Privacy Policy

• Account information. Your email address and a password. Passwords are handled by our authentication provider and stored only in hashed form — we never see or store your password in plain text.
• Content you upload. The property photos you upload, the films the Service generates from them, and optional details you add such as a film title.
• Purchase information. Payments are processed by Stripe; we never receive or store your full card number. We receive and keep a record of each purchase — the package, amount, transaction identifier, and your billing address details (such as state and country), which we retain for tax-compliance purposes.
• Technical information. Standard server logs (such as IP address, browser type, and pages requested) and the essential cookies described in Section 5. We do not run third-party advertising trackers.

• To provide the Service: turning your photos into films, storing your films, and showing them in your dashboard;
• To process payments, grant credits, and maintain purchase records required for tax and accounting compliance;
• To send service emails such as account confirmation, password reset, and purchase receipts;
• To respond to support requests;
• To secure the Service, prevent fraud and abuse, and enforce our Terms;
• To comply with legal obligations.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

This is the part most users care about, so here it is plainly:

• Photos are temporary. Uploaded photos are stored in a temporary working area only while your film is being generated and are deleted from our systems automatically after processing.
• Photos are processed by an AI provider. To generate your film, your photos are transmitted to our third-party AI video-generation provider, whose servers may be located outside the United States (currently including Singapore). Their processing is governed by their own terms; PhotoToTour does not use your photos or films to train AI models.
• Films are private and short-lived. Finished films are stored in private storage, accessible only through your account via time-limited links, and are automatically and permanently deleted 30 days after creation. You can delete a film sooner at any time from your dashboard.

We share personal information only with:

• Service providers that operate the Service on our behalf: our authentication/database/storage provider (Supabase), payment processor (Stripe), AI video-generation provider, and hosting provider (Render) — each only receives what it needs for its role;
• Legal and safety recipients, when we believe disclosure is required by law or necessary to protect the rights, safety, or property of PhotoToTour, our users, or the public;
• A successor business, if PhotoToTour is involved in a merger, acquisition, or sale of assets — your information may be transferred as part of that transaction, subject to this Policy.

We use only essential cookies: they keep you signed in and secure your session. We do not use advertising or cross-site tracking cookies. If you block cookies in your browser, sign-in will not work.

• Account information: kept while your account exists;
• Photos: deleted automatically after processing (Section 3);
• Films: deleted automatically 30 days after creation, or sooner if you delete them;
• Purchase records: retained as long as required for tax, accounting, and legal compliance, even after account deletion;
• Server logs: retained briefly for security and debugging.

We protect your information with industry-standard measures, including encryption in transit (HTTPS), hashed passwords, private storage buckets, and strict separation between user-facing and administrative access. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security; if a breach affecting your personal information occurs, we will notify you as required by law.

You can delete any film from your dashboard at any time. To access, correct, or delete your personal information — including deleting your account entirely — email alexanderhartigan3@gmail.com from your account email address, and we will respond within the time required by applicable law. Deleting your account removes your profile, films, and remaining credits; purchase records are retained as described in Section 6.

California residentshave the right under the CCPA/CPRA to know, correct, and delete the personal information we hold about them, and the right not to be discriminated against for exercising those rights. We do not sell or “share” personal information as those terms are defined in California law.

Visitors from the EEA or UK: we process personal information to perform our contract with you, to comply with legal obligations, and for our legitimate interests in operating and securing the Service. You may have rights of access, rectification, erasure, portability, restriction, and objection, and the right to complain to your local supervisory authority. Contact us at the address below to exercise them.

The Service is intended for adults working in real estate and is not directed to anyone under 18. We do not knowingly collect personal information from children under 13; if you believe a child has provided us personal information, contact us and we will delete it.

We are based in the United States, and your information is processed in the United States and in the countries where our service providers operate (including Singapore for AI video generation). Those countries may have data-protection laws different from your own; we share data with providers only as needed to run the Service.

We may update this Policy from time to time. We will post the new version here and update the date at the top; if a change is material, we will provide additional notice (such as email or a notice in the Service). Your continued use of the Service after the effective date constitutes acceptance.

Privacy questions or requests: alexanderhartigan3@gmail.com.