Privacy Policy

Last updated: 17 October 2026

MoodBrief lets architects and interior designers send their clients a short brief and receive a Style report from the answers. This text explains what personal data we process on moodbrief.com and app.moodbrief.com, why we process it and how you can exercise your rights.

This text serves as a disclosure notice under Turkey's Personal Data Protection Law No. 6698 (KVKK). It also serves as the privacy notice under the EU General Data Protection Regulation (GDPR).

1. Data controller and contact

The data controller is MoodBrief. For any question or request about your personal data, you can write to [email protected].

2. Who uses MoodBrief

Studios: architects, interior designers and team members who sign in with a Google or Microsoft account or with a code sent to their email.
Clients: people who answer questions via a link sent by a studio. Clients do not create an account or sign in.

For the information a studio enters about its clients and for the clients' answers, the data controller is that studio. MoodBrief processes this data on the studio's behalf and instructions (data processor). For accounts, security, billing and operating the service, the data controller is MoodBrief.

3. What data we process

Studio users

Identity and contact: when you sign in with Google or Microsoft, your name, email address and profile photo link. We only request the openid, email and profile scopes. We do not access your emails, calendar, files or contacts. We do not store passwords.
Sign-in by email: we send a 6-digit code to the address you type on the sign-in page. This way we receive only your email address. There is no password. We keep only a hash of the code, for 10 minutes, and it works once. To prevent abuse, short-lived counters use a hash of the address and your IP address. The code email goes through Google Workspace like our other service emails.
Studio information: studio name, logo, team members and roles, invitations, templates, briefs, reports, notification preferences, credit history and usage data.
Client records: client name, email, phone, notes and client profile (e.g. household, budget, timeline, property details) entered by the studio.
Billing details: the name, company name, tax or TC identity number, tax office, address, email and phone a studio enters to buy credits. Each order keeps a copy of these details. Your card details stay with iyzico and never reach us.

Clients

Answers: your selections, notes you write, photos you like and dislike.
Consent record: the time you pressed “I’m ready”, the language you chose and the version of the information notice.
Progress: which screen you are on, when you opened the link and how long you spent answering. We keep this so you can resume where you left off and the studio that sent you the brief can see where you are. Nobody else sees it.
Reminders: when the studio reminded you by WhatsApp or email, and how. The studio sends WhatsApp messages from its own phone. No reminders are sent automatically.
Google Analytics or any other analytics tool does not run on brief pages (links starting with /b/).

Everyone

Technical logs: IP address, browser information, request time and error logs. We use the IP address for security and rate limiting.
Essential cookies: cookies that keep your session open and a cookie that remembers your analytics preference. Language and theme preferences stay in your browser. Cloudflare may add its own essential cookie for attack protection.
Analytics cookies: used only with your permission. Google Analytics runs only on our landing pages and the sign-in page. Details are in the “Cookies and Google Analytics” section.
We do not use advertising cookies. We do not track your visits for advertising.

4. Why we process data and legal bases

To create your account, verify your sign-in and provide the service. Legal basis: performance of a contract (KVKK Art. 5/2-c, GDPR Art. 6/1-b).
To deliver the brief to the client, collect answers and prepare the Style report and AI analysis. We do this on behalf of the studio. The studio must have its own legal basis for sending a brief to its client. The client is informed before starting and proceeds via the “I’m ready” step.
To send service emails: invitations, brief links, report-ready notifications. Legal basis: performance of a contract. You can turn off optional notifications in settings.
To maintain security, prevent misuse, fix errors and log admin actions. Legal basis: legitimate interest (KVKK Art. 5/2-f, GDPR Art. 6/1-f).
Billing and legal obligations when credits are bought. Legal basis: legal obligation (KVKK Art. 5/2-ç, GDPR Art. 6/1-c).
To measure visits with Google Analytics in order to improve our site. Legal basis: your explicit consent (KVKK Art. 5/1, GDPR Art. 6/1-a). You can withdraw your consent at any time.

