Privacy Policy

Last updated: May 3, 2026

This Privacy Policy (“Privacy Policy”) explains how HorseImpact Ltd, trading as ModelRoom (“ModelRoom”, “we,” “us,” or “our”) collects, uses, stores, or discloses your personal data, and what rights you have under applicable law.

We encourage you to read this Privacy Policy carefully to understand our practices and how we process your personal data.

This Privacy Policy applies to the website located at https://modelroom.ai/ and any associated subdomains and web pages (“Platform”), as well as the services and products otherwise made available to you by us through the Platform (together, the “Services”). It also applies to our related communications and interactions with you about the Services, for example, account onboarding, product demos, user support, and service-related emails.

This Privacy Policy does not apply to any third-party websites, services or applications, even if they are accessible through the Services.

We may provide separate or supplemental Privacy Notices in specific contexts, such as for job applicants, and, where provided, those notices govern the relevant processing.

The Services may change over time. This Privacy Policy applies to new features and updates unless we provide a separate or supplemental notice for specific processing activities, where appropriate or required by applicable law.

If you have any questions regarding this Privacy Policy or our processing of your personal data, you may contact us as described in Section 12 (Contact Details).

1. Scope

ModelRoom is the data controller of personal data processed in connection with this Privacy Policy. Where we process personal data on behalf of a business customer, that processing is governed by our Data Processing Addendum as incorporated into the applicable agreement, unless the parties have agreed to another data processing agreement or other written terms that apply to that processing (“Data Processing Agreement”).

2. What Data We Collect

When you access or use our Services, we collect information from and about you, which may include personal data. “Personal data” means any information that identifies or can reasonably be used to identify you as an individual.

The personal data we collect depends on how you interact with us and the Services. Not all of the personal data categories listed below will apply to you. We only collect the personal data that is relevant to your interactions with us and the Services.

Please note that you are not legally required to provide personal data to us. However, if you choose not to provide certain information, for example, data needed to create an account or respond to a support request, we may not be able to provide some parts of the Services. Certain data is also collected automatically when you use the Services.

Data you provide to us

We collect personal data when you create or sign in to an account, use the Services, contact support, sign up for communications, participate in demos, provide feedback, or otherwise interact with us. This may include:

Contact data: full name, email address, phone number, or similar contact details.
Account data: email address, account ID, password stored in hashed form where applicable, username, nickname, profile picture, and other profile information you choose to add.
Communication data: content of communications with us, such as emails, messages, support requests, and related metadata.
Business data: company name, company website, title, role, professional profile URLs, intended use case, and similar business or professional identifiers you provide.
Content, prompt, and output data: content you submit through the Services, such as prompts, instructions, descriptions, chat messages, and any files or media you upload or otherwise make available, the outputs generated in response, and related metadata, such as timestamps, settings, and parameters used for generation.
Feedback data: feedback, survey responses, opinions, comments, and suggestions about the Services you choose to share.
Marketing data: your preferences for receiving marketing communications.
Payment data: if you purchase paid Services, payment and billing information needed to complete the transaction. You provide payment details directly to the relevant payment processor, which collects and processes your payment on our behalf. This may include your name, email address, billing or mailing address, payment card information, and other billing information. We do not access, collect, or store your full credit card number or CVV code.
Transaction data: information about your subscriptions, purchases, renewals, invoices, refunds, chargebacks, failed or cancelled transactions, payment status, and related metadata.
Other data you provide: any other information you choose to provide when completing forms, requesting support, participating in events or promotions, or otherwise interacting with us or the Services.

Data we collect automatically

When you access or use the Services, we may automatically collect certain data. This may include:

Technical data: IP address, date and time stamps, device type, operating system, browser type and version, language, time zone, referring URLs, timestamps, and similar log data.
Usage data: information about how you use the Services, such as pages visited, features used, clicks and other interaction events, navigation paths, session length, performance data, diagnostic data, crash logs, and error logs.

