Privacy Policy

Spazeo ("we," "our," or "us") operates the spazeo.io website and platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

We are committed to complying with the European Union General Data Protection Regulation (GDPR), the India Digital Personal Data Protection Act, 2023 (DPDP Act), and other applicable data protection laws.

2.1 Information You Provide

• Account data: name, email address, password (managed by Clerk), profile photo, company name, phone number.
• Tour content: 360-degree panoramic images, scene titles, descriptions, hotspot data, floor plans.
• Lead data: information submitted by visitors through lead capture forms on your tours (name, email, phone, message).
• Payment data: billing address, payment method details (processed and stored by Stripe; we do not store full card numbers).
• Communications: messages you send us via support, contact forms, or email.

2.2 Information Collected Automatically

• Usage data: pages visited, features used, tour interactions, session duration, click patterns.
• Device data: browser type, operating system, device type, screen resolution.
• Location data: approximate location derived from IP address (country and city level only).
• Cookies and tracking: see our Cookie section below.

• Provide, operate, and maintain the Spazeo platform.
• Process your subscription payments and manage billing.
• Deliver AI-powered features (scene analysis, virtual staging, description generation) by sending panorama data to our AI processing partners (OpenAI, Replicate).
• Provide analytics and insights about your virtual tour performance.
• Send transactional emails (lead notifications, account updates).
• Send marketing communications (only with your explicit consent).
• Improve our products, features, and user experience.
• Detect, prevent, and address fraud and security issues.
• Comply with legal obligations.

• Contract: processing necessary to provide our Service to you.
• Consent: marketing communications, optional analytics cookies, AI feature processing.
• Legitimate interest: fraud prevention, service improvement, security.
• Legal obligation: tax records, legal compliance.

For users located in India, we process your Digital Personal Data in accordance with the Digital Personal Data Protection Act, 2023:

• We obtain your consent before processing personal data, unless processing is for a legitimate use specified under the Act.
• You have the right to access, correct, and erase your personal data.
• You may nominate an individual to exercise your data rights in the event of death or incapacity.
• We maintain reasonable security safeguards to protect your personal data.
• In the event of a personal data breach, we will notify the Data Protection Board of India and affected users as required.
• You may file a complaint with the Data Protection Board of India if you believe your rights have been violated.

We do not sell your personal data. We share data only with:

• Service providers: Convex (database and backend), Clerk (authentication), Stripe (payments), OpenAI and Replicate (AI processing), Resend (email), Vercel (hosting).
• Legal requirements: when required by law, court order, or government request.
• Business transfers: in connection with a merger, acquisition, or asset sale, with prior notice to you.

We retain your account data for as long as your account is active. Upon account deletion, we remove your personal data within 30 days, except where we are legally required to retain it. Tour analytics data is anonymized after account deletion. Backup copies may persist for up to 90 days.

Depending on your jurisdiction, you may have the right to:

• Access your personal data.
• Correct inaccurate data.
• Delete your data ("right to be forgotten").
• Restrict or object to processing.
• Data portability (receive your data in a structured format).
• Withdraw consent at any time.
• Lodge a complaint with a supervisory authority.

To exercise any of these rights, contact us at privacy@spazeo.io.

We use the following types of cookies:

• Essential cookies: required for authentication, security, and basic functionality. Cannot be disabled.
• Analytics cookies: help us understand how visitors use our platform (PostHog). Can be opted out.
• Marketing cookies: used to deliver relevant advertisements. Require explicit consent.

You can manage your cookie preferences at any time through our cookie consent banner.

Your data may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) for transfers from the EEA, and compliance with Indian cross-border data transfer requirements.

We implement industry-standard security measures including encryption at rest (AES-256) and in transit (TLS 1.3), access controls, regular security audits, and incident response procedures.

Spazeo is not intended for children under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on our website. Your continued use of the Service after changes constitutes acceptance.

For privacy inquiries or to exercise your data rights:

• Email: privacy@spazeo.io
• Mail: Spazeo Inc., [Address]
• Data Protection Officer: dpo@spazeo.io