Book a demo

Privacy Policy

for the use of the AIXpose.art platform

Effective Date: August 14, 2026

1 Controller and Contact

The controller for data processing is:

AIXpose OÜ

Ahtri tn 12
15551 Tallinn
Estonia

Registry code: 17473004
VAT ID: EE102978140
Email: legal@aixpose.art

You can contact us at any time with questions about data protection.

A data protection officer has not been appointed, as the statutory requirements for this are not met.

2 Scope

This Privacy Policy applies to the use of the AIXpose.art platform as well as all associated functions, interfaces, website areas, and support services.

The platform is intended exclusively for businesses within the meaning of the German Civil Code. The platform is designed for object-related real estate content without personal reference.

3 Principles of Data Processing

We process personal data in accordance with the principles of the GDPR:

  1. Lawfulness, fairness, and transparency
  2. Purpose limitation
  3. Data minimisation
  4. Accuracy
  5. Storage limitation
  6. Integrity and confidentiality
  7. Accountability

We process personal data on the following legal bases:

  1. Contract performance (Art. 6 para. 1 lit. b GDPR): To provide the platform, process payments, and manage accounts and subscriptions
  2. Legitimate interests (Art. 6 para. 1 lit. f GDPR): To improve the platform, ensure stability, prevent fraud, and carry out marketing (to the extent permitted)
  3. Legal obligation (Art. 6 para. 1 lit. c GDPR): To fulfil statutory retention obligations
  4. Consent (Art. 6 para. 1 lit. a GDPR): To the extent you have given us consent

5 Types of Data Collected and Purposes of Processing

5.1 Account Data

We collect and process the following account data:

  • Company name, name of the account holder
  • Email address
  • Billing address
  • Telephone number (optional)
  • Password (stored in encrypted form)

Purpose: Account creation, authentication, communication, contract performance

Legal basis: Art. 6 para. 1 lit. b GDPR (contract performance)

5.2 Payment Data

Payments are processed via Stripe. We do not receive complete credit card details.

Data collected:

  • Billing address
  • Payment method (credit card, SEPA Direct Debit)
  • Transaction data (via Stripe)

Purpose: Processing of payments, invoicing

Legal basis: Art. 6 para. 1 lit. b GDPR (contract performance)

Note: Depending on its role, Stripe may act as a controller or as a processor. Further information: stripe.com

5.3 Upload Content (Input)

You can upload real estate photos, floor plans, texts, and property information.

Subject of processing: The platform is intended exclusively for object-related real estate content without personal reference. Uploaded content therefore does not constitute personal data in intended operation. Personal data regularly arises in the course of platform use only in relation to the account, payment, usage, technical, and communication data described in the other sections of this policy.

Your responsibility for uploaded content: You are responsible for ensuring that you hold the necessary rights in the uploaded image material and that you are authorised to edit it and to have it edited. This includes in particular the usage rights in photographs created by third parties (for example real estate photographers), the consent of the owners or persons entitled to dispose of the property, and, where in an exceptional individual case persons or personal elements are identifiable in the images, the consents required for this. You undertake not to upload personal data in images, in particular no identifiable persons, no children, no faces, and no identity document data. Details are set out in Section 8 of the Terms and Conditions.

Purpose: Generation of visualisations and outputs

Legal basis: Art. 6 para. 1 lit. b GDPR (contract performance)

Retention period: For as long as the account is active and, after the end of the contract, in accordance with Section 15 of the Terms and Conditions

5.4 Usage Data

We collect information about the use of the platform:

  • Generated outputs
  • Functions used
  • Credit consumption
  • Timestamps of actions
  • IP address (on login and important actions)

Purpose: Provision of the service, billing, improvement of the platform, security

Legal basis: Art. 6 para. 1 lit. b and f GDPR

5.5 Technical Data

We collect technical information:

  • Browser type and version
  • Operating system
  • Device information
  • Referrer URL
  • Time of access

