INMII PRIVACY POLICY

Personal data controller/database owner: INMII LLP (ТОО «INMII»), BIN 260740025815, Republic of Kazakhstan, Astana, Sarayshyq District, 10 Raqymzhan Qoshqarbayev Avenue, Apt. 1801, postal code 010000. Contact for personal data matters: support@inmii.io.

1. General principles

1.1. INMII processes personal and other data to the extent necessary for registration, provision of the digital service, performance of contracts, payments, security, support, dealings with Suppliers, analytics and compliance with legal obligations. The operator of the INMII digital platform and owner of the personal-data database is INMII LLP (ТОО «INMII»), BIN 260740025815.

1.2. This Policy does not replace separate consent where consent is required as a distinct legal basis.

1.3. Separate action/consent may be required for particular operations, such as sharing direct contact details with a specific Supplier, marketing communications or using source materials for separate model training.

2. Categories of data subjects

• website visitors;
• ordinary and professional users, including designers, real estate agents, property flippers and representatives of renovation companies;
• Supplier representatives;
• representatives of organisations and other individuals interacting with INMII;
• individuals contacting support.

3. Data that may be processed

3.1. Account and identification

• first name/full name
• email
• phone number
• account ID
• language and settings
• history of acceptances and consents

3.2. Organisation and representative

• company name
• BIN/IIN where necessary
• job title
• business contact details
• information on authority
• stores, categories and operating regions

3.3. Property and Project

• property city/location
• area and number of rooms
• floor plans and drawings
• photographs and images
• design projects and CAD files
• scale, dimensions, walls, doors, windows, utilities, rooms and furniture
• text requests, prompts, comments and preferences
• generated outputs, Project versions and item lists

3.4. Requests and dealings with Suppliers

• categories and items
• requirements and parameters
• request status
• selected Suppliers
• commercial offers
• records of consent to share contact details
• Deal/Lead/Project identifiers where this mechanism is used

3.5. Payments

• amount
• currency
• date
• status
• product/plan
• transaction ID
• refund information

3.6. Technical data

• IP address
• device and browser type
• operating system
• session identifiers
• essential cookies
• Yandex Metrica and Session Replay (Webvisor) data — only after consent to analytics cookies (Section 11)
• technical, error and security logs

3.7. Support and claims

• messages
• attachments
• history of enquiries
• data necessary to address a request or dispute

As a rule, INMII does not store CVV or the full bank card number; these are processed by payment infrastructure.

4. Sources of data

4.1. Directly from the data subject during registration, creation of a Project, file upload, form completion, payment, document acceptance or contact with support.

4.2. Automatically from the device and software infrastructure during use of the service.

4.3. From Suppliers, payment providers and other counterparties to the extent necessary for the relevant operation.

5. Purposes of processing

• creating and maintaining an account;
• providing INMII functions, including AI analysis, layouts, furniture placement, Project storage, the DESIGNER subscription and item lists;
• processing uploaded files and generating outputs;
• payment, granting access, refunds and accounting;
• routing requests to Suppliers and obtaining offers;
• sharing direct contact details with a particular Supplier after separate confirmation;
• security and prevention of fraud, spam and abuse;
• user support and handling claims;
• technical and product analytics within lawful limits;
• performing contractual, accounting, tax and other legal obligations.

6. Main infrastructure and storage location

6.1. INMII's main server infrastructure, main database, User Projects, plans, photographs, design projects and working files are hosted in Yandex Cloud in the Republic of Kazakhstan.

6.2. The server availability zone used is kz1-a.

6.3. Where backup functionality is enabled, backups of Project data are located within the Yandex Cloud infrastructure used by INMII in Kazakhstan. Backups are for service recovery and do not replace the User’s own copies of materials.

6.4. Certain technical operations may be performed by external providers in other countries in accordance with Section 7 of this Policy.