We do not sell personal data and do not use it for advertising. The AI analysis is an assistive summary for the studio. It does not make automated decisions with legal or similarly significant effects on the client.

5. Room photos and picture generation

The studio or the client may upload a photo of an existing room. We use it only to redraw that room in the client’s style. Before the upload we say that the photo is sent to an AI image service. We store the uploader’s consent with the photo. Before storing it, we remove all extra information inside the photo, including its location (GPS). Only the photo and an English text written from the Style report are sent to the service. No name, email, phone number or address is sent. Make sure no people, documents or addresses are visible in the photo. Photos and the pictures drawn from them are kept with the brief, included when the client’s data is exported, and deleted when the brief or the client is deleted.

In the style test you can also upload a photo of one of your rooms from the browser where you made your result. The photo is sent to an AI image service to draw the same room in your result’s style. You confirm a notice before uploading. We record the time and the notice version. We remove all extra information inside the photo, including its location (GPS). No name, email, phone number or address is asked for or sent. The photo and the drawn picture are visible only in the browser that made the result, never on a shared result link. Both are deleted automatically after 24 hours, or at once if you choose. To prevent abuse we do not store your IP address. It is used only in hashed form in a counter kept for one day.

The studio can turn a finished brief’s Style report and its Concept pictures into an Instagram post that presents its own work. The post shows only style information (the leading style and its share, the colour palette, materials and mood words) and AI-generated inspiration pictures, which are marked as such. The client’s name, contact details, location and any uploaded room photo are never used. Before the post is made, the studio confirms that it shares it with the client’s permission. We record that confirmation with who gave it and when. Anthropic’s Claude model writes the post’s caption from this style information and the studio’s name only. The post’s record is kept with the brief, included when the client’s data is exported, and deleted when the brief is deleted.

6. Cookies and Google Analytics

Essential cookies

__Host-mb_session and __Host-mb_admin: keep your session open. Used only on app.moodbrief.com and not accessible to browser scripts.
__Host-mb_oidc: ties a Google or Microsoft sign-in to the browser that started it. Used only while signing in and deleted after 10 minutes.
mb_consent: remembers your analytics cookie preference for 180 days. Shared between moodbrief.com and app.moodbrief.com. We ask you again when it expires.

Essential cookies are necessary for the service to work, so they do not require consent.

We only use analytics cookies with your explicit consent. When you first visit our site, you see a short prompt at the bottom of the page. If you press “Accept”, Google Analytics 4 starts running. If you press “Decline”, none of Google’s code is loaded. Whichever you choose, you use the site in exactly the same way.

Google Analytics runs only on our landing pages (home page, Privacy Policy, Terms of Use, not-found pages) and the sign-in page. It never runs on the pages where clients answer briefs (links starting with /b/), in the studio app or in the admin panel.

What Google Analytics collects if you consent

Pages you visit: the page address, title and the site that referred you to us. We do not send URL parameters such as codes or referral tokens to Google.
Approximate location: country and city. Google Analytics 4 derives this from your IP address but does not log or store your IP address.
Device and browser: device type, operating system, browser, screen size and language.
Usage: time of visit and time spent on pages.
A random identifier: stored in cookies beginning with _ga and _ga_ to recognise return visits. It does not contain your name, email or brief answers.

We keep Google Signals and ad personalisation turned off. We do not use analytics data for advertising.

The Google Analytics service is provided by Google Ireland Limited and Google LLC. Google processes this data on our behalf as a data processor. Data may be transferred to the US (see “International transfers”).

We retain visit data in Google Analytics for 14 months. Google deletes this data when the period expires. _ga cookies remain in your browser for up to 6 months after your last visit.

You can change your preference at any time via the “Cookie preferences” link at the bottom of our site and the sign-in page. When you press “Decline”, Google Analytics stops immediately and _ga cookies are deleted from your browser. Withdrawing your consent does not affect the lawfulness of processing carried out before the withdrawal. You can also delete or block cookies in your browser settings.

