Privacy policy

Draft for legal review. Last updated 1 October 2026. This text does not apply until it has been approved and published.

Who is responsible

MEE AS (organisation number 912 185 001) makes and runs House Madness. We are the controller of the personal data described here. This policy covers the website housemadness.app, the app and your account.

• Address: Svendsemarka 38, 3409 Tranby, Norway
• Privacy email: [email protected]

We have not appointed a data protection officer, because the law does not require one for a business like ours. Send any privacy question to the email address above.

Your drawings stay on your device

The houses you draw, and the PDFs and images you import, are stored in your browser (IndexedDB) on the device you use. The automatic tracing of scanned drawings also runs in your browser. We have no copy and cannot see your drawings.

Information about your house only leaves your device when

• you save a project file, print or export. You decide where the file goes.
• you use the AI assistant. See “How the AI assistant uses your data”.
• you look up an address or view maps. Your browser then fetches map data directly from public map services. See “Maps and addresses”.

Because your drawings are only with you, you also hold the backup. If you clear your browser data, the houses are gone. Use “Save project file” in the app to keep a copy.

What we process, why, and on what legal basis

The General Data Protection Regulation (GDPR) requires a legal basis for everything we do with personal data. Here is all of it, by purpose. How long we keep each kind of data is under “How long we keep data”.

Your account

You don’t need an account to draw. You need one to buy a plan and to use the AI assistant.

• What: your name, email address, whether the address is confirmed, and when the account was created and changed. Your password is stored only as a cryptographic hash (scrypt), so we cannot read it.
• Logging in with Google, Apple or Vipps: if you choose this, we receive your name, email address, an ID for your account with that service and the login tokens it gives us. From Google we also receive a link to your profile picture.
• Why: to create your account, log you in on the website and in the app, and give you what you have bought.
• Legal basis: our contract with you (GDPR Art. 6(1)(b)).

We need your name and email address to create an account. Without them you cannot have an account, but you can still draw.

Payments

• What: your Stripe customer ID, what you have bought (subscription, Project pass or top-up), its status and dates, whether you pay the founder price, and your AI minutes. Stripe processes your card details, billing address and country (to work out the right VAT), and VAT numbers for businesses. Your card number never reaches us.
• Where from: from you when you pay in Stripe’s checkout, and from Stripe.
• Why: to take payment, give you access, send receipts, work out VAT, keep accounts, and handle refunds and complaints.
• Legal basis: the contract (Art. 6(1)(b)) and our obligations under the Norwegian Bookkeeping Act and VAT rules (Art. 6(1)(c)).

Stripe also uses some data for its own purposes, such as preventing fraud and meeting anti-money-laundering rules. Stripe is responsible for that itself. Read Stripe’s privacy policy.

The AI assistant

• What: your messages, photos you attach, a summary of the house and the results of the tools the assistant uses. In a live call, also your voice and a written version of what is said. We ourselves store only how much you have used: the number of questions, rounds, tokens and minutes per month.
• Why: to give you answers and suggestions, keep track of the minutes and limits in your plan, and prevent misuse.
• Legal basis: the contract (Art. 6(1)(b)). The limits that prevent misuse and keep costs down rest on our legitimate interest in keeping the service available and safe for everyone (Art. 6(1)(f)).

More under “How the AI assistant uses your data”.

Email from us

• What: your email address and name, and the content of the email.
• Why: to confirm your email address, send password reset links and send you important messages about your account and contract. These can be that a subscription is running and how to cancel it (the law requires this at least every six months), that your Project pass will end soon, that you have withdrawn from a purchase, or that the terms are changing. Receipts are sent by Stripe.
• Legal basis: the contract (Art. 6(1)(b)). For notices the law requires: legal obligation (Art. 6(1)(c)).

We don’t send newsletters or marketing. If we want to later, we will ask for your consent first.

When you contact us

• What: what you write, your email address and what we need to help you, such as which purchase your question is about.
• Why: to answer you, solve the matter and document what we agreed.
• Legal basis: the contract (Art. 6(1)(b)) when the matter concerns it. Otherwise our legitimate interest in answering enquiries (Art. 6(1)(f)).

Security and logs

• What: for each login we store the IP address, browser and device (user agent) and time. The server and our hosting provider log technical data such as IP addresses, times, the address requested and error messages.
• Why: to keep your account and the service secure, detect and stop attacks and misuse, and fix errors.
• Legal basis: our legitimate interest in protecting accounts and the service (Art. 6(1)(f)), and our duty to keep data secure (Art. 32).