7. AI processing and external technology providers

7.1. For requested AI functions, INMII uses OpenRouter, through which Google (Gemini) and Alibaba (Qwen) models run. INMII applies available technical and contractual measures to restrict use of transmitted source materials for unrelated purposes. Retention and independent processing by an external model operator are governed by its current rules and the route actually selected.

7.2. To perform a specific AI operation, the necessary part of a plan, image, design file, text request, Project parameters or intermediate output may be transferred to an external provider.

7.3. Certain AI operations may require transfers of data outside Kazakhstan. The known direct technology recipient is OpenRouter (a company registered in the United States). The actual model operator (its developer or a hosting provider chosen by OpenRouter) and place of processing may vary with the selected route, including other jurisdictions. Before the relevant operation, INMII discloses the current recipient/route and known processing geography and obtains separate consent where required. A model name does not itself identify the processing country.

7.4. INMII's main database remains stored in Kazakhstan.

7.5. Technology providers may change as the service evolves. Material changes in personal data processing are reflected in a new Policy version and, where necessary, accompanied by new consent.

7.6. Recipient categories include Yandex Cloud (main infrastructure in Kazakhstan); OpenRouter and the actual operator of the selected model; payment provider TipTop Pay and banks; Meta Platforms (WhatsApp Business, United States) — the phone number and one-time code when signing in by phone; Lark Technologies (Lark Mail email service, Singapore) — the email address and message text; Google — when signing in with a Google account at the User’s choice, and the Google Fonts service, which receives the IP address when the website’s fonts load; Yandex LLC (Yandex Metrica, Russia) — only after consent to analytics cookies, see Section 11; OpenFreeMap — a map tile service that receives the IP address when an address map is opened, with no cookies or account; the push notification service of the User’s browser — when notifications are turned on; the State Revenue Committee of the Republic of Kazakhstan and the data.egov.kz open data portal — the BIN/IIN a Supplier representative enters for verification; the Photon address search service (Komoot, Germany) — the address text the User types into an address form, sent from INMII’s server; a specific Supplier where authorised by the User; and authorities upon lawful request. Current information on additional processors and significant routing changes is provided through this Policy and disclosures before the relevant function.

7.7. Before invoking an AI function involving cross-border transfer of personal data, the User separately confirms that operation. Refusal may make that AI function unavailable; it does not amount to consent for marketing or disclosure of direct contact details to a Supplier.

7.8. Technology recipients known as of this version and their functions are listed in clause 7.6. Before activating a new route that changes recipients or known processing locations, INMII updates disclosures in this Policy and before the relevant AI function, and obtains renewed separate consent where required.

8. AI training and product improvement

8.1. INMII does not use original User plans, photographs or design projects for separate training of its own or third-party AI models without separate, transparent consent.

8.2. INMII does not separately authorise contractors to train models on Users’ source materials on INMII’s behalf without the User’s separate consent. INMII applies available technical settings and contractual measures to restrict such use. An external provider’s independent processing practices are also governed by its current terms, which are disclosed to the User before the relevant AI operation.

8.3. Anonymised and aggregated statistics may be used for analytics, security and product improvement where they do not identify a particular user or confidential Project.

9. Sharing data with Suppliers

9.1. Before direct contact details are shared, a Supplier may receive the minimum information necessary about the User's requirements.

9.2. A phone number, email, WhatsApp or other direct contact detail is shared with a specific Supplier only after a separate, understandable action by the User.

9.3. INMII retains records of the recipient, request, purpose, date/time and version of consent.

9.4. Upon receiving the data, the Supplier is independently responsible for the legality of further processing.

10. Payment providers

10.1. Payments may be processed through TipTop Pay, banks and other lawfully connected payment instruments.

10.2. INMII receives information needed to confirm payment, grant access, process refunds, maintain accounting and prevent fraud.

11. Cookies, analytics and marketing technology

11.1. INMII may use strictly necessary cookies and similar technology for authentication, sessions, security and technical operation of the website.

