Privacy Policy

Netvista Media S.L. is the controller of personal data processed through the Service.

• CIF: B54981352
• Registered office: Av. Sant Rafel 23, 03580 l'Alfàs del Pi, Comunidad Valenciana, Spain
• Email: hello@immovideo.es
• Phone: +34 628 662 912

We process the following categories of personal data:

Account data

• Name and email address
• Password (stored as a hash, never in clear)
• Last login timestamp; session metadata (IP, user-agent)

Organisation data

• Legal name, tax ID (CIF for Spain, EU VAT number for other EU member states), registered address, country
• Logo image
• Billing email

Order and billing data

• Stripe Customer ID and saved-card metadata (brand, last-4 digits — full card numbers never touch our servers)
• Invoice records (number, dates, amounts, VAT split)

Customer Content

• Photographs of properties you upload, including any personal data incidentally captured (e.g. items on display, neighbours visible through windows)
• Property briefs, voice-over scripts, and other text you provide
• Logo images you upload

Operational logs

• Server access logs, application logs, error reports, CDN logs (IP address, request URL, response status, timestamps)
• Cron and worker job records (which renders ran, which failed, which costs were incurred)

We rely on the following legal bases under Article 6 GDPR:

• Performance of a contract (Art. 6(1)(b)) for account data, organisation data, order and billing data, Customer Content, and operational logs needed to deliver the Service.
• Legal obligation (Art. 6(1)(c)) for invoice retention under Real Decreto 596/2016 (4 years) and tax-related record-keeping.
• Legitimate interest (Art. 6(1)(f)) for security monitoring, fraud prevention, abuse detection, and the operational logs strictly necessary for those purposes.
• Consent (Art. 6(1)(a)) where required and obtained, for example for non-essential cookies (we currently do not set non-essential cookies — see Section 8).

We use the following sub-processors. Each is bound by a data-processing agreement and, where data leaves the EU, by Standard Contractual Clauses (Commission Implementing Decision 2021/914) or another GDPR-compliant transfer mechanism.

When you upload Customer Content and place an order, photo URLs and the property brief are transmitted to Replicate (and through Replicate to xAI and Google) and to Moonshot AI for the duration of the render. We do not retain personal data on those providers' servers beyond what is necessary for that processing.

Retention periods locked by our system policy:

• Uploaded photographs (originals + cleaned versions): 7 days after delivery if you flag the video positive, 14 days if you flag it negative, 30 days from creation if no feedback is given. Whichever is shortest applies.
• Generated videos and per-photo clips: up to 24 months from delivery. We email you a 30-day warning before deletion so you can download a copy.
• Account data: for as long as your account is active; anonymised on account deletion.
• Invoice records: 4 years from issue, as required by Spanish tax law (Real Decreto 596/2016).
• Operational logs: typically 30–90 days, longer when needed for security investigations.

Under the GDPR you have the right to:

• Access the personal data we hold about you (Art. 15)
• Have inaccurate data corrected (Art. 16)
• Have data erased (Art. 17), subject to our legal retention obligations
• Restrict processing (Art. 18)
• Receive your data in a portable format (Art. 20)
• Object to certain processing (Art. 21)
• Withdraw consent at any time without affecting prior processing (Art. 7(3))
• Lodge a complaint with the Spanish Data Protection Authority (Agencia Española de Protección de Datos — AEPD) at aepd.es

Exercise your rights by emailing hello@immovideo.es or via the self-serve account-deletion control at /app/settings. We respond within thirty (30) days.

When you upload photographs of a property, those photographs may incidentally capture personal data about third parties (for example, neighbours visible through windows, items on display, or photographs of children in the home). For that incidental personal data:

• You are the data controller of the photographs you upload. You decide what to upload and for what purpose.
• Netvista is the data processor processing on your behalf and instructions to deliver the Service.
• You warrant in our Terms & Conditions that you have obtained any consents required from depicted persons or their parents/guardians.

We use only strictly necessary cookies (session, CSRF protection, language preference). We do not currently use analytics, advertising, or other non-essential cookies, so no cookie consent banner is required under Article 22 LSSI-CE / Article 5(3) ePrivacy Directive. If we add non-essential cookies in the future we will request your prior informed consent.

We implement technical and organisational measures appropriate to the risks of the processing, including TLS for all transport, encryption-at-rest for object storage, access controls, hardened infrastructure, regular backups, isolation of customer data on shared infrastructure, and principle-of-least-privilege for staff access.

No system is perfectly secure. If we become aware of a personal-data breach affecting your data we will notify the AEPD within 72 hours and, where the risk to you is high, notify you directly without undue delay.

The Service is not directed at children under sixteen (16). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

Some of our sub-processors are based outside the European Economic Area (EEA). For these transfers we rely on European Commission adequacy decisions where available (e.g. UK), Standard Contractual Clauses, or — for Moonshot AI in China — Article 49(1)(b) GDPR (transfer necessary for the performance of the contract you have asked us to perform). For the Moonshot transfer we have assessed that the data transferred is limited to the photo URLs and property briefs you submit, that the transfer is necessary for the AI generation you have ordered, and that suitable supplementary measures (DPA, purpose-limited use, deletion windows on the provider side) are in place. You can object at any time by deleting your account or by emailing us.

We may update this Policy from time to time. The current version is always available at immovideo.es/legal/privacy. Material changes will be notified by email at least thirty (30) days before they take effect.

Privacy questions can be sent to hello@immovideo.es. We aim to respond within seven (7) days.