Privacy and cookie policy

1. Who is responsible

The details of the person responsible (the controller) are on the Legal information page. For any privacy question, contact us at clientes@homeoctos.com.

2. Which data we process and why

• Visiting the website. Our hosting provider (Cloudflare) processes technical data such as your IP address, browser and the pages you request, to deliver the website and protect it against abuse. Legal basis: legitimate interest (Article 6(1)(f) GDPR). These logs are kept for a short time (normally no more than 7 days).
• Customer account. Name, email, country, city and, if you provide them, company and whether you are a professional. We use them to run your account and your saved projects. Legal basis: performance of a contract (Article 6(1)(b)).
• Saved projects. The rooms, measurements and products you save online in your account. Legal basis: performance of a contract.
• Email verification. Your email address and a temporary security code (valid for 30 minutes). Legal basis: performance of a contract and security.
• Newsletter. Email address, language and a record of your consent (date and version). We only send the newsletter with your consent (Article 6(1)(a)) and you can unsubscribe at any time via the link in every email or in your account.
• Reminders and price alerts. If you switch them on in your account (or press “Price alert”), we keep your confirmed email address, language, the products you follow with the last price seen, and clicks on our messages. We send at most one email a day, only with your consent (Article 6(1)(a)); you can switch it off in your account or via the link in every email.
• 3D models. When you place a product in your 3D room and its 3D model is not ready yet, we count how many different visitors asked for it. For this we store a code derived from your IP address (it cannot be turned back into the address) and delete it once the model is ready, or after 12 months at the latest. If you ask to be notified, we keep your email address and language only to send that one message and delete them right after (or after 6 months at the latest). Legal basis: legitimate interest (Article 6(1)(f)) and, for the notification, your consent (Article 6(1)(a)).
• Service messages. Emails about your account or a request you made. Legal basis: performance of a contract or legitimate interest.
• Contact. When you write to us we keep your name, email, message and language to answer you. Legal basis: legitimate interest or steps prior to a contract.
• Affiliate links. When you click a link to a shop, the shop and the affiliate network Awin learn that you came from Homeoctos (with a product reference, never your name). If you accept cookies, Awin's MasterTag script sets cookies to attribute a purchase to Homeoctos. We only receive purchase data (date, amount, commission and product reference), nothing that identifies you. Legal basis for these cookies: your consent.
• Shop images. Some product images may be loaded directly from the shop's website, which then sees your IP address.
• Camera and augmented reality. After your permission, the camera preview displays live video on your device. Homeoctos does not record or upload this camera video or request microphone access. Closing or leaving the camera page stops the feed. Manual placement uses a model over the live view; compatible devices may also provide native AR and surface detection.

3. Cookies and storage on your device

We only use what is strictly necessary, unless you accept affiliate cookies. You can change your choice at any time with Cookie settings in the footer.

The browser also remembers when you saw account and newsletter invitations, and whether an invitation was shown during this visit, to limit repeated prompts. Creating an account and subscribing to the newsletter remain separate choices.

• Necessary (no consent needed): your cookie choice (hx-consent), your basket and selection (homeoctos-basket-v1, homeoctos-selection), your local projects (homeocto-studio-v2) and when you last saw the newsletter invitation (homeocto-news-seen). They stay in your browser until you clear them.
• Team: the hx_admin cookie is only used by the Homeoctos team to sign in to management (30 days).
• Affiliate (only with consent): cookies set by Awin through the MasterTag, to attribute purchases. Awin decides how long they last; see Awin's privacy policy.
• We do not use analytics or personalised advertising cookies.
• Visit counting without cookies: we count visits without cookies, using an anonymous code that changes every day and is calculated from the IP address and browser, only to count unique visitors per day. IP addresses are not stored, and once the day ends the codes can no longer be traced back to anyone. Legal basis: legitimate interest.
• Customer and preview sessions. The necessary hx_customer cookie keeps an email-verified customer signed in for up to 90 days and is cleared at sign-out. The temporary hx_preview cookie grants preview access for up to one hour. Newsletter form protection uses short-lived pseudonymous security identifiers derived from the connection address and email, with a maximum retention of 48 hours.

4. Who receives data

• Cloudflare, Inc. (hosting, database, storage and email sending), as our processor. Privacy policy.
• Brevo (Sendinblue SAS, France), as our processor, for sending verification emails when this is switched on.
• Awin AG (Germany) and partner shops, as independent controllers, when you click a link or buy something.
• We do not sell your personal data.

5. International transfers

Cloudflare may process data outside the European Economic Area, including in the United States. These transfers are protected by the EU-US Data Privacy Framework and by standard contractual clauses approved by the European Commission.

6. How long we keep data

• Account, profile and saved projects: as long as your account exists. You can ask us to delete it at any time.
• Newsletter: until you unsubscribe. We keep the record of your consent and of your unsubscribe for as long as needed to prove it and to respect your choice.
• Contact messages: up to 24 months after the matter is closed.
• Log of emails sent: up to 12 months.
• Sign-in and verification codes: minutes to hours.

7. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, and you can withdraw consent at any time without affecting earlier processing. Write to clientes@homeoctos.com; we reply within one month.

You also have the right to lodge a complaint with the Portuguese data protection authority, Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt, or with the authority in your own EU country.

8. Security

We use encrypted connections (HTTPS), team access with one-time codes, and encryption of keys for external services. No system is 100% secure; if a data breach affects you, we will inform you as required by law.

9. Children

The website is not intended for children under 16 and we do not knowingly collect their data.

10. Changes

We may update this policy. The date at the top shows the current version; important changes will be announced on the website or by email.