AIX

Privacy Policy

for the use of the AIXpose.art platform

Effective Date: October 1, 2025

1 Controller and Contact

The controller for data processing is:

SmashForward OÜ Sepapaja 6, 15551 Tallinn, Estonia VAT ID: EE102028980 Email: legal@aixpose.art

Correspondence Address Germany Heidestraße 34, 10557 Berlin, Germany

You can contact us at any time with questions about data protection.

2 Scope

This Privacy Policy applies to the use of the AIXpose.art platform as well as all associated functions, interfaces, website areas, and support services.

The platform is exclusively intended for businesses within the meaning of the German Civil Code. The platform is designed for object-related real estate content without personal reference.

3 Principles of Data Processing

We process personal data according to the principles of the GDPR:

  1. Lawfulness, processing in good faith, transparency
  2. Purpose limitation
  3. Data minimization
  4. Accuracy
  5. Storage limitation
  6. Integrity and confidentiality
  7. Accountability

We process personal data on the basis of the following legal bases:

  1. Contract Performance (Art. 6 para. 1 lit. b GDPR): To provide the platform, process payments, manage accounts and subscriptions
  2. Legitimate Interests (Art. 6 para. 1 lit. f GDPR): To improve the platform, ensure stability, prevent fraud, marketing (as far as permitted)
  3. Legal Obligation (Art. 6 para. 1 lit. c GDPR): To fulfill legal retention obligations
  4. Consent (Art. 6 para. 1 lit. a GDPR): To the extent you have given us consent

5 Types of Data Collected and Processing Purposes

5.1 Account Data

We collect and process the following account data:

  • Company name, name of account holder
  • Email address
  • Billing address
  • Phone number (optional)
  • Password (stored encrypted)

Purpose: Account creation, authentication, communication, contract performance

Legal Basis: Art. 6 para. 1 lit. b GDPR (Contract Performance)

5.2 Payment Data

Payments are processed via Stripe. We do not receive complete credit card data.

Data Collected:

  • Billing address
  • Payment method (credit card, SEPA direct debit)
  • Transaction data (via Stripe)

Purpose: Payment processing, invoicing

Legal Basis: Art. 6 para. 1 lit. b GDPR (Contract Performance)

Note: Stripe may act as controller or processor depending on the role. Further information: stripe.com

5.3 Upload Content (Input)

You can upload real estate photos, floor plans, texts, and property information.

Important Note: The platform is intended for object-related real estate content without personal reference. You undertake not to upload personal data in images, in particular no recognizable persons, no children, no faces, no identification documents. Details see Terms Section 8.

Purpose: Generation of visualizations and outputs

Legal Basis: Art. 6 para. 1 lit. b GDPR (Contract Performance)

Storage Duration: As long as the account is active and after contract end according to Terms Section 15

5.4 Usage Data

We record information about the use of the platform:

  • Generated outputs
  • Functions used
  • Credit consumption
  • Timestamps of actions
  • IP address (on login and important actions)

Purpose: Provision of service, billing, improvement of platform, security

Legal Basis: Art. 6 para. 1 lit. b and f GDPR

5.5 Technical Data

We record technical information:

  • Browser type and version
  • Operating system
  • Device information
  • Referrer URL
  • Access time

Purpose: Ensuring functionality, security, troubleshooting

Legal Basis: Art. 6 para. 1 lit. f GDPR (Legitimate Interest)

5.6 Communication Data

When you contact us (email, support):

  • Name, email address
  • Message content
  • Time of communication

Purpose: Processing your inquiries, support

Legal Basis: Art. 6 para. 1 lit. b and f GDPR

6 Cookies and Tracking Technologies

We use cookies and similar technologies:

6.1 Necessary Cookies

These are required for the basic functions of the platform:

  • Session cookies (authentication)
  • Security cookies
  • Function cookies

Legal Basis: Art. 6 para. 1 lit. b GDPR (Contract Performance)

6.2 Analytics Cookies (Optional)

We may use analytics tools to understand and improve usage. These are only set with your consent.