7. Google user data

MoodBrief’s use of information received from Google APIs and its transfer to other applications comply with Google API Services User Data Policy, including the Limited Use requirements: https://developers.google.com/terms/api-services-user-data-policy

We only receive your name, email address, whether your email is verified and your profile photo link from Google.
We use this information solely to identify you, let you sign in and display it in your account.
We do not sell Google user data or use it for advertising. We do not use it to train AI models.
We do not transfer this data to third parties except where required for security or legal obligations. Our team does not read this data without your consent, a security need or a legal obligation.

The same rules apply when you sign in with Microsoft.

8. Who we share data with

We share data only with the providers needed to deliver the service, and only as much as needed. These providers process the data on our behalf and on our instructions.

Where data may go

Our service providers: servers, content delivery, email, sign-in, AI analysis, picture generation, photo ranking, payments and visit statistics. Those abroad are listed in “International transfers”, with the data each one receives.
The studio that sent the brief: only that studio and its team see the client’s answers, Style report and progress.
Competent authorities and courts: only where the law requires it.

Providers in Türkiye

iyzico Ödeme Hizmetleri A.Ş.: card payments for credit packs. You enter your card details directly on iyzico’s payment page. iyzico receives your name, email, address, phone and TC identity number (if entered) from your billing details. Legal basis: performance of a contract and legal obligation (KVKK Art. 5/2-c and Art. 5/2-ç).

Photo sources (Pexels, Unsplash, Pinterest and Google Images via SerpApi) receive only search terms, such as “warm oak kitchen”. No personal data is sent to these services.

9. International transfers

Our servers are in Germany and most of our providers are outside Türkiye, so your personal data is transferred abroad. Below we list what each provider is used for, which data it receives and the legal basis we rely on.

Hetzner Online GmbH (Germany, EU)

What for: servers, database and backups.
Which data: all the data described in this policy. Account, studio, client, answer and billing details and technical logs are stored here.
Legal basis: entering into and performing a contract (KVKK Art. 5/2-c).

Cloudflare, Inc. (US and its global network)

What for: domain, content delivery and attack protection.
Which data: IP address, browser information and every request to our site. What you type into forms and brief answers also pass through Cloudflare’s network over an encrypted connection.
Legal basis: performance of a contract (Art. 5/2-c) and legitimate interest in keeping the service secure (Art. 5/2-f).

Google (US)

What for: sign-in with Google and sending service emails (invitations, brief links, sign-in codes, report-ready notices, reminders) through Google Workspace.
Which data: at sign-in, your name, email address and profile photo link. In emails, the recipient’s name, email address and the content of the email.
Legal basis: entering into and performing a contract (Art. 5/2-c).

Microsoft Corporation (US)

What for: sign-in with Microsoft.
Which data: Microsoft verifies your account at sign-in and sends us your name and email address.
Legal basis: entering into and performing a contract (Art. 5/2-c).

Anthropic, PBC (US)

What for: analysis of answers with the Claude AI model, translation of user text, quality checks of photos and studios’ Instagram post captions.
Which data: the client’s answers and notes, the brief’s title, the client profile entered by the studio (e.g. household, budget, timeline, location) and, when several people answer, the name of the person answering. No email or phone number is sent. For an Instagram caption only the style information and the studio’s name are sent. Under its commercial terms, Anthropic does not train models on this data.
Legal basis: performance of a contract (Art. 5/2-c). We run the analysis on the studio’s behalf.

Picture generation service provider (abroad)

What for: Concept pictures and redrawing room photos.
Which data: an English image prompt written from the Style report. For a redesign, the room photo is sent too. We first remove the extra information in it, including its location. No name, email, phone number or address is sent. Before sending, we check the prompt for personal details and do not send it if we find any.
Legal basis: performance of a contract (Art. 5/2-c). Whoever uploads a room photo agrees to it knowing the photo is sent to this service.

TypeSafe (US)

What for: ranking the sample photos shown to the client.
Which data: the client’s answers so far and text descriptions of the photos. No name, email or phone number is sent.
Legal basis: performance of a contract (Art. 5/2-c).