Purpose: Ensuring functionality, security, troubleshooting

Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest)

5.6 Communication Data

If you contact us by email or contact form or sign up for early access:

  • Name, email address
  • Company and telephone number (contact form, optional)
  • Message content
  • Time of communication
  • Product interest and consent status (early-access forms)

Purpose: Handling your enquiries, support, and sending the product launch notification you have requested

Legal basis: Art. 6 para. 1 lit. b and f GDPR; Art. 6 para. 1 lit. a GDPR for launch notifications

6 Cookies and Tracking Technologies

We use cookies and similar technologies:

6.1 Necessary Cookies

These are required for the basic functions of the platform:

  • Session cookies (authentication)
  • Security cookies
  • Functional cookies

Legal basis: Art. 6 para. 1 lit. b GDPR (contract performance), Section 25 para. 2 no. 2 TDDDG for storage on your end device

6.2 Analytics Cookies (optional)

We may use analytics tools to understand and improve usage. These are set only with your consent.

Legal basis: Art. 6 para. 1 lit. a GDPR (consent), Section 25 para. 1 TDDDG

You can manage cookies in your browser settings. Please note that disabling cookies may impair the functionality of the platform.

7 Disclosure of Data to Third Parties

7.1 Processors

We use the following service providers as processors:

  • Stripe: Payment processing (stripe.com)
  • Cloud hosting providers: Storage and processing of data
  • Email service providers: Sending of emails
  • Support tools: Customer support
  • Form service providers: Processing and forwarding of contact form and early-access requests

These service providers process data only in accordance with our instructions and are contractually obliged to comply with the GDPR.

7.2 Disclosure to Third Parties

We do not disclose your data to third parties except:

  • If you have expressly authorised us to do so
  • If this is necessary for contract performance (e.g. payment processing)
  • If we are legally obliged to do so (e.g. official requests)
  • To enforce our rights

We do not sell your personal data to third parties.

8 Company Presences on Social Networks

We maintain publicly accessible profiles on social networks in order to communicate with interested parties and customers and to provide information about our offering:

  • LinkedIn, operated by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland
  • Instagram, operated by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland

On our website, these profiles are embedded exclusively as simple hyperlinks. No social media plugins are loaded, so that merely visiting our website does not transmit any data to the operators of the networks. A transfer of data takes place only when you actively click the link.

If you visit our profiles within the networks or interact with them, the operators process your data under their own privacy policies and under their own responsibility. We have no influence over this and no access to the underlying raw data.

For the aggregated page statistics (Insights) provided by the networks, we are joint controllers with the respective operator within the meaning of Art. 26 GDPR. These statistics are processed on the basis of our legitimate interest in needs-based external presentation and reach measurement (Art. 6 para. 1 lit. f GDPR). We receive only anonymised analyses, for example regarding reach, interactions, and broad audience characteristics. The essential contents of the joint controllership agreements are made available by the operators in their respective help centres.

You may exercise data subject rights vis-à-vis us as well as vis-à-vis the respective network operator. As the operators have direct access to the data, we recommend that you submit requests there. Otherwise we will forward requests.

9 International Data Transfers

Our registered office and our office locations are within the European Union. Processing outside the European Economic Area (EEA) takes place only insofar as individual service providers we use process data in third countries, in particular:

  • USA (when using Stripe as well as individual cloud and infrastructure services)
  • Other countries used by our service providers under the safeguards described below

We ensure that appropriate safeguards are in place:

  • Adequacy decisions of the European Commission, in particular the EU-US Data Privacy Framework for correspondingly certified providers
  • Standard contractual clauses of the European Commission
  • Other appropriate safeguards pursuant to Art. 46 GDPR

10 Data Security

We implement technical and organisational measures to protect your data:

  • Encryption of data transmissions (TLS/SSL)
  • Encrypted storage of sensitive data
  • Regular security reviews
  • Access controls and authentication
  • Regular backups

Despite all measures, absolute security cannot be guaranteed. We recommend that you use strong passwords and treat them confidentially.