If we use cookies, pixels, SDKs, or similar technologies in connection with the Services, we will describe this in Section 9 (Cookies and Similar Technologies) or in a separate Cookie Policy.

Data we collect from third parties

We may receive your personal data from third parties. This may include:

Third-party account providers: if you register or log in to our Services using a third-party account, such as Google or Apple, or otherwise link it to our Services, we receive information that such a third-party service shares based on your privacy settings on that service. This usually includes your user ID, username, full name, email address, and profile photo. With Apple, you can choose “Hide My Email”, in which case we receive a private relay address instead of your real email. Connecting your third-party account to our Services is optional. You will be asked to grant permission when you connect, and you can revoke it at any time in that service’s settings. If you revoke permission, we may retain the information we collected previously from that third-party account provider, but the accounts will no longer be linked. We do not access or store your passwords for any third-party accounts. Third-party accounts are governed by their own privacy policies, and we encourage you to review them.
Payment providers: third-party payment processors may provide us with limited payment and transaction information, such as a transaction ID, a token representing your account or payment method, card brand and last four digits, payment status, timestamps, and details of the items or subscription purchased. The payment processor’s use of your personal data is governed by its own terms and privacy policy. Currently, we use Stripe, Inc. as our payment processor. You can access Stripe’s Privacy Policy at https://stripe.com/privacy.
Other integrations you enable: if you connect third-party services to the Services, we may receive data you authorize those services to share.

3. Why We Collect and Process Your Data

We process your personal data only if we have a lawful basis under applicable data protection laws. In this Section we explain how we use your personal data, and the legal grounds we rely on for doing so.

In some cases, we may process your data to pursue our legitimate interests in developing, operating, protecting, and improving the Services and running our business in a way that you would reasonably expect and which does not override your rights and freedoms. We have identified such legitimate interests where applicable.

When we process your data based on our legitimate interests, you have the right to object to such processing. When we process your data based on your consent, you have the right to withdraw it at any time without affecting the lawfulness of processing based on such consent before it is withdrawn. Please see Section 7 (Your Rights) for more details about your rights and how to exercise them.

