Phottate privacy policy

Upcoming version — draft dated 2026-10-14. No effective date has been set. The current document is available in the archive of the current version. This draft requires legal review, reconciliation with the Service’s actual operation, and at least 14 days’ advance notice of material changes.

This document explains what personal data Phottate collects, why, on what legal basis, whom we entrust it to and what rights you have. We have made it as specific as possible, naming providers and actual categories of data rather than using general statements.

This policy is both a source file in the Service’s repository and the content of the page you are reading. The two versions are always identical because the page renders that same file.

1. Who controls your data

The personal data controller is [COMPANY NAME], with its registered office at [REGISTERED OFFICE ADDRESS], tax identification number [NIP], statistical number [REGON], registered in [KRS / CEIDG] (“we”, “Phottate”).

Contact for personal data matters: kontakt@phottate.com.

We have not appointed a data protection officer because we are not required to do so. We handle all data-related matters at the address above.

The Service operates at phottate.com.

2. A quick overview

• We do not sell your data or share it with advertisers.
• We do not use Google Analytics or any other analytics tool that tracks individuals.
• We do not use marketing cookies or advertising pixels. Statistics for views of public material operate only with your consent (sections 3.6 and 6).
• We do not send newsletters. We contact you only about account services.
• We send the photos and text you upload to external AI providers to perform your requested service. Sections 7, 9 and 10 explain this in detail.
• You create an account by email without a password, activate it with a link and then sign in with a one-time code sent to your inbox.

3. What data we process

3.1. Account data

• Your email address: required, used as your login and contact channel.
• Your full name or display name, if supplied.
• Your agency name and logo, if supplied (these appear in rendered material).
• Your phone number, if supplied.
• Your account type (individual or property agent).
• Interface settings: light/dark theme, default map mode, area unit and default country for address searches.
• The account creation date and whether you have used your free first map animation.

3.2. Sign-in and account security data

• One-time sign-in codes: six digits, valid for 10 minutes. The database stores only a cryptographic hash (SHA-256 with a secret server key), never the code itself.
• One-time account activation links, valid for 24 hours.
• The terms acceptance date submitted in the registration form, stored until the account is created and then transferred to the account.
• Session state: maintained in a cryptographically signed token in your browser’s cookie. We do NOT keep a list of active sessions in the database. We record only a date before which all earlier sessions are invalid (after an email change, “sign out everywhere”, or account deletion or suspension).
• For email changes: the new address and a confirmation token stored only as a SHA-256 hash, never in plain text.
• Counters used to limit abuse: code requests, incorrect code attempts and queries for email addresses without an account. Code request limits also include the IP address used to send the request.

3.3. Content you create in the Service

• Projects: your chosen name, the property address, geographic coordinates and country code.
• Neighbourhood animations: search radius, selected place categories, points of interest obtained from OpenStreetMap, estimated walking times, custom markers and descriptions, and scene settings.
• Photos: files you upload or we import from a listing, their names and dimensions, and versions produced by AI operations (correction, virtual staging, sharpening and resolution enhancement).
• Video shots: camera movement configuration, length, any custom scene description (prompt), and the generation provider’s job identifier.
• Edits: timeline, captions and their content, selected music, voiceover script and generated audio file, and branding displayed in the corner of the frame.
• Your music: files uploaded to your account library, their names, sizes and durations, and the date of your declaration that you hold rights to the work.
• Listing imports: listing URL, portal name, price, price per square metre, currency, area, room count, shortened description and photo URLs. We retain the listing request itself for up to 30 days to avoid fetching the same page again for minor corrections.

3.4. Billing data

• Billing profile, if completed: recipient type and name, company tax ID and address (street, postcode, city and country).
• Order history: Stripe payment session identifier, amount, currency, status and number of credits purchased.
• Credit ledger: each top-up and charge, with its reason and date.

We do not process your payment card details. Stripe handles payment entirely on its own page. When creating a Stripe customer, we provide your email address and, if you have a billing profile, its name and address. We also receive the identifiers and information needed to settle the transaction.

3.5. Reports and contact

• Bug reports and ideas: category, report content, any email address you provide, the URL from which the report was sent and, if any occurred, recent browser console error messages. These may include fragments of URLs and identifiers of your material.
• Feedback on AI-generated reels: your feedback and a snapshot of the reel at the time of the report (idea, prompt used, timeline, captions, photo references, project name and address). We save the snapshot so that the report remains meaningful even after the reel or project is deleted.
• Email correspondence you send us.

