Private by design.

Pavilion is operated by Sanctuary Stories Ltd, a company registered in England and Wales (company number 16230261) with its registered office at 20 Wenlock Road, London, England, N1 7GU. For your account and, unless you have been told otherwise, your project data, Sanctuary Stories Ltd is the data controller. Contact us about privacy at hello@pavilion.place.

Account information — your email address, your name, and your role within a project. If you sign in with Google, Google gives us your verified email address and profile name; no project content is sent to Google.

Project content— what you and your fellow members put into a project: photographs, documents, floorplans, notes, decisions, costs, and emails you forward to your project’s own address. This can include personal information, such as photographs of a home.

Billing information— the email address used at checkout, the plan purchased, the amount paid, and Stripe’s references for the subscription. Card details are collected by Stripe on its own pages and never reach our systems.

Technical information — server logs needed to run and secure the service. We use privacy-preserving, cookie-free analytics that do not identify you.

Information about you can also reach us from other members of your project — for example, a photograph or document another member files that includes you, or an invitation sent to your email address.

We use your information to provide Pavilion under our contract with you: operating your account and projects, delivering invitations, notifications, and receipts, taking payment, and providing support.

We rely on our legitimate interests in keeping the service secure (for example, rate limiting and access logging) and in maintaining business records. We use billing records to meet our legal obligations, including tax law. We do not profile you, we do not sell your information, and we do not use your project content for advertising or to train AI models. We do not make automated decisions about you that have legal or similarly significant effects.

Pavilion’s concierge and Design Wizard send the relevant parts of your project to OpenAI to answer your question or generate an image. Each request is processed transiently: OpenAI does not store your content beyond handling the request, and it is not used to train models. The project’s creator can switch AI features off for the whole project in Settings, and every AI feature works only on what the requesting member is already allowed to see.

We use a small number of service providers, each processing only what its role requires: Supabase (database, authentication, and file storage, hosted in London, United Kingdom), Cloudflare (encrypted off-site backups, stored under EU jurisdiction), Stripe (payments), Resend (transactional email), OpenAI (AI processing, as described above), ConvertAPI (converting Office documents into previews — files are processed transiently, not stored), and Vercel (hosting). Each is bound by a data-processing agreement.

Your projects and account data are hosted in the United Kingdom. Backups are stored in the European Union. Some providers (OpenAI, Stripe, Resend, Vercel) process data in the United States; those transfers are protected by recognised safeguards, including the UK Extension to the EU–US Data Privacy Framework and standard contractual clauses, as applicable to each provider.

Your account exists until you delete it, which you can do yourself at any time from account settings. Project content exists until the project is deleted by its creator; deletion is immediate in our live systems, and the project’s off-site backups are erased within 45 days. Billing records are kept for six years, as tax law requires. If a subscription lapses, the project is suspended rather than deleted, so nothing is lost if you return — you can ask us to delete a suspended project at any time.

You have the right to access, correct, export, and erase your personal information, to object to or restrict certain processing, and to complain to the Information Commissioner’s Office (ico.org.uk). In practice: you can see and edit your project data in the product, delete your account yourself, and request a complete machine-readable copy of a project’s data from support@pavilion.place. For anything else, write to hello@pavilion.place and we will respond within one month.

Pavilion uses only the cookies needed to keep you signed in. There are no advertising or tracking cookies, and our analytics are cookie-free — which is why there is no cookie banner.

Where an architect, designer, or other practice provisions a Pavilion for its client, the practice may be the data controller for the project’s content and we process it on their behalf. A data-processing agreement for practices is available on request at hello@pavilion.place.

When we change this policy, we will update the effective date above, and tell you by email or in the product if the change is material.