11 Retention Period

We store personal data only for as long as necessary:

  • Account data: For the duration of the contract and thereafter in accordance with statutory retention obligations (generally 10 years for business correspondence)
  • Payment data: In accordance with statutory retention obligations (generally 10 years)
  • Upload content: For as long as the account is active. After the end of the contract, content may be deleted after reasonable periods, unless statutory retention obligations prevent this (see Section 15 of the Terms and Conditions)
  • Usage data: For the duration of the contract and thereafter for a maximum of 2 years for analysis purposes
  • Communication data: 3 years after last contact

After expiry of the retention periods, the data is deleted or anonymised.

12 Your Rights

You have the following rights regarding your personal data:

12.1 Right of Access (Art. 15 GDPR)

You have the right to obtain information about the personal data we process.

12.2 Right to Rectification (Art. 16 GDPR)

You may request the rectification of inaccurate data or the completion of incomplete data.

12.3 Right to Erasure (Art. 17 GDPR)

You may request the erasure of your data, unless statutory retention obligations prevent this.

12.4 Right to Restriction of Processing (Art. 18 GDPR)

You may request the restriction of processing of your data.

12.5 Right to Data Portability (Art. 20 GDPR)

You may request the transfer of your data in a structured, commonly used, and machine-readable format.

12.6 Right to Object (Art. 21 GDPR)

You may object to the processing of your data for reasons arising from your particular situation, to the extent that processing is based on Art. 6 para. 1 lit. f GDPR (legitimate interest).

You may withdraw given consents at any time. The lawfulness of processing carried out until withdrawal remains unaffected.

12.8 Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement. The supervisory authority competent for us is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn, Estonia).

Contact for exercising your rights:

Email: legal@aixpose.art

We will respond to your request within one month.

13 Special Notes

13.1 Content and Rights in Image Material

You are responsible for the content you upload. You warrant that you hold the necessary rights in the image material and that you are authorised to edit it and to have it edited by us. This applies in particular to images created by third parties and to images of occupied or used properties. Further details are set out in the Terms and Conditions.

13.2 No Processing of Depictions of Persons

The platform is designed for object-related real estate content without personal reference. You undertake not to upload personal data in images, in particular no identifiable persons, no children, no faces, and no identity document data. Details are set out in Section 8 of the Terms and Conditions.

13.3 Roles and Processing on Behalf

With regard to account, payment, usage, technical, and communication data, we are the controller within the meaning of Art. 4 no. 7 GDPR.

Uploaded content is, as intended, free of personal reference, so that as a rule no processing on behalf within the meaning of Art. 28 GDPR takes place in this respect. If you require a data processing agreement in an individual case, for example due to internal requirements or your own compliance needs, we will provide such an agreement upon request.

13.4 No Automated Decision-Making

Automated individual decision-making, including profiling, within the meaning of Art. 22 para. 1 and 4 GDPR does not take place. The AI-supported processes used on the platform serve exclusively to process and generate image, floor-plan, and video content and have no legal effect vis-à-vis you or data subjects.

13.5 Minors

The platform is intended exclusively for businesses and not for minors. We do not knowingly collect data from minors.

14 Changes to this Privacy Policy

We may adjust this Privacy Policy if this is necessary for legal, technical, or economic reasons.

We will inform you of changes in text form (e.g. by email). Material changes will be communicated in good time before they take effect.

The current version is always available on our website.

15 Contact

You can contact us at any time with questions about data protection:

AIXpose OÜ
Ahtri tn 12
15551 Tallinn
Estonia

Registry code: 17473004
Email: legal@aixpose.art

Offices

Berlin
Heidestraße 34
10557 Berlin
Germany

Email: de@aixpose.art

Poznań
ul. Święty Marcin 5
61-804 Poznań
Poland

Email: pl@aixpose.art