Privacy notice

1. Who is responsible

Virtual Home Stage is the controller for the personal data described in this notice. You can reach us at hello@virtualhomestage.com or by post at to be published before launch.

We have not appointed a data protection officer, because the law does not require one for our activities. Questions about privacy go to hello@virtualhomestage.com.

2. Controller or processor

We are the controller for the data of accounts, contact persons, orders, payments, invoices, the contact form, our own outreach to agencies, reviews and the use of our website.

For personal data that appears in the photos, reference images and order details a customer supplies (for example a person reflected in a mirror, a name on a letter or a street address in an order reference), we act as a processor on behalf of the customer, who is the controller. Our data processing agreement applies to that data. If you appear in such a photo, please contact the estate agent concerned first; we will help them handle your request.

Two things we do with photos on our own account, as controller: we keep a review log (who approved which file and when, with hashes of the files, no images) for 5 years to demonstrate what we approved and delivered; and, for properties in the United States, we keep the copy of the original behind the public link for 24 months so that the edit can be checked. Legal basis: legitimate interest in being able to account for our work and for the label on every image.

3. Which data we process

4. Why we process data and on what legal basis

• To create and manage your account, let you sign in, carry out your orders, deliver, handle revisions, guarantees and refunds, and keep you informed about the status of your orders. Legal basis: performance of the contract (Article 6(1)(b) GDPR), and our legitimate interest in serving our business customers where the contract is with your employer (Article 6(1)(f)).
• To check your VAT number in VIES, apply the correct VAT, issue invoices and keep our accounts. Legal basis: legal obligation (Article 6(1)(c)).
• To answer your question via the contact form or email, and to arrange an office plan. Legal basis: legitimate interest, or steps taken at your request before entering into a contract.
• To send you service emails that belong to an order or your account, such as a reminder about an unfinished order, tips for getting started or a notice that credits are about to expire. Legal basis: legitimate interest. You can turn off the optional ones with the link in the email or in your account settings.
• To ask you once for a review after a delivery, and to publish a review you give us. Legal basis: legitimate interest for the request, which you can object to at any time; your consent for publication, which you can withdraw at any time.
• To contact agencies by email about our service. Legal basis: legitimate interest in offering a service relevant to their work to businesses, within the rules for electronic marketing in the country concerned. See the section on prospects and business outreach.
• To prevent fraud and abuse, such as repeated use of a free photo, and to keep the service and our staff accounts secure. Legal basis: legitimate interest.
• To count visits and orders in total and learn which pages and sources work. Legal basis: legitimate interest. We do not link these statistics to your account or to your name. You can object at any time with the switch on the cookie page; if your browser sends Global Privacy Control or Do Not Track, we count your page views without the daily code and set no fsid cookie.
• To comply with other legal obligations and to establish, exercise or defend legal claims. Legal basis: legal obligation or legitimate interest.

Where we rely on legitimate interest, we have weighed our interest against your interests and rights. You can ask us for that assessment.

We do not sell your data, we do not share it with others for their advertising and we do not build profiles of you. Our own marketing is limited to the business emails described in the section on prospects and business outreach and the optional service emails you can switch off. Providing your account and billing details is necessary to order; without them we cannot supply to you.

5. Prospects and business outreach

If you work at an estate agency we have not worked with yet, we may email the agency to introduce our service. We find agencies and their general business email address on the agency's own public website or in a public business directory. We do not buy email lists.

We keep: the agency's name, town and website, its general business email address, the web page where we found it and when, a contact name if the website shows one, a short note about the agency's listings, and a record of the emails we sent and of any reply or objection.

Legal basis: our legitimate interest in offering a service that is relevant to the agency's work (Article 6(1)(f) GDPR). We send one email and at most one follow-up. Every email says who we are and where we found the address, gives our postal address and a link to this notice, and lets you object with one click.

We follow the rules for electronic marketing of the agency's country. We do not send unsolicited business emails to agencies in Germany or Italy, where the law requires prior consent for this.

You can object at any time, by using the link in the email, by replying, or at hello@virtualhomestage.com. We then stop straight away and put your email address on our objection register, which we keep only to make sure we never contact you again, for as long as we contact agencies.

If you do not reply, we delete your details 12 months after our last email.

6. Automated processing

We do not take decisions about you based solely on automated processing that produce legal effects for you or similarly significantly affect you.

Some checks are automatic: whether a VAT number is valid in VIES, whether an agency has already used a free photo (based on its VAT number and email domain), and whether a rate limit has been reached. If such a check stops you, you can contact us at hello@virtualhomestage.com and a person will look at it.

The staging of photos is done with generative image models. That processing concerns the image of a room, not decisions about people, and every result is checked by a person before delivery.