3.6. Technical data and security records

• Activity history and application diagnostics: account identifier, time, dashboard path visited, operation type and outcome, material or job identifiers, and error messages and stack traces. These help diagnose failures and resolve user problems. We do not record form content, job payloads, headers, cookies or URL parameters. We filter credentials and email addresses from error messages, but their content may exceptionally contain other personal data. Only the administrator has access.
• Administration panel audit: every state change we make in the panel — who did what, on whose account, and with which parameters. The record does not contain IP addresses.
• Public page view counter: page identifier, view date, optionally the referring domain, and a shortened fingerprint calculated from the IP address, browser header and a day-dependent salt. The fingerprint limits repeated counting of the same page within a day. A separate IP address hash limits views of one page to five per day from that address. We do not store raw IP addresses in the views table or use cookies for this counter. We activate it only after consent to view statistics. Without consent, we neither create these hashes nor record a view. We treat hashes as pseudonymous data to which the GDPR may apply.
• Server and hosting provider logs, created automatically for security and failure diagnosis.
• Error telemetry, if enabled: exception description, stack trace, technical context and page or request URL. We disable Sentry’s default collection of identifying data and remove cookies from server reports, but error content or a URL may exceptionally contain personal data.

4. Why we process data and on what legal basis

The legal bases are those in Article 6(1) GDPR.

• Account operation and service delivery — point (b), performance of a contract. This includes sign-in, creating projects, generating material and sharing it.
• Billing and payment handling — points (b) and (c), legal obligations concerning accounting and tax records.
• Reports and correspondence — point (f), our legitimate interest in answering questions and fixing errors.
• Service security: sign-in attempt limits, administrator activity auditing and abuse prevention — point (f).
• Public page view statistics — point (a), your consent, using the hashes described in section 3.6. You can withdraw consent at any time.
• Establishing, pursuing and defending claims — point (f).

Providing an email address is necessary to create an account. Other profile data (name, phone, agency name and logo) is voluntary. The service works without it; only the appearance of completed material changes.

4a. Discounts, referrals, commissions and document acceptance

For new purchases, we record Stripe coupon and promotion code identifiers, the code text where available, and the amounts recorded by Stripe. Historical local definitions, versions, reservations and uses are retained in the archive. We record the original price, discount, discounted amount, number of credits and settlement status. This serves order performance (Article 6(1)(b) GDPR), accounting obligations (point (c), to the extent required by law), and limit enforcement and abuse prevention (point (f), our interest in accurate settlements and customer protection).

When you arrive through a direct partner link, we process a random referral identifier. With the registration attempt, we record the email address, partner identifier, activation token hash, terms version, and acceptance, expiry, verification and attribution dates. After verified creation of a new account, we record the original partner attribution for later purchases. We do not change an existing account’s attribution or use a persistent marketing referral cookie. An unrelated later visit does not create a referral. The form informs you of a valid referral before registration.

Referral handling and correct commission calculation are based on our legitimate interest in accounting for the source of sales and preventing abuse (point (f)). For partners, we also process status, rate, commission and payout data to perform the partner programme agreement (point (b)) and tax obligations to the extent required by law (point (c)). The use of point (f), the interest assessment and the information notice require review before public activation. Providing a referral identifier is not necessary for ordinary registration.

Partner data includes the account identifier, individual rate, status, permanent link and optional code. We record the partner, commission rate, tax basis and gross and net amounts on the order. Financial history retains commissions, their availability dates, refund and dispute adjustments, settlement batches, and external payment dates and references. We do not collect bank account numbers or initiate automatic transfers.

Partners can access their own link and aggregate results: numbers of referred accounts and sales, commission amounts, adjustments and payouts. We do not disclose referred customers’ email addresses, names, account identifiers or identities. Authorised support staff and administrators see detailed links for settlement purposes. We audit administrative changes to codes, statuses and rates, order reconciliation and payouts (point (f), protecting settlements and claims).

These categories are stored in our database at Hetzner. The infrastructure and backup providers described in section 9 have access within the scope of their services. Stripe manages codes and receives the pack price and order identifier together with existing payment data. We do not send it the referral identifier or partner identity. Resend receives the email address and activation link, whose return address includes a random registration attempt identifier. Accounting and legal advisers may receive documentation to the extent necessary. Transfer rules and rights remain as described in sections 10 and 12.

