Privacy policy
Last updated: 2026-09-13
1. Who the controller is
The controller of your personal data is Elewacje AI, the service operated at elewacjeai.pl. For anything concerning personal data, write to kontakt@elewacjeai.pl or use the contact form.
2. What we collect
Account data. Sign-in runs through an external identity provider (Microsoft Entra External ID). After you sign in we store your identifier at that provider, your email address, display name, role in the service and the number of visualisations used and available. We never store your password — the identity provider handles authentication.
Photos and visualisations. The photos you upload are stored on our server together with the visualisations generated from them, the change description (prompt) and the materials you selected. A photo of a house or plot can indirectly reveal the location of a property — treat it as data about you.
Payments. Payments are handled by Stripe. We neither receive nor store card or BLIK details. We record the amount, currency, payment status, the operator's transaction identifier and the date.
Contact form. Your name or company name, email address, message, category and the IP address the message was sent from (abuse protection).
Visit statistics. We use Umami on our own server. It sets no tracking cookies and builds no profile of an individual visitor.
3. Why, and on what basis
| Purpose | Legal basis |
|---|---|
| Running your account and providing the service | Art. 6(1)(b) GDPR — performance of a contract |
| Generating visualisations from your photos | Art. 6(1)(b) GDPR — performance of a contract |
| Settling payments and meeting accounting duties | Art. 6(1)(b) and (c) GDPR |
| Replying to a message from the contact form | Art. 6(1)(f) GDPR — legitimate interest |
| Spam and abuse protection (IP, reCAPTCHA) | Art. 6(1)(f) GDPR |
| Visit statistics | Art. 6(1)(f) GDPR |
4. Who processes the data for us
The service runs on external infrastructure and services. We share data only as far as the service requires:
| Recipient | What it receives | Why |
|---|---|---|
| Microsoft (Entra External ID) | Email address, sign-in data | Authentication |
| OpenAI | The uploaded photo and the prompt | Generating the visualisation |
| Replicate | The uploaded photo and the prompt | Alternative generation engine |
| Stripe | Email address, amount, order identifier | Payment processing |
| Google (reCAPTCHA) | IP address, browser technical data | Contact-form protection |
| Resend | The contact-form message | Notifying us of a new message |
| OVH | All data stored on the server | Hosting |
Processing outside the EEA. OpenAI, Replicate, Stripe and Google may process data outside the European Economic Area, under the standard contractual clauses approved by the European Commission.
Your photo goes to the AI provider. A visualisation cannot be produced without sending the photo for processing. If you would rather the photo never left your computer, do not use the service.
5. How long we keep it
- Account, photos and visualisations — until you delete your account.
- Billing records — for the period tax law requires (currently 5 years from the end of the year in which the tax obligation arose).
- Contact-form messages — 12 months after the matter is closed.
6. Your rights
You have the right to access your data, to rectify it, to erase it, to restrict processing, to data portability, and to object to processing based on legitimate interest.
Deleting your account is something you can do yourself, in Account settings in the portal. That removes the account along with your photos and visualisations; billing records are kept for the period the law requires.
You may also lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland).
7. Sharing a visualisation
You can generate a public before/after link for a visualisation. Anyone holding that link sees the photo and the result without signing in. You can turn the link off at any time, and it stops working for everyone.
8. Cookies
We use only what the service needs to work: the sign-in session and your remembered light/dark theme. We run no tracking advertising and share no data with advertising brokers.
9. Changes to this policy
The date of the last update is shown at the top. We will notify signed-in users by email about material changes.