7. Who we share data with

We use the service providers below. Each processes personal data on our behalf under a data processing agreement, unless stated otherwise. For each provider outside the EEA we name the safeguard for the transfer. We share data with others only where the law requires it (for example with the tax authorities), to establish or defend legal claims (for example with our lawyer or accountant), or as part of a transfer of our business, in which case this notice continues to apply.

8. Data outside the European Economic Area

We choose processing in the EU where we can: our database, photo storage and server functions are in the EU, emails are sent from the EU, and our support mailbox is stored in the EU. Some providers are companies established in the United States, and their staff or sub-processors may access data from there, and the image model providers may process photos outside the EU.

Where personal data is transferred outside the EEA or the UK, we make sure there is an appropriate safeguard, as named for each provider above: an adequacy decision (such as the EU-US Data Privacy Framework, or the UK Extension to it, where the provider is certified), or the European Commission's standard contractual clauses, with the UK International Data Transfer Addendum for data from the UK, together with additional measures where needed. If the Data Privacy Framework ceases to apply, the standard contractual clauses apply in its place. You can ask us for a copy of the relevant safeguard at hello@virtualhomestage.com.

9. How long we keep data

• Photos, results, working copies and reference images: 12 months after delivery.
• Originals of properties in the United States, behind the public link: 24 months after delivery.
• Photos and orders that were never paid: 90 days.
• Messages about an order, notifications in the portal, the record of deliveries sent to a colleague (including the colleague's email address) and your feedback on photos: 12 months, like the photos; feedback on a photo is removed together with that photo.
• Review log: 5 years, without images; it holds only who approved what and when, and hashes of the files.
• Invoices, payments and the accounting records: 7 years, the statutory retention period in the Netherlands.
• Account data: for as long as your account exists. When we delete an account, we remove its photos and personal data and keep only pseudonymised records of payments and orders that we are required to keep.
• Record of emails sent: for as long as the account exists; on deletion the email address is removed from the record.
• Contact form messages and follow-up notes: 2 years.
• Saved quote links: valid for 14 days; download and share links: valid for 60 days.
• Our own visitor statistics: 13 months. The daily random value behind the visitor code: two days. The list of who is on the site right now: until you leave the page, and 10 minutes at the latest. The fsid cookie: 90 days from your first visit, not extended.
• Funnel events: 13 months.
• Security records: hashed rate-limit counters only for as long as the limit runs; reports of blocked browser content 90 days; sign-in countries of our staff 24 months.
• Prospect data: 12 months after our last email if you did not reply. Objection register: for as long as we contact agencies, so that we do not contact you again.

Backups of our database are kept by our database provider for a limited period and are then overwritten.

10. Security

We protect personal data with appropriate technical and organisational measures. Photos are kept in private storage and can only be opened through temporary signed links. All connections are encrypted. Customers can only read their own data. Staff accounts are protected with two-step verification for administrators, sessions that expire, and access limited to what each role needs. Every administrative action with consequences is recorded in a log that cannot be altered afterwards.

If a data breach occurs that is likely to result in a risk to you, we report it to the supervisory authority and, where required, inform you.

11. Your rights

Under the GDPR and the UK GDPR you have the right to access your data, to have it corrected or deleted, to have its processing restricted, to receive your data in a common format (data portability), and to object to processing based on legitimate interest, including at any time to direct marketing. Where processing is based on consent, you can withdraw your consent at any time, without affecting earlier processing.

Customers can download all data of their account as one file and request deletion of the account in the account settings of the portal. For any other request, contact us at hello@virtualhomestage.com. We respond within one month; if a request is complex, we may extend that by up to two months and tell you why. We may ask you to confirm your identity first.

If your request concerns photos supplied by an estate agent, we forward it to that agent, who decides on it as the controller, and we help them carry it out.

12. Complaints

If you are not satisfied with how we handle your data, please tell us first at hello@virtualhomestage.com. You also have the right to lodge a complaint with a supervisory authority, in particular:

• in the Netherlands: the Autoriteit Persoonsgegevens (Dutch Data Protection Authority), autoriteitpersoonsgegevens.nl;
• in the United Kingdom: the Information Commissioner's Office (ICO), ico.org.uk;
• or the supervisory authority in the EU member state where you live, work or where the alleged infringement took place.

13. Residents of the United States

We do not sell personal information and do not share it for cross-context behavioural advertising. We process the personal information of business contacts only for the purposes in this notice. If a US state privacy law gives you rights to know, correct or delete your personal information, you can exercise them at hello@virtualhomestage.com; we will not discriminate against you for doing so.

14. Cookies

We use only cookies of our own: functional cookies that make the site work, and one cookie (fsid) that counts in total how many visitors go on to order. It is not linked to your account, and you can switch it off on the cookie page. We use no cookies for advertising and no third party places cookies through our site. Our page-view statistics, and Vercel Web Analytics, work without cookies. The cookie statement explains this in full.

15. Changes

We update this notice when our service, our providers or the law change. The version and date are at the top. If a change is significant, we inform customers by email before it takes effect.