Limiting attempts

• What: your IP address and how many attempts come from it, for example to log in, sign up or reset a password. For the assistant and live calls we count requests and calls per account.
• Why: to stop password guessing, spam and runaway requests.
• Legal basis: our legitimate interest in protecting the service and its users (Art. 6(1)(f)). The counters are kept only in the server’s memory and reset after an hour at most.

Maps and addresses

When you look up an address or view maps and aerial photos in the app, your browser fetches the data directly from these services, not through us:

• Kartverket and Geonorge (the Norwegian mapping authority): address search, property, elevation data and maps
• PDOK (the Dutch government’s geodata service, run by the Kadaster): address search, parcels, aerial photos and elevation data in the Netherlands
• Esri: aerial photos outside the Netherlands, and there when PDOK does not answer (servers in the United States)
• Overpass, a service for OpenStreetMap data: buildings in the neighbourhood (run by FOSSGIS e.V. in Germany)

These services see your IP address and what you search for or the area you look at, just as every website sees the IP address of its visitors. We don’t receive this information. We chose these services, and they are used only when you use the map features (the contract, Art. 6(1)(b)). Each service is responsible for what it does with the data.

How the AI assistant uses your data

The AI assistant is artificial intelligence (AI), not a person. You can type to it, attach photos, or talk to it in a live call.

The assistant is optional. All the drawing tools, the 3D view and the calculations work without it, and nothing is sent to the AI providers until you send a message or start a call yourself.

When you type

The answers are written by Anthropic’s Claude language model. Each time you send a question, this goes through our server to Anthropic:

• your message and the whole conversation so far. The model remembers nothing between questions, so the conversation is sent again each time.
• a short summary of the house: the project name, the floors and rooms, and which floor you are looking at
• the results of the tools the assistant uses, such as the sizes of rooms, walls and windows, loads and beams, and the address of the property if you have entered it
• the photos you have attached in the conversation
• a written version of what was said in live calls, if you have talked to the assistant along the way

Our server adds instructions and descriptions of the tools and sends the answer back to you. We don’t store the content. The conversation exists only in the app while it is open, and is gone when you close the app or start a new conversation.

Photos

You can attach photos, for example of a ceiling to find out whether there is a beam. Before a photo is sent, the app makes it smaller (at most 1568 pixels on the longest side) and saves it again as a JPEG. This also removes hidden information in the file, such as the GPS position. You can attach up to 3 photos per question and 6 per conversation. The photos are sent again each time, for as long as the conversation lasts.

Please avoid photos of people, documents or anything else that isn’t needed to see the structure.

In a live call

Live calls use OpenAI’s Realtime API. When you press “Talk live” and allow your browser to use the microphone:

• The sound from your microphone goes straight from your browser to OpenAI (over WebRTC), and the answer comes back as speech. The audio does not pass through our server.
• Through our server, the app sends OpenAI a summary of the house. If you typed with the assistant before the call, the latest part of the typed conversation is sent too (text only, no photos), so you can carry on where you left off.
• OpenAI writes down what you say and what the assistant answers. This transcript is shown in the chat.
• OpenAI receives the results of the tools the assistant uses, just as when you type.

Our server starts the call, notices when it ends, and deducts the minutes from your account. It does not store the audio or the text of the call, only how long it lasted. The microphone is only in use during the call, and you can turn it off at any time.

The app also has a simpler voice option, “Talk (preview)”, which uses your browser’s own speech recognition. In some browsers, such as Chrome, the browser then sends the audio to the browser maker to turn it into text, and the text of the answer may be sent there to be read aloud. That happens under your browser’s own terms, and we don’t receive the audio.

Do they train on your data?

• Anthropic says in its Commercial Terms that it does not train its models on content sent through its API. According to Anthropic, inputs and outputs are normally deleted within 30 days, but may be kept longer when needed to investigate misuse or when the law requires it. See Anthropic’s page on retention.
• OpenAI says in its documentation on API data that data sent to its API is not used to train its models unless the customer has chosen to allow it. We have not. OpenAI normally keeps logs for detecting misuse for up to 30 days.

This is the providers’ own description of how they handle data. We have agreements with both on how they must handle the data, but we cannot inspect their systems ourselves. We don’t use your conversations to train AI models either.

The answers can be wrong

The assistant can misunderstand, miscalculate or misread a photo. Suggestions about the load-bearing structure are rough estimates, not structural design, and must be checked by a qualified structural engineer (in Norway, a RIB). See the terms for more.

No automated decisions

The assistant makes suggestions, and you decide whether to accept or discard them. We make no decisions about you based solely on automated processing that have legal effects or similarly significantly affect you (GDPR Art. 22).

