AI Floorplans Ltd trading as Could I Extend
Last updated: 13 April 2026
This Privacy Policy explains how AI Floorplans Ltd (“we”, “us”, “our”) collects, uses, and protects your personal data when you use Could I Extend (the “Service”). We are the data controller for the purposes of UK data protection law.
We are committed to protecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Data Controller: AI Floorplans Ltd
Contact: support@couldiextend.com
If you have any questions about this Privacy Policy or how we handle your data, please contact us at the address above.
2.1 Account Information
2.2 Floorplan and Design Data
2.3 AI-Generated Proposals
2.4 Sharing Data
2.5 Technical Data
2.6 Data We Do Not Collect
| Purpose | Data Used | Lawful Basis (UK GDPR) |
|---|---|---|
| Creating and managing your account | Email, display name, password hash | Article 6(1)(b) — necessary for the performance of our contract with you (our Terms of Service) |
| Authenticating your sessions | Email, auth tokens | Article 6(1)(b) — contract performance |
| Providing AI floorplan analysis | Floorplan images, design data | Article 6(1)(a) — your explicit consent, given when you submit a floorplan for analysis |
| Generating and storing extension proposals | Design data, AI analysis results | Article 6(1)(b) — contract performance (delivering the core service) |
| Enabling public sharing of proposals | Display name, proposal content, share link | Article 6(1)(a) — your explicit consent, given when you activate sharing |
| Protecting the Service and preventing misuse | Account data, technical data | Article 6(1)(f) — our legitimate interest in maintaining a secure service |
| Improving the Service | Aggregated, anonymised usage patterns | Article 6(1)(f) — our legitimate interest in improving our product |
Where we rely on consent, you may withdraw it at any time (see Section 7). Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
We do not sell your personal data. We share data only with the following categories of recipients:
4.1 Anthropic (AI Processing)
When you submit a floorplan for AI analysis, we transmit the floorplan image and design data to Anthropic PBC (based in the United States) via their API. Anthropic processes this data solely to return the AI analysis to us. Under Anthropic’s API terms, they do not use API inputs for model training.
International transfer safeguard: This transfer from the UK to the US is protected by appropriate safeguards as required by UK GDPR Article 46 — specifically, the UK International Data Transfer Agreement (IDTA) or UK Addendum to EU Standard Contractual Clauses.
4.2 Vercel (Hosting)
Our frontend application is hosted on Vercel Inc. (based in the United States). Vercel processes IP addresses and request metadata as part of standard web hosting. This transfer is covered by appropriate contractual safeguards.
4.3 Law Enforcement
We may disclose your data if required by law, regulation, or valid legal process.
| Data Category | Retention Period |
|---|---|
| Account data (email, display name) | Until you delete your account, or 2 years of inactivity, whichever comes first |
| Password hash | Until you delete your account |
| Auth tokens | Access token: 15 minutes. Refresh token: 7 days. |
| Password reset tokens | 1 hour (auto-expired) |
| Floorplan images (uploaded) | Automatically deleted after AI analysis completes |
| Design data and proposals | Until you delete them or your account, or 2 years of inactivity |
| Shared proposal data | Until you revoke sharing or delete your account |
| Database backups | 30 days (encrypted) |
| Server logs (Vercel) | Per Vercel’s retention policy |
After the applicable retention period, data is securely deleted or anonymised.
We implement appropriate technical and organisational measures to protect your personal data, including:
No system is completely secure. If we become aware of a personal data breach that poses a risk to your rights, we will notify the Information Commissioner’s Office within 72 hours and, where required, notify you directly.
| Right | What It Means |
|---|---|
| Access (Article 15) | Request a copy of the personal data we hold about you |
| Rectification (Article 16) | Ask us to correct inaccurate data |
| Erasure (Article 17) | Ask us to delete your data (“right to be forgotten”) |
| Restriction (Article 18) | Ask us to limit how we process your data |
| Data portability (Article 20) | Receive your data in a structured, machine-readable format |
| Objection (Article 21) | Object to processing based on legitimate interests |
| Withdraw consent | Withdraw consent at any time where processing is based on consent |
How to exercise your rights: Contact us at support@couldiextend.com. We will respond within 30 days as required by law. We may ask you to verify your identity before processing your request.
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO):
Website: ico.org.uk
Helpline: 0303 123 1113
Please see our separate Cookie Policy for full details on how we use cookies and browser local storage.
In summary: we use essential local storage for authentication (strictly necessary — no consent required under PECR) and optional local storage for demo experience tracking (requires your consent).
The Service is not directed at anyone under the age of 18. We do not knowingly collect personal data from children. If we learn that we have collected data from a child under 18, we will delete it promptly.
We may update this Privacy Policy from time to time. We will notify you of material changes by email or in-app notice at least 14 days before they take effect. The “Last updated” date at the top will always reflect the most recent version.
If you have questions, concerns, or wish to exercise your data rights:
AI Floorplans Ltd
Email: support@couldiextend.com
For complaints about our data handling, you may also contact the ICO (see Section 7).