We record acceptance of the terms with the version, date and source, retaining successive entries and previous evidence. This is evidence of entering into or amending the agreement (point (b)) and material for claims (point (f)). Acknowledging the privacy policy is not blanket consent to processing. Purchase and programme data are included in your own data export. A partner’s export does not include data identifying customers.

Section 11 sets retention periods, taking account of legal obligations, claims and data minimisation. A registration attempt’s validity period (24 hours) does not mean its record is deleted. Automatic deletion or anonymisation has not been implemented for the new categories. Referral expiry and account closure do not automatically remove financial links. The final retention and erasure-request procedure requires separate review. We do not present preservation of the database as an unlimited legal basis for retention.

5. Automated decisions and profiling

We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you. We do not profile you for marketing purposes.

The Service uses AI models to carry out creative work you request: analysing photos, generating video shots and voiceovers, and proposing reels. This is a tool that follows your instructions, not a mechanism for assessing you as a person.

6. Cookies and browser storage

We use cookies for sign-in and security and to remember your theme and privacy settings:

• authjs.session-token keeps you signed in after you enter a code. It expires after 14 days, or earlier following an email change, account deletion or “sign out of all devices”.
• authjs.csrf-token and authjs.callback-url are short-lived, help complete sign-in securely and return you to the correct page, and disappear when the procedure ends.
• phottate-logowanie (on an encrypted connection: \_\_Secure-phottate-logowanie) remembers the email address between entering it and entering the code, so that the code works only in the browser where sign-in was requested. It is cryptographically signed, inaccessible to page scripts, and disappears after 10 minutes or after sign-in.
• phottate-ui-locale — after an explicit choice, stores the interface language (Polish or English) for one year, only on the current host. When you are signed in, we also save the preference in your profile; it takes precedence over the browser setting. Interface language does not change your material’s content. The cookie is not used for analytics or advertising.
• theme remembers your chosen light or dark mode for up to one year.
• phottate-zgody stores selected consent categories for up to 180 days. It is signed and accessible only to our server. It is not used for cross-site tracking.
• \__Secure-mapka-admin applies only to our administrative accounts: an elevated administration panel session that expires after one hour.

The video editor also stores video track height and guide settings locally in your browser. These settings are not sent from browser storage to our server. We do not use analytics, advertising or tracking cookies, and we do not embed social media pixels.

On your first visit, you can accept view statistics, reject optional processing or choose your settings. Without valid consent, the public presentation and video counter receives no data from your request. The “Privacy settings” button lets you change your choice or withdraw consent at any time. Withdrawal applies prospectively and does not affect the lawfulness of earlier processing. Advertising and remarketing are currently inactive. Before enabling these features, we will ask for a new choice.

Article 399(3) of the Polish Electronic Communications Law provides an exception to the consent requirement when storing or accessing information is necessary to deliver a service requested by the user. Sign-in and security cookies serve such a service. We store theme and editor settings after you select the relevant features, to preserve your requested way of using the Service. We store the privacy settings cookie to respect your choice on subsequent visits.

You can delete cookies and locally stored settings in your browser. Deleting the session cookie signs you out.

7. Photos, listings and third-party data

This is the most important section for property agents. Please read it carefully.

Material you upload or import — interior and exterior photos, listing descriptions and property addresses — may contain the personal data of other people: homeowners, tenants, people visible in photos, and information about their property and circumstances.

For this material, the roles are as follows:

• You are the controller of personal data contained in uploaded material. You decide whose home to photograph and why to publish it, and you are responsible for having a legal basis for processing.
• We are the processor. We process it only on your documented instructions, to the extent needed for the requested operation, and do not use it for our own purposes.

By uploading material, you declare that you have the right to process it and entrust its processing to us. In particular, you have the property owner’s consent to use the photos and consent to disseminate the likeness of any people visible in them.

We recommend that you do not upload photos showing people, documents, correspondence or other data that could identify residents. They are unnecessary for presenting property and significantly increase your risk.

The data processing terms — scope, duration, party obligations, subprocessors and deletion rules — are governed by the data processing agreement forming Annex 1 to the terms of service, available at phottate.com/umowa-powierzenia. By accepting the terms, you enter into that agreement with us.

8. Public pages

You share generated material at public addresses: neighbourhood animations under addresses beginning with “/p/”, and completed edits under addresses beginning with “/f/”. Each address includes a random material identifier.

