Privacy Policy
Last updated: 10 October 2026. Version 1.0.
This Privacy Policy explains how MOZIX d.o.o. (“IQ Deco”, “we”) handles personal data when you visit iqdeco.com or use the IQ Deco service. We are the controller for the data of our users and website visitors. For data about your own customers that you put into the Service, you are the controller and we act as your processor under our Data Processing Addendum.
Controller: MOZIX d.o.o., Dunajska cesta 159, 1000 Ljubljana, Slovenia, company No. 9168109000. Privacy contact: info@iqdeco.com.
1. Data we collect
| Category | Examples | Source |
|---|---|---|
| Account data | name, email, phone, password (stored only as a hash), country, currency, language, customer number | you, at sign-up and in your profile |
| Studio profile | studio name, logo, slogan, studio email, phone, website, address, social links, crew contacts (name, email) | you |
| Your Content | projects, scenes, photos, inventory, briefs, quotes, notes, documents | you |
| Client Data | your customers’ names, phones, emails, event details, venue and budget, images they upload through a brief link | you or your customer (we are processor) |
| Billing data | plan, billing period, payment status, country for tax | Paddle (we do not receive full card details) |
| Security and usage logs | IP address, login attempts, browser type, pages requested, time | your device |
| Support messages | bug reports, cancellation reasons, emails | you |
| AI usage | the scene or image sent for AI processing, the result, cost counters | you |
We do not knowingly collect data of children under 16 and do not ask for special category data.
2. Why we use it and our legal basis (EU and UK GDPR)
| Purpose | Legal basis |
|---|---|
| Create and run your account, provide the Service, store your projects | contract (Art. 6(1)(b)) |
| Take payments and keep accounting records | contract; legal obligation (Art. 6(1)(c)) |
| Send service emails: login codes, security notices, billing and retention notices | contract; legitimate interest |
| Keep the Service secure, prevent abuse and fraud (rate limits, login monitoring) | legitimate interest (Art. 6(1)(f)) |
| Fix bugs and improve the Service using aggregated statistics (for example, anonymous structure of scenes checked by the composition tool) | legitimate interest |
| Send product news and offers | your consent (Art. 6(1)(a)), which you can withdraw at any time |
| Answer requests and complaints, defend legal claims | legitimate interest; legal obligation |
We do not sell your data and do not use it for advertising profiles. We make no decisions about you that are based solely on automated processing and have legal effects.
3. Who receives data
We share data only with service providers who need it to run the Service, under contracts that protect it:
| Recipient | What for | Location |
|---|---|---|
| Infomaniak Network SA | hosting of the Service and database; email (info@iqdeco.com) | Switzerland |
| Paddle.com Market Ltd | payment processing and invoicing as Merchant of Record (independent controller) | UK, with processing in the EU and US |
| fal.ai (Features & Labels, Inc.) | AI image generation and background removal; it may use model providers such as Google and moderation services | United States |
| Infomaniak Network SA (Swiss Backup) | encrypted backups | Switzerland |
| Telegram | internal alerts to our team with your customer number only, never your name or email | worldwide |
People you share a brief or order-sheet link with can see what that page shows. We may disclose data to authorities when the law requires it.
4. International transfers
Switzerland and the UK have adequacy decisions of the European Commission. Transfers to the United States rely on the EU–US Data Privacy Framework where the recipient is certified, or on the European Commission’s Standard Contractual Clauses (and the UK Addendum), with additional safeguards where needed. You can ask us for a copy of the relevant safeguards.
5. How long we keep data
| Data | Retention |
|---|---|
| Account and Your Content | while your account exists; after you delete it — erased within 7 days |
| Inactive accounts | deleted after 180 days without activity after the last paid period, or 30 days if never paid, after an email warning |
| Archived and completed projects | 1 year, then deleted after two email notices |
| Uploaded files no longer used anywhere in your account | deleted within about a week |
| Images sent to AI processing | input deleted within 1 hour after the task; the result stays in your account |
| Server logs with IP addresses | 30 days |
| Login-attempt records | up to 90 days (failed) and 7 months (successful) |
| Backups | rolling, at most 30 days |
| Billing and tax records | as required by accounting law (in Slovenia, up to 10 years), held by Paddle and by us |
| Marketing consent | until you withdraw it |
6. Your rights
Under the GDPR and UK GDPR you can ask to access, correct, delete, restrict or port your data, object to processing based on legitimate interest, and withdraw consent at any time. You can delete your account yourself in your profile. For other requests write to info@iqdeco.com; we answer within one month. If a request concerns your customers’ data in a decorator’s account, we will forward it to that decorator.
You may complain to a supervisory authority: in Slovenia, the Information Commissioner (Informacijski pooblaščenec, ip-rs.si); in the UK, the Information Commissioner’s Office (ico.org.uk); or the authority where you live or work.
7. Security
We use encrypted connections (HTTPS), hashed passwords, email-code confirmation for sensitive actions, rate limiting, access logging and restricted administrative access. No system is fully secure; if a breach affects you we will tell you as the law requires.
8. Cookies and similar storage
We use only what is needed to run the Service, such as keeping you signed in and remembering your language and display settings. See the Cookie Policy.
9. US residents
We collect the categories listed in section 1 for the purposes in section 2. We do not sell or share personal information for cross-context behavioural advertising, and we do not use sensitive personal information to infer characteristics. Depending on your state (for example California, Colorado, Virginia), you may have the right to know, access, correct and delete your data and to not be discriminated against for using these rights. Send requests to info@iqdeco.com; we will verify your request by email. You may use an authorised agent.
10. Changes
We will post updates here and email you about material changes before they apply.