.com to opt out; we will process the request within 15 business days, after which new data is no longer used for training. Data that has already participated in historical training cannot be individually removed retroactively, but we will stop using your content where reasonably practicable. We do not use your private content to train public third-party foundation models unless you expressly opt in. An in-account "opt out of training" toggle will ship in a future release.

Deletion: You can proactively delete your own designs and projects in the product; deleted data then enters the purge process (see Section 7, Retention).

4. How We Share Information

We do not sell your personal information. We may share it when:

  • Service providers (sub-processors): cloud hosting, AI model and image processing (including the model APIs in chain (b) of Section 3), payment processing, and analytics providers, bound by confidentiality and data protection. See the full Sub-processor List.
  • Bring-your-own-key chain: when you use your own third-party API key, the relevant data is sent directly to that third party; we do not cache it and are not responsible for their processing, which is governed by their privacy terms (see Section 3(c)).
  • Legal requirements: responding to legal requests, preventing fraud, or protecting rights and the public where required.

For purposes of the California CCPA, the above service providers receive information in their capacity as "service providers / processors" and are bound by appropriate contracts; this sharing does not constitute a "sale" or "sharing" under the CCPA.

5. International Data Transfers

Because we use global cloud and AI providers, your information may be transferred outside your country. We apply the following region-specific mechanisms:

  • EEA and UK: we preferentially store your data within the EU (e.g., France / Germany / Ireland); where an export is necessary, we rely on the European Commission's Standard Contractual Clauses (SCCs, 2021/2022 modules) or the UK International Data Transfer Agreement / Addendum (IDTA / ITA), complete a transfer impact assessment (TIA), and rely on an adequacy decision where the recipient's country has one.
  • California, USA: we process information as a CCPA "service provider" under an appropriate DPA; the transfer does not constitute a sale or share. Enterprise plans can enable EU single-tenant region residency (by separate agreement).
  • Brazil: under the LGPD, international transfers rely on SCCs or your explicit consent.
  • South Korea: under PIPA Article 17, transfers rely on SCCs or a written contract, and we inform you of the recipient.
  • UAE: under the PDPL, we transfer only to recipients offering a comparable level of protection, using SCCs as the safeguard.
  • Singapore: under PDPA Section 26, transfers rely on binding contracts offering comparable protection standards.
  • China: this Service is offered from outside China and is not actively directed at users in mainland China; if such users choose to use it, their data is exported under the EEA-to-third-country mechanisms above, and we do not conduct PIPL security assessments or standard contract filings unless an enterprise customer signs a separate China DPA addendum.

6. Cookies and Similar Technologies

We use cookies and similar technologies to operate essential features and analyze traffic. See our Cookie Policy.

7. Retention

We keep your information only as long as needed for the purposes collected:

  • Account information: retained until you delete your account.
  • Uploads and generated content: kept until you delete the item or your account; purged from active production systems within 30 days of deletion.
  • Backups: erased from backups within 90 days of a deletion request.
  • Operational and security logs: no longer than 12 months.
  • Payment and tax records: kept as required by law (typically 7 years).
  • Analytics data: kept in identifiable form for no more than 24 months.

After account deletion, we delete or anonymize the relevant information on the cycles above; anything retained beyond the necessary period is deleted or anonymized.

8. Your Rights

Depending on where you live, you may have the right to access, correct, delete, restrict processing, port data, object to processing, and withdraw consent. California residents also have the right to know, delete, correct, and opt out of the "sale or sharing" of personal information. To exercise these rights, contact privacy@layrax.com; to verify your identity we may ask for the minimum necessary information, such as your account email.

Response times: where the GDPR applies, we will respond within one month of receipt (extendable by up to two months for complex requests, with reasons); where the CCPA applies, within 45 days (extendable by a further 45 days). "Opt out of model training" requests are processed within 15 business days (see Section 3).

Complaints: if you believe our processing infringes your rights, you may lodge a complaint with your data protection supervisory authority — for example the Irish Data Protection Commission (DPC), the California Privacy Protection Agency (CPPA), or the authority of your EEA member state (GDPR Article 77).

9. Security

We take reasonable technical and organizational measures to protect your information, but no internet transmission can be guaranteed fully secure.

10. Children

The Service is not intended for anyone under 18. If you believe a minor has provided personal information without a guardian's consent, please contact us to have it deleted.

11. Changes

We may update this policy from time to time. We will notify you of material changes through the Service. Continued use constitutes acceptance of the updated policy.

12. Contact

  • Operator: [Please fill in: legal entity name]
  • Filing / Registration no.: [Please fill in: ICP filing / registration number]
  • Email: contact@layrax.com (privacy matters: privacy@layrax.com)
  • EU/UK Representative and data protection contact (GDPR Art. 27/37): privacy@layrax.com / [Please fill in: EU representative name and address]