Remember that anyone who knows the address can open the page. It requires no sign-in and is not password-protected. The page contains the property address and, if you have completed your profile, your agency name, logo and contact details. You publish them deliberately to promote the listing. We ask search engines not to index these pages (through robots.txt and a “noindex” tag), but we cannot control where you share the link.

A person opening a Public page downloads the map from MapTiler and photos and videos from Cloudflare storage. These providers see the person’s IP address and technical browser information under their own terms. Our view counter (section 3.6) operates only with consent to statistics, without analytics cookies or raw IP storage in the views table.

To withdraw material from circulation, delete it in the dashboard. Its public address will stop working.

9. Whom we share data with

We use external providers depending on the features used and the Service’s configuration. Their legal roles differ: some process data on our behalf, some act as separate controllers, and some public data sources receive no personal data. We maintain a recipient and provider register, including transfer verification status, in docs/rodo/subprocesorzy.md. Entries marked as candidates do not indicate an active service.

Infrastructure

• Hetzner — servers in Germany (European Union) running the application, PostgreSQL database and video job queue processor. The database volume is fully encrypted.
• Cloudflare R2 — storage for photos, generated shots, completed videos, voiceover files, uploaded music and encrypted database backups.
• Sentry, if reporting is configured — the application error telemetry described in section 3.6. Settings disable default collection of identifying data, and we remove cookies from server reports. We cannot, however, rule out personal data in an exception’s content or request URL.
• RunPod or Google Cloud (Cloud Run), if remote rendering is configured — video rendering on a remote GPU for the duration of an individual render: initially map animations, and edits after additional legal verification. A job receives only the data needed to render: coordinates and nearby places for maps; also your photos, clips, branding and audio for edits. It runs in a container with no persistent disk and no access to our database. Results return to our storage, and working copies are deleted within one day at the latest. Without remote rendering configuration, our worker performs the job. Koyeb remains a test candidate and is not selected by the production adapter.

Communication and payments

• Resend — sends email: sign-in codes, activation links, email change confirmations and notifications about completed material.
• Stripe — handles payments for credit packs. Stripe is a separate controller of your payment data and applies its own privacy policy.

Content generation and processing

• fal.ai — generation platform for video shots from photos, virtual staging, photo correction, resolution enhancement, voiceover speech synthesis and music. It receives your photos, voiceover scripts and scene descriptions. The models it actually uses are supplied by third parties, including Kling, MiniMax, Wan, Seedance, SeedVR, Topaz, Google (Nano Banana) and ElevenLabs. We maintain the current list in the subprocessor register.
• OpenRouter with Google Gemini — an automatic photo quality check before shot generation (whether a photo is suitable for animation). It receives the photo through a temporary, one-time link.
• Anthropic — photo analysis and reel planning by a language model. It receives your photos, project name and address, imported listing data and the instruction you enter.

Place data and maps

• Mapbox — converts addresses to coordinates and calculates walking times. It receives the property address and coordinates.
• MapTiler — map layers used when rendering animations.
• OpenStreetMap (Overpass API) — data on nearby points of interest. Queries concern an area, not a person.
• Optional listing retrieval service — if configured for portals that block direct access, it receives the listing URL. Its operator must be identified in the register before use with user data.
• National Bank of Poland — public property price statistics. We do not send it any of your data.

Other recipients

Data may be disclosed to entities authorised by law (courts, law enforcement and tax authorities), and to our legal and accounting advisers to the extent necessary for their duties.

10. Transfers outside the European Economic Area

Some providers, including fal.ai, Anthropic, Cloudflare, Stripe, Mapbox, Resend, OpenRouter and, for remote rendering, RunPod or Google Cloud, may process data outside the EEA or permit access from outside it. Some models available through fal.ai come from Chinese providers. Depending on the feature, transfers may include uploaded photos, prompt content and project data. The application and database run on Hetzner servers in Germany.

A transfer to a particular recipient may be based on an adequacy decision covering its current Data Privacy Framework certification (Article 45 GDPR), or standard contractual clauses with the required supplementary measures (Article 46 GDPR). The register identified in section 9 describes the assigned basis and verification status. An entry marked “to be confirmed” does not confirm that an agreement has been signed, certification obtained or a transfer assessment completed. Selecting a European server region does not in itself exclude access from a third country.