11.2. INMII uses Yandex Metrica (Yandex LLC, Russia) for visit statistics, including Session Replay (Webvisor), which records a visitor’s actions on the website’s pages. Metrica loads only after «Принять все» (Accept all) is pressed in the cookie banner; after «Только необходимые» (Necessary only) it does not load. Metrica receives the IP address, device and browser details, the addresses of pages visited and actions on them; the transfer to Russia is cross-border.

11.3. In Session Replay recordings every input field, phone number and address is hidden. In personal accounts page content is hidden by default; only buttons, headings, tabs and menus are visible. Public tariff prices are visible in recordings.

11.4. The choice can be changed or withdrawn at any time through the «Настройки cookies» (Cookie settings) link at the bottom of the website; after withdrawal the Metrica cookies are deleted and Metrica no longer loads. Declining does not limit the website.

11.5. INMII uses no other non-essential analytics or advertising technology. Any such technology may be added only after this Policy is updated and with the User’s choice in the cookie banner.

12. Retention periods

12.1. Active paid access to a Project lasts 12 months.

12.2. Projects and related files are kept while the account exists and are deleted at the data subject’s request (Section 13) or in cases provided by law; statutory records may be retained longer.

12.3. Account data are retained while the account is active and, after closure, only to the extent necessary for lawful purposes.

12.4. Payment, accounting, contractual and consent records may be retained for longer where required by law, to evidence legal relationships or protect rights.

12.5. Security logs are retained for a reasonable period necessary to investigate incidents and protect the service.

12.6. Deleted data may temporarily remain in protected backups until the normal technical backup cycle is completed.

12.7. Technical retention in particular backups, AI logs and downstream providers is reviewed in the data-processing register; INMII does not promise unverified periods or immediate physical erasure in every external system.

12.8. Messages sent through the «Написать нам» (Contact us) form and enterprise plan requests are kept for one year (an accepted request that granted the plan is kept while the account exists); the IP address a form message was sent from is removed after 180 days.

13. Deletion and data subject rights

13.1. To the extent provided by law, a data subject may request information on processing, correction, withdrawal of consent, cessation of processing, deletion and exercise other statutory rights.

13.2. Withdrawal of consent does not render earlier processing unlawful and does not require deletion of information that INMII must or may retain on another lawful basis.

13.3. A User may request deletion of an account/data via the available interface or at support@inmii.io.

13.4. INMII may request reasonable identity verification before fulfilling a request.

14. Security

14.1. INMII applies access controls, protected transfers and incident response consistent with applicable law and the actual infrastructure.

14.2. If personal-data security is compromised, INMII investigates, limits the impact and notifies the competent authority and affected individuals in the cases, manner and timeframes required by Kazakhstani law.

14.3. On request INMII provides available information about the incident and recommended steps without revealing other individuals’ data or creating additional security risks.

15. Marketing and notices

15.1. Service messages necessary for the account, Project, payment, security and requests are distinguished from marketing communications.

15.2. Marketing consent is provided separately and must not be preselected.

15.3. Users must be able to opt out of optional marketing without closing their basic account, unless otherwise required by law.

16. Minors

INMII is intended for Users aged 18 or over.

17. Changes to the Policy

17.1. INMII may update this Policy as its product, infrastructure and applicable law change.

17.2. Material changes to processing conditions are subject to appropriate notice and, if required, renewed consent.

18. Languages and publication

18.1. Published RU/KK/EN versions are to be consistent. A difference in translation must not restrict a data subject’s mandatory rights under Kazakhstani law.

18.2. The current version, publication date and privacy-request channel are available at inmii.io; prior versions are retained to the extent necessary to demonstrate compliance.

Company details and contacts

INMII LLP (ТОО «INMII»)

BIN: 260740025815

Address: Republic of Kazakhstan, Astana, Sarayshyq District, 10 Raqymzhan Qoshqarbayev Avenue, Apt. 1801, postal code 010000

Director: Матийко Людмила (Lyudmila Matiyko)

Website: inmii.io

Email: support@inmii.io

Telephone: +7 776 650 0700