1. Controller and contact
Vistune Studio, the supplier identified at checkout and on your Whop receipt, controls personal data used to operate this service. Privacy requests can be submitted through the support form with “Privacy request” as the subject.
2. Data we process
- Account data: email address, password hash, verification status and session records.
- Order data: service, quantity, price, status, instructions, revision requests and timestamps.
- Content: source images, floor plans and finished files. These may incidentally contain people, addresses or other personal data.
- Payment metadata: Whop checkout, payment and status identifiers. Vistune does not receive or store full card details.
- Support and security data: messages, email delivery status, current and previous IP addresses, IP-derived country, sign-in outcomes, browser, operating system, device type and administrative support actions.
- Analytics data, if you consent: pages visited, approximate country, device and browser information, referring source, campaign parameters and interactions with the site.
3. Why and on what basis
- To create and secure accounts and perform orders: necessary to enter into and perform the contract.
- To process payments and maintain transaction records: contract and legal obligations.
- To prevent fraud, protect the service, diagnose failures and enforce terms: legitimate interests in operating a secure service.
- To answer privacy requests and comply with tax, accounting, sanctions or law-enforcement duties: legal obligations.
- To measure site use through Google Analytics: your consent, which you can withdraw at any time.
We do not use uploaded files to train public AI models or for public portfolio use without permission. We do not sell personal data or send marketing emails under this policy.
4. Client-supplied personal data
If you upload files containing personal data about another person, you are responsible for having a lawful basis and giving any notice required to provide that data to Vistune for processing. Vistune processes that content only to fulfil the order, provide support, secure the service and comply with law.
5. Service providers and transfers
We disclose only the data needed to trusted providers supporting the service, including Whop for payments, Google Analytics when you consent, a limited IP-country lookup provider used for account security and regional statistics, the transactional email provider, infrastructure and storage providers, and professional advisers where necessary. Google explains how it uses information from sites that use its services on its partner sites page. These providers may process data outside your country. Where required, transfers rely on an adequacy decision, standard contractual clauses or another lawful safeguard.
6. Retention
Verification codes are short-lived and user sessions expire after 30 days. Detailed sign-in, IP and device history is normally retained for up to 180 days for security and support; aggregated statistics may be retained longer without being used to identify an individual. Files uploaded for an order that is not paid may be removed from the live service after 48 hours. Source and finished files for paid orders are normally retained for up to 90 days after order completion or package expiry so you can download files and resolve support issues, then scheduled for deletion. Daily operational backups are retained for up to 90 days; data removed from the live service may remain in a restricted backup until that backup expires and is used only for recovery, security and legal purposes. Account data is kept while the account is active and may be retained for up to 24 months after inactivity unless deletion is requested. Transaction and legally required records may be kept for up to 7 years or the applicable statutory period. Support records are normally kept for no more than 24 months. Data may be retained longer where reasonably necessary for a legal claim, fraud investigation or legal obligation.
7. Security
We use access controls, hashed passwords, expiring verification codes, secure cookies, encrypted transport, file-type checks, rate limits, restricted administrative access and backups. No online system is risk-free; please use a unique password and contact us if you suspect unauthorised access.
8. Cookies and analytics
Vistune uses essential technology, including a secure session cookie needed to keep you signed in. Security logs record IP and device information whether or not optional measurement is accepted because they protect accounts and support fraud prevention. Essential technology cannot be disabled without preventing account features from working.
Google Analytics and Vistune's first-party site analytics are optional and do not load unless you select “Accept.” If accepted, they use identifiers to measure site use, acquisition and purchases. We do not send your uploaded files or payment card details to Google Analytics. Selecting “Decline” does not affect the service. You can withdraw or reconsider your choice at any time.
9. Your rights
Depending on your location, you may have rights to access, correct, delete, restrict or object to processing, receive a portable copy, and complain to your local data-protection authority. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. We may need to verify your identity and may retain data that law requires us to keep.
10. Children and automated decisions
The service is not directed to children and is not intended for anyone unable to enter into the relevant contract. Vistune does not make decisions producing legal or similarly significant effects solely by automated means.
11. Changes
We may update this policy when our service or legal duties change. Material changes will be presented through the site or account before they apply where required.