Privacy Policy

The controller of your personal data is [legal entity name] sp. z o.o., address: [street, building, postal code, city], Poland, NIP [NIP], KRS [KRS] (“we”, “Stretta Studio”).

For any questions about personal data, write to privacy@strettastudio.online.

A note on roles. For your account data (email, payments, projects) we are the controller. For photos of your clients’ premises, you — acting in the course of your professional activity — are the controller, and we process those photos on your behalf as a processor (Art. 28 GDPR) — see Section 3 and the Terms of Service.

We never receive or store payment card details — they are handled by the payment provider (Section 6). Providing an email is required to create an account; you provide the remaining data as you use the service.

A key characteristic of the service is that uploaded photos usually show the premises of your client — a third party. Special rules therefore apply:

• You obtain the client’s consent. By uploading a photo, you confirm that the owner of the premises has agreed to its processing for creating a visualization. This is your obligation under the Terms of Service.
• We are a processor acting on your instructions. We process client photos only to create visualizations and only on your commands in the interface (upload, generate, delete).
• Originals are deleted automatically after 30 days from upload — by a storage lifecycle rule, with no action needed from you. Generation results are kept until you delete the project or the account: you need them to show the client.
• Don’t upload more than needed. Visualizing a ceiling does not require photos of people or documents. If a person accidentally appears in the frame, choose a shot without people where possible.

The visualization is created by a third-party image generation model (Section 6). The photo and markup parameters are passed to the provider solely to perform the specific generation. We do not use your photos to train our own or anyone else’s AI models, and we choose providers whose API terms prohibit using submitted materials for training.

A generation result is an illustrative image. Decisions about the client contract, materials and installation are made by a human; the service performs no automated decision-making producing legal effects concerning you (Art. 22 GDPR).

Strictly necessary cookies (sign-in session, chosen language, your analytics choice) are always set — without them the service does not work or cannot remember your preference. For product analytics we store an anonymous identifier in your browser and send events about how the service is used. Analytics is enabled only after you consent in the banner — before that no analytics data is collected or leaves your device.

There are no advertising cookies and we do not track you across other sites. Analytics events are stored in our own database (with the infrastructure providers listed below) and are not shared with third-party analytics services. You can withdraw consent at any time by clearing the site data in your browser.

We share data only with infrastructure providers without which the service cannot operate. Each acts under a data processing agreement (DPA) and only on our instructions:

Beyond subprocessors, data may be disclosed to competent authorities where required by law, and to legal and accounting advisors to the extent necessary.

Some providers listed in Section 6 are located in the USA or process data outside the European Economic Area. Such transfers rely on lawful safeguards: the European Commission’s adequacy decision for participants of the EU–U.S. Data Privacy Framework, or the Commission’s Standard Contractual Clauses (SCC, Art. 46 GDPR) with supplementary measures. You can request a copy of the relevant safeguards at privacy@strettastudio.online.

After the period expires, data is deleted or irreversibly anonymized. Database backups are overwritten within a limited retention cycle.

Under the GDPR you have the right to:

• access your data and obtain a copy (Art. 15);
• rectify inaccurate data (Art. 16);
• erase your data — the “right to be forgotten” (Art. 17);
• restrict processing (Art. 18);
• receive your data in a portable format (Art. 20);
• object to processing based on legitimate interest (Art. 21).

The fastest way to exercise the right to erasure is the “Delete account” button in settings: it irreversibly deletes the account, projects, photos and results. For other requests, write to privacy@strettastudio.online — we will respond within one month.

If you believe we process data unlawfully, you may lodge a complaint with the supervisory authority — the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl) or with the supervisory authority of your place of residence in the EU.

Requests concerning client photos received from the clients themselves will be forwarded to you as the controller of that data, and we will provide reasonable assistance in fulfilling them.

We apply technical and organizational measures appropriate to the risk (Art. 32 GDPR): traffic encryption (TLS), encryption of files at rest, separate storage for originals (private) and results, least-privilege access control, atomic operation accounting and logging. We will notify you and the supervisory authority of security breaches posing a high risk to your rights in accordance with Art. 33–34 GDPR.

The service is intended for professional use and is not addressed to persons under 18. We do not knowingly collect children’s data; if you become aware of such a case, let us know and the data will be deleted.

We update this policy when the service or legal requirements change. We will give at least 14 days’ notice of material changes (new processing purposes, new categories of subprocessors) by email or in the interface. The current version is always available on this page with its date.

[legal entity name] sp. z o.o., [street, building, postal code, city], Poland.
Data questions: privacy@strettastudio.online
Support: support@strettastudio.online