Privacy policy

Your rooms can reveal a lot about your life. Here is what Sepja stores, when it shares information, and how you can exercise your choices.

Last updated: 8 October 2026

Who is responsible

Sepja is created and run by Eman Borg , who is responsible for how your personal information is used. For privacy questions or requests, email sepja@sepja.com . Our support page explains what to include.

Information we use

• Your account: your name, email address, a protected version of your password, whether your email is verified and your sign-in settings.
• Your spaces: room names, dimensions, objects, custom models, materials, uploaded textures and thumbnails, positions, reference images and notes, requested room-view images, saved versions, edit timestamps and the account responsible for an edit.
• Conversations: messages to the Sepja assistant, its responses, tool changes and optional short spoken confirmations. Spoken replies are saved so they can be played again.
• Sharing and connections: who has joined a room, invitation emails and links, and the permissions you give connected AI apps.
• Service information: session identifiers, IP addresses, browser information and technical logs used to operate the service, troubleshoot faults and protect accounts. Support messages contain whatever you choose to send us.

Information normally comes from you, people sharing a space with you, or an AI application you authorise. Avoid uploading identity documents, sensitive personal information, or photographs of other people unless you have an appropriate reason and permission.

Why we process it

We use account and workspace information to provide the service you request: sign-in, saved rooms, edit history, collaboration and AI features. This processing is necessary to perform our agreement with you. Account details are required for a saved workspace; photos, sharing and AI connections are optional.

We use limited technical and support information for our legitimate interests in keeping Sepja secure, reliable and usable, investigating abuse and answering requests. We also process information when necessary to meet legal obligations or establish, exercise or defend legal claims. Where a feature relies on consent, you can withdraw that consent without affecting earlier lawful processing.

AI and reference images

The Sepja assistant currently uses OpenAI . When you send a message, Sepja sends the request, relevant recent conversation, your current room and reference information needed to answer or edit your room. New photos are sent with your next messages. The assistant can look at a saved photo again when needed. Image names and notes may be included in later messages. Images are not automatically attached to every message, but an image may be sent more than once, including during a retry.

If you enable spoken replies, short confirmation text is sent to ElevenLabs or Microsoft Azure Speech, depending on the language and voice settings. Audio is generated on demand and saved privately; the same text, language and voice may reuse saved audio.

If you choose voice dictation, your browser asks for microphone permission. Your recording is sent to OpenAI Whisper or Microsoft Azure Speech for transcription. Sepja does not retain the recording. The recognised text appears in the chat box for you to review before sending; when sent, it becomes part of the saved conversation.

When an assistant requests a view of your design, an open room tab can render and save an image of that room from the requested angle. The image contains the 3D design, not your browser controls or other tabs. Connected assistants can retrieve these views; Sepja sends a view to its AI provider only when the assistant requests visual inspection. Textures remain in private room storage and are reused across saved versions.

When you connect ChatGPT, Claude or another AI app, that application can request accessible room data, saved history and selected reference images, and submit edits under your authorisation. Its own privacy policy applies to information it receives. Disconnect an application from Connected apps to stop further access through that connection; disconnecting does not erase information it has already received.

Sharing a space

Publishing a room in the gallery makes its name, current design and visible textures available to everyone. Other users can create independent copies that they can edit. Private reference uploads, conversations and original edit history are not included in those copies. Removing a gallery listing stops new gallery copies, but it cannot remove copies other users already created; a separate viewing link continues to work until you turn it off.

People who join a shared space can view and edit its scene and access its reference images, shared assistant conversation and history. Their authorised AI connections can access that space too. Share only with people you trust. The owner can revoke invitation links and remove members; revoking a link does not remove people who already joined. Removing access cannot recall copies someone has already made.

A separate view-only link is optional. If you enable it, anyone with the link can see the room name, current 3D scene, textures used in that scene and its sharing preview without signing in. It does not include chat, reference photos, edit history or unused uploads. Social and messaging services can fetch the preview when you share the link. Turning off the link stops future access through Sepja; it cannot remove copies or previews already cached by recipients or other services.

Other recipients and international processing

Hosting, storage, email delivery and technical service providers process information needed to run Sepja. AI and speech providers receive the information described above when those features are used. We may disclose information when required by law or when necessary to protect rights and investigate misuse.

Providers and AI applications may process information outside your country, including outside the European Economic Area. Their processing locations and terms depend on the service used. Contact us for details of the providers and international-transfer safeguards applicable to your information.

How long we keep your information

We keep your account and saved rooms while needed to provide the service and preserve your designs. Earlier versions are saved too: deleting an object or going back to an older version does not remove it from the room's history.

You can delete your account in account settings . This removes the account and its owned room records from the active database. Contributions to spaces owned by others may remain in those spaces. For erasure of personal information in shared contributions, uploaded files, generated audio or other retained records, contact us so we can review and complete the request across the relevant storage systems.

Routine backups are retained for up to one month. Deleted information may remain in those backups until they expire. Backups are used for recovery, not ordinary access. If recovery restores information covered by a completed deletion request, that request must be reapplied.

Support correspondence, security records and other limited information may need to be kept longer where necessary to resolve a request, investigate an incident, comply with a specific legal obligation or handle a legal claim. Retention depends on that purpose and any applicable legal period. We delete or anonymise information when it is no longer needed for that purpose.

Cookies and security

Sepja uses cookies and browser storage for sign-in, session security and preferences such as appearance. Blocking these can prevent parts of the service from working. Account access controls, private reference storage and permissions for connected apps help protect your data, but no online service can guarantee absolute security.

Your rights

Depending on applicable law, you can request access, correction, erasure, restriction or portability of your personal data, and object to processing based on legitimate interests. Some rights depend on the circumstances and may be subject to lawful exceptions. We may need to verify your identity before acting. We respond within one month and will explain any lawful extension.

You can contact Malta's Information and Data Protection Commissioner , or your competent data protection authority, if you have a concern. Sepja generates design suggestions; it does not use those suggestions to make decisions about your legal rights or eligibility for services.

Updates

We will update this page when our practices change and provide appropriate notice of material changes. The date above identifies the current version.