Privacy policy
This policy explains what personal data we process when you use our service that shows a house on your own photo, and why. We keep it short and specific. If a point is unclear, write to us.
1. Who is responsible
Markus Schmidt IT Beratung
Hackstraße 82, 70190 Stuttgart, Germany
Email: bms166@gmx.net
2. Overview: what we process, why, and for how long
| Data | Purpose | Legal basis (GDPR) | Kept for |
|---|---|---|---|
| The photo you upload (after your browser has shrunk it and removed metadata) | Create the image you asked for | Contract, Art. 6(1)(b), and your consent, Art. 6(1)(a) | Not stored by us. It exists only in memory while it is processed and sent to Google (see section 3). |
| The generated image | Show it to you and let you download it | Contract, Art. 6(1)(b) | Deleted automatically after 24 hours, or immediately when you press “Delete now”. |
| Order data: package, amount, order time, payment time, transaction hash, wallet address the payment came from, exchange rate on the day, country derived from your IP address | Match your payment to your order, deliver the credits, accounting and tax, proof of where the customer is located for VAT | Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c) | Paid orders: for the statutory retention period, which is 8 years counted from the end of the calendar year of the payment [confirm with tax adviser]. Orders that still have unused credits are kept as long as the credits exist. Unpaid orders that expire are deleted after 7 days. |
| Payments we cannot match (amount, transaction hash, sending wallet address) | Find your payment when you contact us, and refund it where appropriate | Legitimate interest, Art. 6(1)(f), in resolving payment problems | 12 months after receipt, then deleted automatically. |
| Consent record: time and version of the consent text you accepted | Prove that you consented | Legal obligation to demonstrate consent, Art. 7(1) and Art. 6(1)(c) | As long as the related order data. |
| Access code and credit balance. We store only a one-way hash of the code, not the code itself. | Give you access to your credits | Contract, Art. 6(1)(b) | While you have credits. It is deleted together with the order data above once the credits are used up and the retention period has ended. |
| Connection data such as your IP address and browser information, handled by Cloudflare | Deliver the site, keep it secure, block bots and abuse | Legitimate interest, Art. 6(1)(f) | We do not store IP addresses in our database. Cloudflare keeps its own technical logs for a limited time under its own terms. |
| Emails you send us | Answer you | Contract, Art. 6(1)(b), or legitimate interest, Art. 6(1)(f) | Deleted 12 months after the matter is closed, unless tax or commercial law requires us to keep them longer. |
| Data in your own browser: your access code and an open payment request | So you do not lose your credits when you reload the page | Strictly necessary for the service you requested, section 25(2) no. 2 TDDDG | Until you clear your browser data. A payment request is removed when it expires. |
3. Your photo and AI processing
When you create an image, this happens:
- Your browser shrinks the photo and saves it again as a JPEG. This removes location data (GPS) and other hidden metadata before anything leaves your device.
- The photo is sent to our server and passed on to Google’s Gemini service, which creates the image. Together with the photo we pass on a simple placement sketch (coloured boxes showing where a building should stand) and the building dimensions and image settings you chose. We keep the original photo in memory only for this purpose and do not write it to any storage.
- The generated image is stored for up to 24 hours so that you can view and download it. You can delete it at any time.
Please do not upload photos that show identifiable people, license plates, or other personal data of third parties. If a photo does show such data, you are responsible for having the right to use it.
Google acts as our processor for this step [verify before publishing: use the paid Gemini API or Vertex AI with a data processing agreement, and confirm in Google’s current terms whether prompts and images are retained for abuse monitoring and for how long, and that they are not used to train models. Then state the result here in one sentence.]
No decision that has legal or similarly significant effects on you is made by automated means. The generated image is an illustration only.
4. Payments and the blockchain
You pay in USDC on the Base network, sent directly from your wallet to our wallet. We do not run your wallet, we never have access to your private keys, and we do not ask for your name to accept a payment.
Blockchain transactions are public and permanent. Your wallet address, the amount and the time of your payment are visible to anyone on the blockchain. We cannot change or delete them, and this is outside our control. To read new payments, we use a blockchain data provider ([name of your RPC provider]). It sees our wallet address and the public payments made to it.
We do not carry out identity checks on customers. We can link a payment to you only through the order you created and, if you contact us, through the transaction hash you tell us.
5. Who receives data
- Cloudflare, Inc. hosts the website and the service (servers, database, file storage in the EU, and the Turnstile bot check). Requests are handled at the Cloudflare location closest to you, which can be outside the EU.
- Google (Gemini) creates the image from your photo.
- PayPal (Europe) S.à r.l. et Cie, S.C.A., if you choose to pay by PayPal instead of USDC. PayPal processes the payment on its own responsibility and under its own privacy policy; we receive only your order status and, if given, the payer name PayPal reports for the order.
- [RPC provider] provides blockchain data, as described above.
- [Email provider] handles email you send to us.
- Tax adviser, authorities and courts where the law requires or where we need to establish or defend legal claims.
We do not sell your personal data and we do not use it for advertising or profiling. We do not use analytics or advertising cookies.
6. Transfers outside the EU
Cloudflare and Google are based in the United States. Where data is transferred there, we rely on [confirm for each provider: EU-US Data Privacy Framework certification and/or Standard Contractual Clauses]. You can ask us for a copy of the safeguards.
7. Security and bot protection
We use Cloudflare Turnstile before you can place an order. Turnstile checks that you are not an automated program and may read information from your browser for this purpose. It is used only for security, not for advertising. Generated images are stored in EU storage, connections are encrypted, and the private key of our wallet is never stored on the web server.
8. Your rights
Under the GDPR you have the right to:
- access the data we hold about you,
- correct inaccurate data,
- have data erased, where the law allows (we cannot erase data on the public blockchain, and we must keep order data for the statutory period),
- restrict processing,
- receive your data in a common format,
- object to processing that is based on our legitimate interest,
- withdraw your consent at any time, with effect for the future. This does not affect processing that took place before. You can delete your generated image yourself at any time in the service.
To use these rights, write to bms166@gmx.net. Please include your transaction hash so that we can find your order, since we do not know who you are otherwise. We may ask you to show that the payment came from your wallet.
You also have the right to complain to a data protection authority, for example the one where you live or the one responsible for us: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Königstraße 10a, 70173 Stuttgart, Germany.
If you live outside the EU (for example in the United Kingdom, Brazil or California), you may have similar rights under local law. Write to us and we will handle your request in the same way.
9. Children
The service is meant for adults. Please do not use it if you are under 18.
10. Changes
If we change how we process data, we will update this page and its version number. The version of the consent text you accepted is stored with your order.
11. Spokes Dojo (wheel preview)
[Lawyer: please review this section before publication.]
If you use the wheel preview Spokes Dojo instead of the house tool, the following applies in addition to the sections above:
- In your browser: the photo, your wheel markings and the preview stay on your device. Nothing is sent until you press “Realistisch rendern”.
- When you render: your browser shrinks the vehicle photo and removes metadata. The server receives the photo, a preview image made in your browser, an image of the wheel design and a short list of settings (wheel positions, rim and tyre sizes, finish, caliper colour). We pass these on to Google’s Gemini service to create the image. They are kept in memory only and not written to storage. Purpose, legal basis, processor and transfers are as described in sections 2, 3, 5 and 6.
- The result is stored for up to 24 hours and can be deleted at any time.
- Own wheel image: if you load a wheel image or let the AI prepare it, that image is processed in the same way. Use only images you may use.
- Please do not upload photos that show identifiable people or readable license plates.