Google Analytics: Google Ireland Limited and Google LLC (Ireland and US)

What for: measuring visits to our marketing pages. It runs only if you consent.
Which data: the pages you visit, approximate location, device and browser information and a random cookie identifier. Details are in “Cookies and Google Analytics”.
Legal basis: your explicit consent (Art. 5/1). If you press “Decline”, this data never reaches Google.

For these transfers we rely on the safeguards in Article 9 of the KVKK as amended in 2024. For transfers to countries without an adequacy decision of the Personal Data Protection Board, we sign the standard contract published by the Board with each provider. We notify the Personal Data Protection Authority of every signed contract within 5 business days of signing.

For occasional, one-off transfers where a standard contract is not possible, we rely only on the exceptions listed in the law, such as asking for your explicit consent.

US rules may not protect your data as well as those in Türkiye or the EU.

For transfers from the EU, standard contractual clauses (SCCs) under the GDPR or adequacy decisions (such as the EU-US Data Privacy Framework) are used.

10. How long we keep data

Account and studio information: for as long as your account is open. When you delete your account, this information is also deleted.
Client records and answers: for as long as the studio keeps them. Studios can export and permanently delete a client’s data.
Backups: deleted data is removed from backups within 14 days as backups are refreshed.
Sessions and technical logs: for the duration of the session and the short period required for security. Audit logs of admin actions may be kept longer.
Sign-in codes: 10 minutes at most. A used code is deleted at once.
Google Analytics data: 14 months. Your cookie preference (mb_consent): 180 days.
Records required by law (e.g. invoices, orders and the billing details at the time of the order): for the period set by the Turkish Tax Procedure Law and Commercial Code, even after the studio is deleted. A studio’s saved billing details are deleted with the studio.

11. Your rights

Under Article 11 of the KVKK and the GDPR, you may request the following:

To learn whether your data is being processed and to request information.
To learn the purpose of processing and whether the data is used in accordance with that purpose.
To know the persons to whom the data is transferred, domestically or abroad.
To request the correction of incomplete or inaccurate data.
To request the deletion of data and the notification of this deletion to persons to whom the data has been transferred.
To object to a result reached against you through analysis conducted exclusively by automated systems.
To claim compensation if you suffer damage due to unlawful processing.
Under the GDPR, you may additionally request a portable copy of your data, object to processing and request the restriction of processing.

For these rights, write to [email protected]. We will respond free of charge within 30 days at the latest. We may request additional information to verify your identity.

If you are a studio’s client, your answers are under that studio’s control. Please direct your request to the studio that sent you the brief first. If you write to us, we will forward your request to the studio and help them fulfil it.

Studio users can download their account information and delete their account from the Settings section.

You can withdraw your consent for analytics cookies via the “Cookie preferences” link at the bottom of the page.

If you find our response insufficient, you may apply to the Personal Data Protection Board. If you reside in the EU, you may also lodge a complaint with the data protection authority in your country.

12. Security

All connections are encrypted with TLS (HTTPS).
Secret keys and sensitive settings are stored encrypted with AES-256-GCM in the database.
Session cookies are not accessible to browser scripts. Only a hash of session keys is stored.
Authorisation is checked on every request. Each studio’s data is kept separate from the others.
The admin panel requires two-factor authentication. Admin actions are written to an audit log.
Sign-ins and brief links are protected by rate limiting. Brief links expire and can be revoked.
Sign-in codes are valid for 10 minutes and work once. They stop working after 5 wrong tries. Only their hashes are stored.

No system is perfect. In the event of a data breach, we will notify the affected individuals and the Board within the period prescribed by law.

13. Children

MoodBrief is not designed for anyone under 18. Studios should send briefs to their adult clients. If you believe the data of someone under 18 has been processed, please contact us. We will delete the data.

14. Changes

We may update this policy. We will announce important changes on this page, and by email where necessary, before they take effect. The date at the top of the page shows the last update.