Privacy Policy

Last updated: July 11, 2026

This Privacy Policy describes how VistaRight (“we”, “us”, or “our”) collects, uses, and shares information when you use our website and services (the “Service”). VistaRight is operated from the United Kingdom and, for the purposes of UK data protection law, is the controller of the personal data described in this policy (except workplace content controlled by your employer — see section 5). You can reach us at [email protected].

1. Information We Collect

• Account information: name, email, organisation, and authentication identifiers.
• Billing information: handled by our payment processor (Stripe). We do not store full card numbers.
• Content you upload: property photographs and other inputs you submit to the Service, and the edited versions we generate from them.
• Usage data: log data, device information, IP address, and interaction events.
• Cookies: used for authentication and session management only. We do not use advertising or cross-site tracking cookies.

2. How We Use Information

• To provide, maintain, and improve the Service.
• To process payments and manage subscriptions.
• To communicate with you about your account, security, and product updates.
• To detect, prevent, and address fraud, abuse, or technical issues.
• To comply with legal obligations.

3. AI Processing of Your Images

Uploaded photographs are processed by third-party AI model providers (currently OpenAI and Google) solely to deliver the editing features you request — classifying that an upload is a property photo and generating the edited version. We access images only to operate the Service and to investigate abuse. We do not use your images to train AI models, and we use API tiers under which our providers do not use your content to train theirs.

4. Sharing & Service Providers

We share information with service providers (processors) who help us operate the Service. Our current providers are:

• Stripe — payments and subscription billing
• Render — application hosting
• Neon — database hosting
• Cloudflare — image storage
• Resend — transactional email (sign-in links, notifications)
• OpenAI and Google — AI image classification and editing (see section 3)
• Sentry — error monitoring (configured to exclude request bodies and IP addresses)

We may also disclose information to comply with law or protect rights, safety, and property. We do not sell your personal information.

5. Visibility Within Your Organisation

VistaRight is a team product. If your account belongs to an organisation, administrators of that organisation can see the images you upload and edit, your usage statistics, and your account status, and can manage your membership. If you joined through your employer, your employer determines how that workplace data is used.

6. Data Retention

• Images: kept until you delete them or your account is deleted. Deleting an image permanently removes the stored original and edited files.
• Account data: kept while your account is active, and deleted on verified request (see section 8).
• Security & audit logs (including IP addresses): retained for up to 24 months for fraud prevention, abuse investigation, and security, then deleted. Where an account is erased, log entries are unlinked from the account and identifying details are removed.
• Billing records: retained as required by tax and accounting law.

7. Security

We use technical and organisational measures appropriate to the risk, including encrypted connections, private image storage with expiring access links, revocable sessions, and audit logging of privileged actions. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

8. Your Rights

If you are in the UK or EU, you have the right to access, correct, delete, or receive a copy of your personal data, and to object to or restrict certain processing. To exercise any of these rights, email [email protected] from the address on your account. We respond to verified requests within one month. You can also delete individual images yourself at any time from within the Service, and you may lodge a complaint with the ICO or your local supervisory authority.

9. International Transfers

Some of our providers process data outside the UK/EEA (for example in the United States). Where they do, we rely on appropriate safeguards such as the UK Extension to the EU-US Data Privacy Framework or Standard Contractual Clauses.

10. Children

The Service is not directed to children under 13 (or the equivalent minimum age in your region), and we do not knowingly collect their personal information.

11. Changes

We may update this policy from time to time. Material changes will be posted on this page with a new “Last updated” date.

12. Contact

Questions about this policy? Contact us at [email protected].