Legal Basis: Art. 6 para. 1 lit. a GDPR (Consent)

You can manage cookies in your browser settings. Note that disabling cookies may impair the functionality of the platform.

7 Data Disclosure to Third Parties

7.1 Processors

We use the following service providers as processors:

  • Stripe: Payment processing (stripe.com)
  • Cloud hosting providers: Storage and processing of data
  • Email service providers: Sending emails
  • Support tools: Customer support

These service providers process data only within the scope of our instructions and are contractually obligated to comply with the GDPR.

7.2 Disclosure to Third Parties

We do not disclose your data to third parties, except:

  • If you have expressly authorized us to do so
  • If this is necessary for contract performance (e.g., payment processing)
  • If we are legally obligated to do so (e.g., official requests)
  • To enforce our rights

We do not sell your personal data to third parties.

8 International Data Transfers

Your data may be transferred to countries outside the European Economic Area (EEA), in particular:

  • Estonia (seat of SmashForward OÜ)
  • USA (when using Stripe and cloud services)

We ensure that adequate guarantees are in place:

  • Standard contractual clauses of the EU Commission
  • Adequacy decisions of the EU Commission
  • Other appropriate guarantees according to Art. 46 GDPR

9 Data Security

We implement technical and organizational measures to protect your data:

  • Encryption of data transmission (TLS/SSL)
  • Encrypted storage of sensitive data
  • Regular security reviews
  • Access controls and authentication
  • Regular backups

Despite all measures, absolute security cannot be guaranteed. We recommend that you use secure passwords and treat them confidentially.

10 Storage Duration

We store personal data only as long as necessary:

  • Account data: For the duration of the contract and thereafter according to legal retention obligations (usually 10 years for business correspondence)
  • Payment data: According to legal retention obligations (usually 10 years)
  • Upload content: As long as the account is active. After contract end, content may be deleted after reasonable periods, provided no legal retention obligations oppose (see Terms Section 15)
  • Usage data: For the duration of the contract and thereafter maximum 2 years for analysis purposes
  • Communication data: 3 years after last contact

After expiration of storage periods, data is deleted or anonymized.

11 Your Rights

You have the following rights regarding your personal data:

11.1 Right of Access (Art. 15 GDPR)

You have the right to obtain information about the personal data we process.

11.2 Right to Rectification (Art. 16 GDPR)

You can request the rectification of incorrect or the completion of incomplete data.

11.3 Right to Erasure (Art. 17 GDPR)

You can request the deletion of your data, provided no legal retention obligations oppose.

11.4 Right to Restriction of Processing (Art. 18 GDPR)

You can request the restriction of processing of your data.

11.5 Right to Data Portability (Art. 20 GDPR)

You can request the transfer of your data in a structured, commonly used, and machine-readable format.

11.6 Right to Object (Art. 21 GDPR)

You can object to the processing of your data for reasons arising from your particular situation, to the extent that processing is based on Art. 6 para. 1 lit. f GDPR (legitimate interest).

You can withdraw given consents at any time. The lawfulness of processing until withdrawal remains unaffected.

11.8 Right to Complain

You have the right to complain to a supervisory authority, in particular in the member state of your residence, your workplace, or the place of the alleged violation.

Contact for Exercising Your Rights:

Email: legal@aixpose.art

We will respond to your request within one month.

12 Special Notes

12.1 No Processing of Person Representations

The platform is designed for object-related real estate content without personal reference. You undertake not to upload personal data in images. Details see Terms Section 8.

12.2 Data Processing Agreement

If you need an agreement on data processing in individual cases, we can provide such an agreement upon request.

12.3 Minors

The platform is exclusively intended for businesses. We do not process data of minors.

13 Changes to this Privacy Policy

We may adjust this Privacy Policy if this is necessary for legal, technical, or economic reasons.

We will inform you of changes in text form (e.g., by email). Material changes will be communicated in advance before they take effect.

The current version is always available on our website.

14 Contact

You can contact us at any time with questions about data protection:

SmashForward OÜ
Sepapaja 6
15551 Tallinn, Estonia
Email: legal@aixpose.art

Correspondence Address Germany
Heidestraße 34
10557 Berlin, Germany