Purpose of data processing	Data processed	Legal basis
Provide and operate Services (create and manage accounts, enable access, run features, process inputs and chat interactions, generate outputs, deliver the Platform)	Contact data Account data Content, prompt, and output data Technical data Usage data	Performance of a contract (including pre-contractual steps at your request): provide the Services you request, including account creation, access, and feature delivery
Run product demos and pre/post-demo communications (qualify requests, schedule, reschedule, or cancel demos, send invites, reminders, or access instructions, run demo follow-ups, share materials you requested)	Contact data Communication data Business data Technical data	Performance of a contract (including pre-contractual steps at your request): arrange and deliver demos you request and follow up on your requests Legitimate interests: verify authenticity of demo requests, prevent spam and abuse, and tailor demos for your role and use case
Provide support (respond to support requests, resolve issues, and follow up)	Contact data Account data Communication data Technical data Usage data Other data you provide	Performance of a contract (including pre-contractual steps at your request): provide support and respond to your inquiries Legitimate interests: troubleshoot efficiently, improve support quality, and prevent abuse of support channels
Send service and administrative communications (send technical notices, security alerts, account messages, and operational updates)	Contact data Account data Technical data Usage data	Performance of a contract (including pre-contractual steps at your request): send account-related and service communications needed to provide the Services Legitimate interests: keep you informed about service changes and maintain security and service continuity
Operate, secure, and improve the Services (monitor performance, debug, detect incidents, understand usage patterns, run analytics, develop and test features, create aggregated and de-identified data)	Technical data Usage data Feedback data Communication data	Legitimate interests: operate, secure, and improve the Services, including performance, user experience, reliability, and product development Consent: where required by law (for example, for the use of certain non-essential cookies or similar technologies)
Customize and improve experience (remember preferences, tailor the user interface, suggest relevant features or templates where available)	Account data Contact data Technical data Usage data Feedback data Communication data Marketing data	Legitimate interests: tailor parts of the Services and our communications to make them more useful and relevant Consent: where required by law (for example, where personalization relies on technologies that require consent)
Send marketing communications (send news and product updates, measure campaign effectiveness)	Contact data Marketing data Usage data	Consent: where required by law (for certain marketing communications and related measurement technologies) Legitimate interests: promote the Services and keep you informed about updates where permitted by law
Assess and set up business relationships (respond to business inquiries, evaluate partnership, agency, affiliate, or collaboration opportunities, negotiate terms, and prepare agreements)	Contact data Communication data Business data	Performance of a contract (including pre-contractual steps at your request): take steps you request to discuss and set up a business relationship Legitimate interests: identify and engage suitable customers, partners, agencies, affiliates, or collaborators, assess fit and eligibility, and protect the integrity of our business relationships
Process payments and manage billing (process purchases, manage subscriptions, handle refunds, chargebacks, failed or reversed transactions, maintain transaction records, prevent payment fraud)	Contact data Payment data Transaction data Technical data	Performance of a contract (including pre-contractual steps at your request): provide paid features, process purchases and subscriptions Legitimate interests: prevent payment fraud, manage disputes and chargebacks, and maintain transaction security and integrity Compliance with a legal obligation: comply with tax, accounting, and statutory record-keeping requirements
Protect rights and prevent misuse (enforce our Terms and policies, secure the Services, prevent abuse, detect and prevent fraud, investigate incidents, and respond to voluntary requests, reports, or complaints)	Any relevant personal data categories listed in this Privacy Policy, only as necessary for the specific matter	Legitimate interests: protect our business, personnel, users, and the Services, enforce our Terms and policies, detect, prevent, and address fraud, abuse, security incidents, and violations of our Terms and policies
Legal compliance (comply with legal obligations, respond to lawful requests, meet statutory record-keeping obligations)	Any relevant personal data categories listed in this Privacy Policy, only as necessary for the specific matter	Compliance with a legal obligation

Automated decision-making. We do not use automated decision-making, including profiling, that produces legal effects or similarly significant effects on you.

4. With Whom We Share Your Personal Data

We may share your personal data with third parties in the following cases:

Service providers: vendors that help us develop, operate, secure, support, and improve the Services, such as hosting, cloud infrastructure, analytics, attribution, product measurement, customer support, email delivery, and payment processing. Where our service providers process personal data on behalf of business customers, they may act as sub-processors under the Data Processing Agreement.
AI infrastructure providers: we use third-party service providers to provide AI, generation, editing, and agent chat features in the Services. When you use these features, Content, prompt, and output data, chat interactions, and related Technical data, such as timestamps, settings, and parameters, may be transmitted to those providers to process your request and return output so we can deliver the Services to you. We process this data to provide and operate the Services as described in this Privacy Policy and our Terms. We do not train our own models on your input or output.
Professional advisors: lawyers, accountants, auditors, and other professional advisors as necessary for them to provide services to us.
Affiliates: within our corporate group to deliver the Services, for internal administration, and where otherwise consistent with this Privacy Policy.
Legal compliance: regulators, law enforcement, government authorities, or courts where required or permitted by law, and to establish, exercise, or defend legal claims.
Security and abuse prevention: where necessary to detect, prevent, or address fraud, abuse, security incidents, and violations of our terms or policies, and to protect the rights, property, or safety of ModelRoom, our users, or others.
Corporate transactions: prospective and actual counterparties, such as investors, acquirers, successors, or assignees, and their advisors in connection with a corporate transaction, including due diligence, reorganization, merger, financing, sale, assignment, or transfer of all or any part of our business, assets, or shares, including insolvency proceedings. If control of all or any part of our business, assets, or shares changes, the respective acquirer, successor, or assignee may process your personal data as described in this Privacy Policy.
With your consent or at your discretion: if you ask us to share your data, connect an integration, or choose to make Content available to others through the Services, that Content and associated account identifiers, such as username, may be visible to others according to your settings and the Services’ functionality.

