Privacy Policy

Astravisualize is an AI property-rendering service operated from Australia. We are the data controller for the personal information described here. Contact for anything in this policy: hello@astravisualize.com.

• Account details.Your email address and, if you sign in with Google, the name and profile picture Google shares with us. The picture is not copied: it is shown from Google’s own servers while you are signed in, and changing it there changes it here. A password, if you set one, is stored hashed by our authentication provider and is never visible to us.
• Photos and plans you upload, and the renders made from them. When you are signed in, both are stored under your account. When you render without an account, the result is returned to your browser and neither the upload nor the render is stored by us. Camera metadata (EXIF, including any GPS location) is stripped from every upload before it is processed.
• Usage records. Which pipeline and model each render used, when, how many credits it cost, and whether it was watermarked. Not the instruction you typed.
• Billing. Your Stripe customer and subscription identifiers, plan and status. Card numbers go directly to Stripe and never touch our servers.
• Abuse-prevention signals. To enforce free-tier limits and rate limits we keep a salted one-way hash of your IP address. The raw address is not stored, and the hash cannot be reversed to it.
• Email you give us on the site, for example when the free allowance is used up and you leave an address to be told when it resets.
• Page analytics, only if you accept it in the cookie banner: page views and referrers through Vercel Web Analytics (no cookie) and PostHog (a random device id in a cookie, and your account id once you sign in, never your name or email). Neither identifies you across other sites, and we record no sessions.

We do not collect precise location, contacts, or anything from your device beyond what a normal web request carries.

• To make your renders and show them back to you.
• To sign you in, keep your account and bill you.
• To enforce free-tier limits, rate limits and our daily spending cap, and to stop abuse.
• To email you about your account: sign-in links, receipts, trial and renewal notices.
• To understand which pages are used, if you accepted analytics. Never to profile you for advertising — we run no ads and sell no data.
• To comply with tax, accounting and other legal obligations.

To make a render, your upload and our instruction are sent to the AI model provider for the model you chose — Google (Gemini image models) for the standard and detail tiers, OpenAI for the premium tier. They process the image to produce the render and return it to us. Both providers state that data sent through their paid APIs is not used to train their models. We do not use your uploads or renders to train anything either.

Renders we deliver carry an embedded note that the image is digitally altered. That is part of the file, not personal information about you.

We share personal information only with the companies that run parts of the service:

• Supabase — sign-in, our database and file storage. Your data lives in its Sydney, Australia region. Uploads and renders sit in a private bucket that is only reachable through short-lived links generated for you.
• Vercel — hosting and, if accepted, page analytics. Requests are served from Vercel’s network, which may include servers in the United States.
• PostHog — product analytics, only if accepted, in the United States.
• Sentry — error reports when something breaks, so we can fix it. Sent without your request body, cookies or address; your account id is the only identifier, and text is scrubbed of emails before it leaves.
• Stripe — payments, invoices and the billing portal. Stripe’s own privacy policy governs what it collects from you at checkout.
• Google — sign-in with Google, and the Gemini models described above.
• OpenAI — the premium image model, only when you choose it.

We do not sell personal information and do not share it with advertisers. We will disclose it if the law requires us to, or to protect the rights or safety of someone else.

Your database records and files are stored in Australia. Providing the service means some data is processed in the United States (Vercel, Stripe, Google, OpenAI). Where you are in the EU, UK or another place with transfer rules, we rely on our providers’ standard contractual clauses and equivalent safeguards for those transfers.

• Renders and uploads under an account: until you delete them or close the account, then removed from storage within 30 days.
• Account and usage records: for the life of the account, then deleted or anonymised within 30 days of closure, except billing records we must keep for tax law (seven years in Australia).
• Abuse-prevention hashes and rate-limit counters: rolling windows of hours to days.
• Email addresses left on the site: until you sign up, ask us to remove them, or 12 months of no contact.

We set only the cookies below. None of them is used for advertising, and nothing tracks you on other sites. The banner you saw on your first visit controls one thing: whether page analytics runs; the analytics cookie below exists only after you accept.

You can change your choice any time with “Cookie settings” in the footer, or by clearing this site’s cookies in your browser. Blocking the sign-in cookies means you cannot stay signed in.

Wherever you are, you can ask us to access, correct, export or delete the personal information we hold about you, and to close your account. Write to hello@astravisualize.com from the address on the account; we act within 30 days and will tell you if we need longer. There is no charge.

• Australia. We handle personal information under the Privacy Act 1988 and the Australian Privacy Principles. If you are unhappy with our response you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).
• EU and UK (GDPR). Our legal bases are performance of our contract with you (making renders, running your account), our legitimate interests (security, abuse prevention, improving the service) and your consent (analytics). You may object to processing based on legitimate interests, withdraw consent at any time, and complain to your local supervisory authority or, in the UK, the ICO.
• California (CCPA/CPRA). You have the right to know, delete and correct, and not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined in the CCPA, so there is nothing to opt out of.

Data moves over TLS. Uploads and renders are stored in a private bucket, reachable only through short-lived signed links generated for the account that owns them. Database access is restricted at the row level. API keys for the AI providers live only on our servers. No system is perfect; if we learn of a breach affecting your data, we will tell you and any regulator we must, without undue delay.

The service is not directed at children and we do not knowingly collect personal information from anyone under 16. If you believe a child has given us data, write to us and we will delete it.

We will post any changes here and update the date at the top. If a change materially affects how we use your data, we will email account holders before it takes effect. The Terms of Service sit beside this policy.