If you use House Madness for work

If you use Proff in work for clients and send information about them to the assistant, such as their address, we process that information on behalf of your business. Your business is then the controller of the client data, and we are the processor. The data processing agreement is in the terms, under “Business customers (Proff)”.

Who we share data with

We never sell personal data. We share it only with providers we need to run the service. A processor handles data only on our instructions and under a data processing agreement with us.

Google, Apple and Vipps handle your data under their own privacy policies when you log in with them. We only receive what is listed under “Your account”.

We may also share data with our accountant and auditor, with lawyers if we need to establish or defend a legal claim, and with public authorities when the law requires it.

Transfers outside the EEA

Some of our providers process data in the United States. For those transfers we use a lawful basis under Chapter V of the GDPR:

• The EU–US Data Privacy Framework for companies certified under it. The European Commission’s decision on the framework also applies in Norway through the EEA Agreement.
• The EU standard contractual clauses (SCCs) in the data processing agreements, including those with Anthropic and OpenAI.

On top of this, data is encrypted in transit, and we send no more than is needed. You can ask for a copy of the standard contractual clauses. Trade secrets may be redacted.

How long we keep data

Three years is the general limitation period for claims under Norwegian law. For that long we may need to document what we agreed.

Your rights

You have the right to

• know what data we hold about you and get a copy of it (access, Art. 15)
• have incorrect data corrected (Art. 16)
• have data erased (Art. 17)
• ask us to restrict processing, for example while we check whether something is wrong (Art. 18)
• receive data you have given us in a machine-readable format (data portability, Art. 20)

You have the right to object. Where we process data on the basis of legitimate interest (security, logs, limiting attempts and limits against misuse), you can object to the processing on grounds relating to your particular situation (Art. 21). We will then stop, unless we have compelling legitimate grounds that override your interests, or need the data to establish, exercise or defend a legal claim.

Do it yourself under Account

• Download my data gives you a file (JSON) with your account, plan and AI usage. If you also want your login history or payment details, write to us.
• Your name can be changed under Account. To change your email address, write to us.
• Delete your account deletes the account straight away. If you have only logged in with Google, Apple or Vipps and have no password, write to us and we will delete it for you.

When your account is deleted:

• we delete the account, your login sessions, the links to Google, Apple and Vipps, your plan, your AI minutes, your usage data and the link to your customer record at Stripe
• active subscriptions end straight away. The terms explain what this means for the rest of the period and for unused minutes.
• we and Stripe keep payment and accounting records for as long as the law requires
• the data disappears from logs and backups within 30 days
• the drawings in your browser stay where they are

Write to us

Email [email protected]. It’s free. We answer within one month. If the request is complicated, we may extend this by up to two more months, but we will tell you within the first month. To protect your account, we may ask you to confirm that it’s you, for example by replying from the email address on the account.

You can complain

If you think we process personal data in breach of the rules, you can complain to the Norwegian Data Protection Authority, Datatilsynet. If you live in another EU or EEA country, you can also complain to the data protection authority there. See the list of data protection authorities in the EEA. You are welcome to contact us first. We can often sort things out quickly.

Cookies and local storage

We only use cookies and local storage that are strictly necessary for the service you have asked for. Under the Norwegian Electronic Communications Act (ekomloven), these need no consent. We use no analytics, no tracking and no ads, and so there is no consent banner. If we ever want to use something that needs consent, we will ask you first.

Cookies

Local storage in your browser

This stays in your browser and is not sent to us. You can delete it in your browser’s settings. That also deletes your houses, so save a project file first.

Children

House Madness is not made for children under 16. You must be at least 16 to create an account, and at least 18 to buy anything and to use the AI assistant. If we learn that a child under 16 has created an account, we will delete it. If you are a parent and think your child has given us personal data, write to [email protected].

Security

This is how we protect your data:

• All traffic is encrypted (HTTPS).
• Passwords are stored only as a hash.
• The login cookie cannot be read by scripts on the page (HttpOnly) and is only sent over an encrypted connection.
• We check where requests come from and stop repeated login attempts.
• The server and database are in the EU/EEA, and backups are protected.
• Only the people who need it to run the service have access to the data.
• We store as little as possible, and not the content of conversations with the assistant.

If a personal data breach happens anyway, we report it to Datatilsynet within 72 hours when the law requires it, and tell you if the breach is likely to put you at high risk.

Changes to this policy

We update this policy when the service or the rules change, for example when we start using a new provider. The date at the top shows when it last changed. If a change matters to you, we will tell you by email before it applies. You can get earlier versions by writing to us.

Contact

MEE AS
Svendsemarka 38, 3409 Tranby, Norway
Privacy email: [email protected]