5. International Transfers of Personal Data

Our Services are global by nature, and your personal data can therefore be transferred to and processed in countries other than the country of your residence, including countries where privacy laws differ from those in the country of your residence.

Where your personal data is shared with recipients located outside the European Economic Area (“EEA”), the United Kingdom, or Switzerland, we ensure appropriate safeguards are in place to protect your personal data. Depending on the transfer, we rely on:

adequacy decisions by the European Commission recognizing that a recipient country provides an adequate level of protection for personal data;
Standard Contractual Clauses adopted by the European Commission to transfer personal data to recipient countries without an adequacy decision; and/or
other lawful transfer mechanisms, where applicable.

You can request a copy of the relevant transfer safeguards, such as Standard Contractual Clauses, by contacting us using the details in Section 12 (Contact Details).

6. How Long We Keep Your Data

We keep personal data only for as long as necessary for the purposes described in this Privacy Policy, including to provide the Services, comply with legal obligations, resolve disputes, enforce agreements, and protect the Services. Retention depends on the type of data, how it is processed, and applicable legal requirements.

Account data: retained while your account is active. If you close your account, we delete or de-identify account data within a reasonable period, unless we need to retain certain data for legal compliance, security, backups, fraud prevention, or dispute resolution.
Content, prompt, and output data: retained for as long as you store or make them available through the Services. After you delete content or close your account, we may retain it only as necessary for backups, security, legal compliance, and dispute resolution, and otherwise delete or de-identify it within a reasonable period.
Technical, usage, and diagnostic data, including logs: retained for a limited period appropriate for security, troubleshooting, service reliability, and abuse prevention, and longer where needed to investigate incidents, enforce our Terms and policies, or comply with law.
Support communications: retained for as long as needed to address your request, provide reasonable follow-up, maintain support history, and for recordkeeping, security, and dispute resolution.
Payment and transaction records: retained as required for accounting, tax, and financial compliance, and as necessary to manage disputes and chargebacks.

Where we anonymize data, we may retain and use it in anonymized form.

Where we process personal data on behalf of a business customer under the Data Processing Agreement, retention and deletion may also be governed by that agreement.

7. Your Rights

We may publish additional privacy disclosures or regional addenda that apply to users in specific jurisdictions. Where an addendum applies, it supplements this Privacy Policy and will control to the extent of any conflict.

If you are located in the EEA, the United Kingdom, or Switzerland, or if our processing of your personal data is otherwise subject to the EU GDPR, UK GDPR, or Swiss data protection law, you have certain rights under applicable data protection law. This Section sets out those rights and explains how you can exercise them:

Access: right to know whether we are processing your personal data, and, if so, obtain a copy of your personal data and other supplementary information.
Rectification: right to request that we correct or update your personal data that are inaccurate or incomplete.
Erasure: right to request that we erase your personal data in certain circumstances, for example where your personal data are no longer necessary for the purposes for which they were collected. This right is also known as the ‘right to be forgotten’. This right is not absolute and applies only in certain cases.
Restriction: right to request that we restrict the processing of your personal data where (i) you have contested the accuracy of your data, for a period enabling us to verify it, (ii) the processing is unlawful and you oppose erasure and request restriction instead, (iii) we no longer need the data for our purposes but you require them to establish, exercise, or defend legal claims, or (iv) you have objected to processing based on our legitimate interests, pending verification whether our grounds override yours.
Portability: right to obtain the personal data you provided to us in a structured, commonly used and machine-readable format, for example, in CSV format, and, where technically feasible, to have it transmitted to a third party. This right applies only where processing is carried out by automated means and based on your consent or a contract.
Objection: right to object at any time to processing of your personal data that is based on our legitimate interests or tasks carried out in the public interest. You also have the right to object at any time to direct marketing, including profiling related to such marketing.
Consent withdrawal: where we rely on your consent for processing of your personal data, you have the right to withdraw it. Withdrawal will not affect the lawfulness of processing based on your consent before it was withdrawn, nor will it affect processing based on legal grounds other than consent.

