Draft notice — pending company registration.
This privacy notice is provisional. The legal entity (Estonian OÜ) is currently in registration; final registration is expected May–June 2026. Placeholder fields marked {{...}} below will be replaced with the final registered name, registry code, and Estonian office address once registration completes. The substantive privacy commitments (lawful basis, retention, opt-out, data-subject rights) are final and binding; only the entity-identity fields are provisional. For any data-protection question in the meantime, write to dpo@feelsright.ai.
Effective date (provisional): 2026-05-09
Status: Draft — entity-identity fields pending OÜ registration
Next review: on registration completion (estimated May–June 2026), then every 6 months thereafter
Privacy Notice
Effective date: 2026-05-09
1. Who we are
FeelsRight is operated by {{legal_entity_name}} OÜ ("we", "us", "FeelsRight"), an Estonian private limited company.
Registered office: {{registered_office_address}}
Registry code: {{registry_code}}
Email: hello@feelsright.ai
Privacy queries: dpo@feelsright.ai
Supervisory authority: Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, AKI), https://www.aki.ee/en
We are the data controller for the personal data described in this notice.
2. Scope
This notice covers personal data we collect when you:
visit https://feelsright.ai or any sub-page
receive a B2B partnership outreach email from us at a publicly listed business address
correspond with us via email or any contact form
use the FeelsRight recommender (room-photo upload feature)
engage with us as a vendor, wholesale partner, designer referral partner, or distribution partner
3. What we collect and why
3.1 B2B outreach to business contacts
We send unsolicited business-to-business partnership emails to publicly listed business email addresses (e.g., info@, trade@, partnerships@).
Categories of data: business contact details (name, role, work email, work phone), publicly listed organisation details (company name, registered address, wholesale program metadata).
Sources: brand websites, B2B trade directories, public company registers, LinkedIn public profiles.
Lawful basis: legitimate interest under GDPR Article 6(1)(f). We have documented a Legitimate Interests Assessment (LIA) covering necessity, balance against the recipient's rights, and data minimisation. The LIA is available on request to dpo@feelsright.ai.
Retention: until you opt out, or 24 months from our last interaction with you, whichever is sooner. Opted-out addresses are kept indefinitely on a suppression list to prevent re-contact.
Recipients of your data: only our email-infrastructure providers (Google Workspace) and proxy / browser-automation providers (IPRoyal, CloakBrowser). No data is sold or shared with third-party marketers.
3.2 Website visitors
When you visit https://feelsright.ai we may log:
IP address (truncated where possible)
user-agent string
pages visited and timestamps
referring URL
Lawful basis: legitimate interest in operating, securing, and improving the site.
Retention: server logs retained for 30 days; aggregated analytics for 13 months.
3.3 Recommender users
When you upload a room photo to the FeelsRight recommender:
Categories of data: the uploaded image, derived feature embeddings, anonymous session ID, country-level IP geolocation.
Lawful basis: performance of a contract (Article 6(1)(b)) — providing the service you requested.
Retention: uploaded images retained for 30 days for service improvement, then deleted; embeddings retained in anonymised form.
No facial recognition: we do not detect, identify, or store any face data; if a face is in the photo, our pipeline ignores it for recommendation purposes.
3.4 Direct correspondence
If you email us, fill in a form, or reply to outreach:
Categories of data: anything you choose to share — name, email, message body, attachments.
Lawful basis: legitimate interest in responding to your enquiry, or performance of a contract if you become a partner.
Retention: for the duration of the business relationship and 6 years thereafter (Estonian commercial code retention period).
4. International transfers
Some of our processors (Google Workspace) are based in or transfer data to the United States. We rely on:
the EU–US Data Privacy Framework adequacy decision, where the processor is certified
the European Commission's Standard Contractual Clauses (SCCs) where the processor is not DPF-certified
supplementary measures including encryption in transit and at rest
Copies of relevant transfer mechanisms are available on request to dpo@feelsright.ai.
5. Your rights
Under GDPR you have the right to:
access the personal data we hold about you
rectify inaccurate data
erase your data ("right to be forgotten") subject to retention obligations
restrict processing
object to processing based on legitimate interest
data portability for data we hold under contract or consent
withdraw consent (where applicable)
not be subject to automated decision-making with legal effects
To exercise any right, email dpo@feelsright.ai. We respond within 30 days.
If you are unsatisfied with our response, you may lodge a complaint with the Estonian Data Protection Inspectorate (https://www.aki.ee/en) or your local supervisory authority.
6. Opt-out from B2B outreach
To stop receiving partnership outreach:
reply to any outreach email with the word STOP (or "UNSUBSCRIBE")
email optout@feelsright.ai
We action opt-outs within 7 days and add the address to a permanent suppression list. We do not require any reason, and you do not need to verify your identity.
7. Security
We protect your data with:
TLS 1.2+ for all data in transit
encryption at rest for stored content
access controls limited to personnel with a business need
annual review of processor security posture
prompt incident-response process; we will notify the AKI within 72 hours of any reportable breach and notify you without undue delay if your data is materially affected
8. Sub-processors
We use the following sub-processors. The list is current as of 2026-05-09 and is updated when material changes occur.
Processor
Purpose
Region
Google Workspace (Gmail)
email infrastructure
US (DPF-certified)
IPRoyal
residential proxy infrastructure
global
CloakBrowser
browser automation infrastructure
EU
{{cloud_hosting_provider}}
application hosting
{{region}}
{{cdn_provider_if_any}}
content delivery
global
To object to a specific sub-processor, email dpo@feelsright.ai.
9. Children
FeelsRight is a B2B and home-furnishings recommender service not directed at children under 16. We do not knowingly collect data from children.
10. Changes to this notice
We may update this notice from time to time. Material changes will be communicated via the website and, where relevant, by email. The effective date at the top of this notice will be updated on each change.