Privacy Policy

1. Introduction

PropertyPixel is operated by Web Ninja - FZCO, a company registered in the Dubai Silicon Oasis Free Zone, Dubai, United Arab Emirates ("we," "our," or "us"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered photo enhancement service at propertypixel.app ("Service").

By using the Service you consent to the practices described in this policy. If you do not agree, please discontinue use of the Service.

2. Information We Collect

We collect information that you provide directly to us:

• Account Information: Email address and, if you set one, a password.
• Profile Information: Name and role (e.g. agent, photographer) if you provide them when completing your profile.
• Payment Information: Billing details processed securely by Stripe. We do not store full card numbers or CVV codes.
• Images: Property photos you upload for enhancement, virtual staging, video generation, or 3D tour creation.
• Usage Data: Pages visited, features used, actions taken, timestamps, IP address, browser type, and device information.
• Communications: Messages you send us via email or support channels.

3. How We Use Your Information

We use the information we collect to:

• Create and maintain your account and deliver the Service
• Process your image enhancement, staging, video, and 3D tour requests
• Process payments and send transaction confirmations and invoices
• Send service-related notices, security alerts, and support messages
• Respond to your questions and customer service requests
• Monitor and analyze usage to improve and develop the Service
• Detect, investigate, and prevent fraudulent or unauthorized activity
• Send marketing communications about new features or offers — you may opt out at any time

If you are located in the EU or UK, we process your personal data under the following lawful bases (GDPR Art. 6):

• Contract performance — processing necessary to provide the Service you signed up for (account creation, image processing, billing)
• Legitimate interests — fraud prevention, product analytics, and security improvements, where these do not override your rights
• Legal obligation — retaining financial records as required by law
• Consent — for optional marketing emails; you may withdraw consent at any time

4. Image Storage and Processing

Images you upload are stored securely and processed using AI technology to provide the enhancements you request. Your images are:

• Used only to provide the specific enhancement service you requested
• Transmitted to our AI processing provider (fal.ai) solely to perform the requested enhancement; they are not retained by that provider beyond processing
• Never used to train AI models without your explicit consent
• Never shared with third parties for marketing or commercial purposes
• Stored using industry-standard encryption at rest and in transit
• Available for you to delete at any time from your account

5. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. Specific retention periods:

• Uploaded and enhanced images: Retained for 90 days from the date of upload. After 90 days, images are automatically and permanently deleted from our storage.
• Account data (email, profile, credit history): Retained for the lifetime of your account. If you delete your account, account data is permanently deleted within 30 days, except where retention is required for legal, tax, or fraud-prevention purposes (up to 7 years for financial records).
• Payment records: Retained for 7 years as required for financial compliance.
• Usage logs: Aggregated and anonymized after 12 months.

You may request earlier deletion of your data at any time by contacting us or by deleting your account from the Settings page.

6. Data Sharing

We do not sell your personal information. We may share your information only with:

• Service Providers: Third-party vendors who help us operate the Service, including Supabase (database and file storage), Stripe (payment processing), fal.ai (AI image processing), Resend (transactional email), and PostHog (product analytics). Each is contractually bound to handle data securely and only for the purposes we specify.
• Legal Obligations: When required by applicable UAE law, court order, or government authority, or to protect the rights, property, or safety of Web Ninja - FZCO, our users, or the public.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, in which case users will be notified in advance.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These include TLS encryption in transit, AES-256 encryption at rest, row-level security on our database, and access controls limiting which personnel can access user data.

However, no method of transmission over the internet is 100% secure. In the event of a data breach that affects your personal information, we will notify you promptly in accordance with applicable law.

8. Your Rights

You have the following rights regarding your personal data. EU and UK residents have these rights under GDPR / UK GDPR:

• Access (Art. 15): Request a copy of the personal data we hold about you
• Correction (Art. 16): Request that inaccurate or incomplete data be corrected
• Deletion (Art. 17): Request erasure of your personal data, subject to legal retention requirements
• Data Portability (Art. 20): Request an export of your data in a structured, machine-readable format
• Restriction of Processing (Art. 18): Request that we limit how we use your data in certain circumstances
• Right to Object (Art. 21): Object to processing based on legitimate interests, including profiling and direct marketing
• Withdraw Consent: Where processing is based on consent, withdraw it at any time without affecting prior processing
• Opt out of marketing: Unsubscribe from marketing emails at any time via the unsubscribe link in any email or by contacting us

To exercise any of these rights, contact us at hello@propertypixel.app. We will respond within 30 days. We may ask you to verify your identity before processing your request.

EU/UK residents: If you are not satisfied with how we handle your data, you have the right to lodge a complaint with your local data protection supervisory authority — for example, the ICO in the UK (ico.org.uk) or your national authority in the EU (edpb.europa.eu).

9. Cookies and Analytics

We use the following types of cookies and tracking technologies:

• Essential cookies: Required for authentication, session management, and core Service functionality. Cannot be disabled without breaking the Service.
• Analytics: We use PostHog to understand how users interact with the Service (pages visited, features used, errors encountered). This data is aggregated and used solely to improve the product. PostHog data is processed under a data processing agreement.

You can control browser cookies through your browser settings. Disabling essential cookies will prevent you from logging in to the Service.

10. International Data Transfers

Web Ninja - FZCO is based in Dubai, UAE. Our service providers (including Supabase, Stripe, and fal.ai) may process data in the United States or other jurisdictions outside the EU/UK/UAE.

For EU and UK users: Where we transfer personal data outside the European Economic Area or United Kingdom, we ensure an adequate level of protection is in place — either through the EU Standard Contractual Clauses (SCCs), UK International Data Transfer Agreements (IDTAs), an adequacy decision, or another approved transfer mechanism under GDPR / UK GDPR. You may request a copy of the relevant safeguards by contacting us at hello@propertypixel.app.

As we do not have an establishment in the EU or UK, and our processing does not involve large-scale systematic monitoring, we are not currently required to appoint an EU/UK representative under Art. 27 GDPR. If this changes as the Service scales, we will update this section accordingly.

11. Children's Privacy

The Service is not directed at children under 18. We do not knowingly collect personal information from anyone under 18. If you believe we have inadvertently collected such information, please contact us and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on the Service, and by updating the "Last updated" date above. Your continued use of the Service after changes are posted constitutes your acceptance of the revised policy.