These rights are subject to certain limitations and exceptions under applicable law. We will assess each request to exercise these rights on a case-by-case basis.

To exercise any of these rights, please contact us using the contact details in Section 12 (Contact Details) below. Where we process personal data on behalf of a business customer, we may refer your request to that business customer or assist the business customer in responding to your request, as appropriate.

We will respond as soon as possible, but not more than within one month of receipt of your request. This period may be extended by a further two months where necessary due to the complexity and number of requests. In this case, we will inform you of such an extension within one month of receipt of your request and explain the reasons for the delay. We reserve the right to verify your identity before we process your request. If we cannot comply with your request, we will inform you of the reasons and of your right to complain to a supervisory authority.

If you believe that our processing of your personal data infringes applicable laws, you have the right to lodge a complaint with a supervisory authority, in particular in the EEA country of your habitual residence, place of work, or where an alleged infringement occurred. As we are established in the Republic of Cyprus, the supervisory authority overseeing us is the Commissioner for the Protection of Personal Data. We encourage you to contact us first so we can address your concerns before reaching out to the Commissioner.

8. Children’s Privacy

Our Services are intended for use by individuals who are over 18 years of age or the age of majority in their country of residence, whichever is older. We do not intentionally or knowingly collect personal data from children. If you become aware that we might have unintentionally collected personal data from a child, please contact us using the contact details in Section 12 (Contact Details), and we will take reasonable efforts to stop processing such data and erase it as soon as possible.

9. Cookies and Similar Technologies

We may use cookies and similar technologies, such as pixels, tags, SDKs, and local storage (together, “Cookies and Similar Technologies”), in connection with the Services.

Some Cookies and Similar Technologies are strictly necessary to operate and secure the Services, enable core functionality, authenticate users, maintain session state, and help prevent fraud, abuse, or unauthorized access. We may also use Cookies and Similar Technologies for optional purposes, such as analytics, product measurement, marketing, and improving the Services.

Where required by applicable law, we will obtain your consent before using Cookies and Similar Technologies for optional purposes. Where available, you may manage your preferences through the Services, a consent banner, browser settings, or other controls we make available. If you disable or reject certain Cookies and Similar Technologies, some parts of the Services may not function properly or may be unavailable.

We may provide additional information about Cookies and Similar Technologies we use in this Section 9 or in a separate Cookie Policy.

10. External Links

Our Services may contain links to third-party websites and applications. Your use of any such third-party services, and the way they process your personal data, are covered by the privacy notices of such third-party services, not this Privacy Policy. We do not control and are not responsible for the content, security, or privacy practices of those third parties. We encourage you to read the privacy notices of any such third-party services you visit.

11. Changes to Privacy Policy

We may make changes to this Privacy Policy from time to time. When we make changes, we will post the updated Privacy Policy and update the “Last updated” date at the top of this Privacy Policy. If we make material changes, we will take reasonable steps to notify you prior to the changes becoming effective, for example, by displaying a prominent notice on our Services, or, where required by law, we will obtain your consent or give you the opportunity to opt in to or opt out of, as applicable, any new uses of your personal data. We encourage you to periodically review this Privacy Policy to stay informed of our privacy practices.

12. Contact Details

For any questions, comments, or concerns regarding this Privacy Policy or our processing of your personal data, please contact us at [email protected] or by post at Griva Digeni 51, Athineon Court, Office 202, 8047 Paphos, Cyprus.