Third countries may provide a lower level of data protection than European Union law, and their public authorities may have broader data access powers. AI-based features may additionally require transferring photos and prompt content. The other providers listed above also serve other parts of the Service.

Information about the safeguards used and how to obtain a copy is available on request at our contact address.

11. How long we retain data

Retention of the new categories in section 4a is determined by the period of contract performance, relevant tax obligations and claim limitation periods. Financial history, account links and acceptance evidence are retained when an account is closed. We do not claim full anonymisation: identifiers and links may still allow the administrator to identify an individual. Expiry of a 24-hour registration attempt does not delete its record. Before publication, a separate procedure for deleting or restricting this data must be approved, and the existing retention promises below must be reconciled with the Service’s operation.

• Account data and created material — for the duration of your account. You can delete the account yourself in the dashboard. Deletion is immediate, subject to the exceptions below.
• Archived projects — automatically deleted 30 days after archiving, together with associated material.
• Manually deleted material — deleted immediately, without a recycle bin.
• Sign-in codes — 10 minutes from sending; we also delete them when you request a new code or sign in. Account activation links — 24 hours. Email change tokens — up to 24 hours from the request.
• Terms consent from the registration form — until account creation, when it is transferred to the account, or at most 30 days if no account is created.
• Billing records and the credit ledger — five years from the end of the tax year in which the tax obligation arose. After account deletion, only an anonymised billing record remains (order identifier and amounts), without personal data. We do not delete this record on request because tax law requires it.
• Bug reports and reel feedback — up to 24 months.
• Activity history and application diagnostics — 30 days. Records linked to an account are also deleted when the account is deleted.
• Administration panel audit records — 24 months, as a safeguard against abuse on our side.
• Public page views (section 3.6) — 90 days.
• Consent choices in the browser — the cookie expires after at most 180 days; each change replaces the previous value.
• Listing requests during imports — up to 30 days.
• Photo analyses for AI reels — deleted together with the photo concerned.

Deleting an account also permanently deletes uploaded photos and generated videos. Download what you want to keep beforehand. After deletion, it cannot be restored.

12. Your rights

You have the right to:

• withdraw consent at any time through the “Privacy settings” button on the website, without affecting the lawfulness of processing before withdrawal;
• access your data and obtain a copy (Article 15 GDPR);
• rectify inaccurate or incomplete data (Article 16);
• erase data, the “right to be forgotten” (Article 17);
• restrict processing (Article 18);
• port data to another controller (Article 20);
• object to processing based on our legitimate interest on grounds relating to your particular situation (Article 21).

Some of these rights have limits. We will not delete accounting documents before the period required by tax law expires, or restrict processing where it is necessary to defend claims.

How to exercise these rights: email kontakt@phottate.com from the address registered to your account. We respond without undue delay, no later than one month after receiving the request.

You can also fulfil common requests yourself without contacting us: delete your account in the dashboard (Settings → Privacy tab), and download a JSON copy of your data — projects, material, credit history and order history — there.

If you believe we process your data unlawfully, you can complain to the President of the Polish Personal Data Protection Office, ul. Moniuszki 1A, 00-014 Warszawa, uodo.gov.pl.

13. Security

Our safeguards include:

• passwordless sign-in with a one-time code sent to your inbox. We store no passwords, so none can be stolen;
• email change confirmation tokens stored only as cryptographic hashes;
• encrypted connections (HTTPS);
• encryption at rest: the database volume on our server is fully encrypted (LUKS). We encrypt backups before sending them off-server and keep the decryption key only off-server. File storage (Cloudflare R2) encrypts data at rest under its own terms;
• sign-in attempt limits;
• administration panel access protected by a second authentication factor and recorded in an audit log;
• least-privilege access: we access production data only when needed to handle a report or resolve a failure.

No safeguard offers complete certainty. If you notice anything concerning, email kontakt@phottate.com.

14. User age

The Service is intended for adults working in real estate or presenting their own property. We do not target children or knowingly collect their data.

15. Policy changes

We may update this policy, for example when adding a feature that uses a new provider. We will give at least 14 days’ advance notice of material changes by email to the address linked to your account. The last update date appears at the beginning of this document.

The change history of this document is public. The policy is versioned together with the Service’s code.

16. Contact

For personal data matters: kontakt@phottate.com

[COMPANY NAME] [REGISTERED OFFICE ADDRESS]

← Back to home