Privacy policy · Reitur Studio

Who is responsible

[Company name], with registered office at [address], [country] ("we"), is the controller of the personal data collected through Reitur Studio: these pages, the account pages and the application at /studio/.

For any question about this policy or about your data, write to [email protected].

What data we process

We process only what providing the service and measuring visits to the public pages need. Depending on how you use Reitur Studio:

Account. Name, e-mail address, password (stored as a hash, never in clear text), language, organization and your role in it.
Content. The projects, venues and plans you import (DXF, PDF or limits drawn on the map), the reference images you upload, the generated 3D models and renders, the layout proposals and the client or event names you enter.
Use of the service. The record of every AI generation (type, credits, date and the member who requested it), invitations, notifications and shared projects.
Billing. Plan, period, credits and the history of payments and invoices. Your card details go directly to the payment processor; we never see or store them.
Review with clients. When you share an event for review: the e-mail addresses you invite and the access codes we send them (stored as hashes), the credentials of review links (also as hashes), the comments and replies in the viewer, and the date each invited person last opened it. Of anyone who enters with a link we keep no identity data at all.
Venue scans. If you scan a venue with the iPhone app: its geometry (walls, doors, windows, floors and the objects the phone recognises, with their measurements), the points, measurements and corners you mark, each area's name, the phone's path during the scan, and the phone's model and app version. With your location permission, also where the venue is, the address the phone's system looks up for that place and the compass heading; with the motion permission, the height the barometer measures. In open spaces the LiDAR sensor measures the ground's height around each corner: heights only, no images. If you turn on “Venue textures”, also images: a sample of each wall and of the floor and a photo of each wall, which may show whatever is in front of them. Without that option no camera image leaves the phone, and the test recording, if you turn it on, stays on it.
Technical data. IP address, browser type and the server logs security requires, plus the application error reports, which include no cookies, form contents or your identity.
Visits to the public pages. Unless you turn analytics off: which pages you visit, where you came from, your language, browser, device and approximate location, tied to a random identifier stored in a cookie; if you create an account, also some of its steps (creating and confirming it, signing in, your first project, AI requests, sharing and payments, with their amount), without your name or e-mail. To relate a payment to the visit, that identifier goes with the payment to the payment processor.

We ask for no special categories of data, and we ask you not to include any in your projects.

What we use it for

Each use has a basis that justifies it:

Providing the service (performance of the contract). Creating and maintaining your account and organization, storing and showing your projects, generating plans, renders and models, and telling you what happens in them.
Security and abuse prevention (legitimate interest). Confirming your e-mail, limiting attempts, telling people from bots on the account forms and detecting uses contrary to the Terms.
Billing (contract and legal obligation). Charging plans and credits, issuing invoices and keeping them as long as the law requires.
Service communications (contract). Confirmations, invitations, receipts, billing reminders and organization notices. We send no advertising.
Product improvement (legitimate interest). Aggregate usage statistics, without identifying you, to learn what works and what does not.
Measuring the public pages (legitimate interest, which you can object to). Learning how many people visit these pages, what they read, where they come from and how many end up using the studio or buying a plan, to improve them. You can object at any time by turning analytics off with “Cookie preferences” at the foot of every page.

We do not sell your data, use it for advertising or profiling, or make automated decisions with legal effects on you.

AI tools

Layout proposals, renders and 3D models are generated with external providers. For each generation we send only what is needed: the scene description, the capture or the reference images you choose and, for a 3D model, the source image.

We do not train models on your content, and we use each provider's API interfaces under their business customer terms, which we review before integrating them. Results are stored in your project and count as credit usage for your organization. The categories of providers are listed in the next section.

Who we share it with

We do not hand data to third parties for their own purposes. Providers in these categories do process it on our behalf, and only for what is stated:

Hosting. The cloud infrastructure that runs the application, the database and the files.
Network and security. Delivery network, protection against attacks and the check that tells people from bots on the account forms.
Payments. Charging plans and credits, invoices and the billing portal.
E-mail. Transactional e-mail: confirmations, invitations, receipts and notices.
Errors. Application error reports, without personal data.
AI generation. Layout proposals, image renders and 3D models from an image.
Maps. Map and satellite imagery tiles in the venue view. Your browser requests them directly, so these services see your IP address while the map is open.
Web analytics. Measuring visits to the public pages and the steps that follow them (account, projects, payments), unless you turn it off.

You can ask us for the current list of providers at the contact address.

The people you give access to also see your data: the members of your organization according to their role, and anyone who receives a shared project link. And the authorities, when a legal obligation requires it.

Some of these providers process data outside [country]. When they do, we rely on the safeguards their contract provides, such as standard contractual clauses or equivalent mechanisms.

How long we keep it

Account and content. While the account is active. If you close it, we delete or anonymize your data within [30] days, except what we must keep.
Billing. Invoices and payment records for [5] years, as tax law requires.
Technical and security logs. [90] days.
Shared projects. They stop being accessible when the owner withdraws the link or closes the account.
Review invitations and links. They stop giving access when you withdraw them or they expire (links after 30 days by default); access codes expire in ten minutes. Comments are kept with the project.
Scans. With the venue and the projects, while the account is active. The 3D models the phone uploads are deleted 90 days after the scan is imported, or 30 days after a session nobody imported expires; the venue’s measurements and its images are kept with it.
Public page analytics. The data of each visit, [2] months in the analytics service; after that only aggregate reports that do not identify you remain. The cookies last a year from your last visit.

Your rights

You can access your data, correct it, ask us to delete it, object to a processing, restrict it or ask for it in a portable format. Your name, language and notifications you edit yourself in Settings; for everything else write to [email protected].

We answer within the period the applicable law in [country] sets (as a reference, one month). If you believe we have not handled your request properly, you can complain to the data protection authority of your country.

Security

All traffic is encrypted (HTTPS), passwords are stored as hashes, sessions use secure cookies the browser does not expose to scripts, access to each project depends on the organization and the role, and accounts are not activated until the e-mail is confirmed. Provider credentials never reach the browser.

No system is infallible: if we detect a breach that affects you, we will tell you and notify the authority when the law requires it.

Minors

Reitur Studio is aimed at event production professionals. It is not meant for people under 18 and we do not knowingly collect data from minors; if you believe this has happened, write to us and we will delete it.

Changes to this policy

If we change something relevant we will tell you by e-mail or with a notice in the application before it takes effect. The date at the top shows the latest version.