Privacy Policy

imotfoto (“we”, “us”) offers an online service that lets estate agents and photographers automatically enhance real-estate photos using artificial intelligence. We are the data controller for the personal data processed through this service, within the meaning of the General Data Protection Regulation (GDPR).

Questions about privacy or about exercising your rights? Email privacy@imotfoto.com.

• Account data: your email address and, if you fill them in, your name and company name. You can log in with a password (which is stored encrypted) or via Google.
• Photos: the real-estate photos you upload to be edited, including the technical metadata contained in the file, and the enhanced versions we return.
• Payment data: payments run through Stripe. We only receive a confirmation and invoice details. We do not store full card or bank account numbers ourselves.
• Usage data: your credit balance, the number and type of edits, login events and the chosen subscription/plan.
• Technical data: limited log files (such as IP address and timestamp) needed for security and for resolving issues.
• Communication: messages you send us, for example via the contact form or by email.

We process your data for the following purposes and on the following legal bases:

• Delivering the service (editing, storing and showing you your photos) and managing your account. Legal basis: performance of the contract.
• Payments and invoicing, including the retention of invoices. Legal basis: performance of the contract and a legal (tax) obligation.
• Security and preventing misuse of the service. Legal basis: our legitimate interest in keeping the service safe and reliable.
• Service communication (for example a confirmation or an important notice). Legal basis: performance of the contract. We only send any newsletters or tips with your consent, which you can withdraw at any time.

To enhance your photo it is temporarily sent to the AI service of Google (Gemini). Google processes the photo on our instructions and solely to carry out the requested edit; in doing so Google acts as a processor. Part of this processing may take place outside the European Economic Area (see section 6).

The AI only edits the image (light, color and, if you choose, the sky). No automated decisions about individuals that have legal consequences are made.

We never sell your data. We only engage the following processors, and only to the extent needed to deliver the service:

• Supabase: database and authentication (account and usage data), hosted in the EU.
• Cloudflare R2: storage of your photos, encrypted at rest.
• Google (Gemini): the AI processing of your photos.
• Stripe: processing of payments (PCI-DSS certified).
• Resend: sending emails (such as confirmations and account emails).
• Vercel: hosting and delivery of the website, plus cookieless website statistics (Vercel Web Analytics).

Data processing agreements are in place with these parties so that they only use your data for our instructions.

Some processors (such as Google, Stripe, Resend and Vercel) may process data (in part) outside the European Economic Area, for example in the United States. In that case we rely on the appropriate safeguards required by the GDPR, such as the EU Standard Contractual Clauses and/or an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework).

• Photos: kept for as long as you keep them in your account. You can delete them yourself; after deletion of your account they are permanently erased within 30 days.
• Account data: kept for as long as you have an account and deleted after closure, except where the law requires us to keep it longer.
• Payment and invoice data: kept for 7 years because of the statutory tax retention obligation.
• Technical logs: kept briefly, only for security and troubleshooting.

We use only essential cookies needed to make the service work: a session and authentication cookie to keep you logged in, plus a preference cookie for your theme and cookie choice. We place no tracking, analytics or marketing cookies and share nothing with advertising networks.

For website statistics we use Vercel Web Analytics. This is a cookieless measurement method that collects only aggregated data that cannot be traced back to you (such as pages visited and the number of visitors). No cookies are placed and no personal data is stored for this, so consent is not required.

We take appropriate technical and organizational measures to protect your data. All data transfer takes place over encrypted connections (TLS), photos are stored encrypted and access to data is restricted per user.

Under the GDPR you have the following rights:

• Access to the data we process about you;
• Rectification of inaccurate data;
• Erasure of your data (“right to be forgotten”);
• Restriction of the processing;
• Objection to processing based on legitimate interest;
• Data portability: a copy of your data in a common format;
• Withdrawal of consent you previously gave, without this undoing earlier processing.

You can also delete your account and photos yourself in your settings. For the other requests, email privacy@imotfoto.com. We respond within one month. If you disagree with how we handle your data, you can lodge a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).

We may amend this privacy policy, for example for new features or changed regulations. The date at the top of this page indicates the most recent change. For significant changes we will inform you actively.

Questions about this privacy policy? Email privacy@imotfoto.com or view our terms and conditions.