Archvisio
ENDE
Request access

Privacy Policy

Last updated: October 2026 - Applicable law: GDPR, Austrian DSG

1. Controller

The controller responsible for data processing on this platform is:

Florian Stangl
Handel-Mazzetti Strasse 13, 4690 Schwanenstadt, Austria
legal@archvisio.ai

2. Data We Collect

Account data
When you register, we collect your email address and, optionally, your name and profile photo. If you choose "Continue with Google" to sign in, Google passes your email address, name and profile photo to us; Google handles the sign-in itself under its own privacy policy. Lawful basis: performance of a contract (Art. 6(1)(b) GDPR).

Project and workspace data
Files you upload (floor plans, reference images, site photos), prompts, render outputs, and project settings are stored to deliver the service. Lawful basis: performance of a contract (Art. 6(1)(b) GDPR).

Billing data
Payment is processed by Polar.sh. We receive only a transaction confirmation and your billing email. We do not store credit card details. Lawful basis: performance of a contract and legal obligation (Art. 6(1)(b)(c) GDPR).

Usage data
We store logs of AI generation requests (model used, credit cost, timestamp) for billing accuracy and abuse prevention. Lawful basis: legitimate interest (Art. 6(1)(f) GDPR).

Cookies and session data
We only use strictly necessary cookies: to keep you signed in, to remember your language, to keep a password-protected presentation unlocked after you have entered its password, and to keep our password-protected pricing and feature preview pages unlocked for 30 days (pricing_unlocked, pricing_unlocked_de, features_unlocked). No tracking or advertising cookies are used.

Analytics
To understand how Archvisio is used and to improve it, we measure page visits and product usage with Usermaven and PostHog. Both run without cookies or other stored identifiers. Usermaven recognises repeat visits by a hash of your browser's user agent and IP address and shortens the IP addresses of visitors from the EU; PostHog treats every page view as anonymous. When you are signed in, usage events are linked to your account email. Usermaven may briefly keep events that could not be sent yet in your browser's local storage; this contains no identifier. Lawful basis: legitimate interest (Art. 6(1)(f) GDPR). You can object at any time by emailing legal@archvisio.ai.

Abuse protection (rate limiting)
To protect sign-up and invitation forms, documentation search, presentation passwords and render requests from abuse, we keep short-lived request counters in a Redis store. Each entry is keyed by your IP address or account ID (for waitlist sign-ups additionally by a hash of the email address, never the address itself), contains nothing else, and expires automatically within two hours at most. Lawful basis: legitimate interest in keeping the service secure (Art. 6(1)(f) GDPR).

Browser notifications (optional)
If you switch on browser notifications in your account settings, we store the subscription your browser creates (the address of its push service and encryption keys) and send short messages, such as "Render complete", through your browser's push service. Lawful basis: consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by switching notifications off in your account settings or browser; we then delete the subscription. It is also deleted when your account is erased.

3. Third-Party Processors

We share data with the following processors under data processing agreements:

  • Contabo GmbH (Germany, EU; server located in France) -- VPS hosting, all application data and self-hosted database
  • Cloudflare, Inc. (EU region, R2) -- File storage for uploaded images and generated renders
  • fal.ai (United States, EU data residency) -- AI model inference for image and video generation. SCCs apply.
  • Black Forest Labs (BFL) (European Union) -- AI image generation (Flux models), EU infrastructure
  • Anthropic, PBC (United States) -- AI language model processing (Claude). SCCs apply.
  • Brevo (Sendinblue SAS) (France, EU) -- Transactional emails, contact list and waitlist management
  • Polar.sh (United States) -- Subscription billing and payment processing. SCCs apply.
  • Freepik Company S.L. (Spain, EU) -- AI image upscaling (Magnific). Renders transmitted for processing.
  • Google LLC (United States / EU) -- Sign-in with Google (optional) and Maps and location services (optional). SCCs apply.
  • Usermaven Inc. (United States; data hosted in the EU) -- Cookieless website and product analytics. SCCs apply.
  • PostHog Inc. (United States; EU Cloud, Frankfurt) -- Cookieless product analytics. SCCs apply.
  • Browser push services (Google, Mozilla, Apple or Microsoft, depending on your browser) -- Delivery of optional browser notifications; the message contains only a title and a short text. SCCs apply where data leaves the EU.

SCCs = Standard Contractual Clauses (EU adequacy mechanism for transfers to third countries).

4. Data Retention

Account data is retained for as long as your account is active.

Deleting your account
You can delete your account at any time in your account settings. Your account and every workspace in which you are the only member — including all projects, uploads and generated files — are hidden immediately and permanently erased after 60 days. Within those 60 days you can ask us to restore your account by writing to hello@archvisio.ai. If you want your data erased sooner, tell us and we will erase it right away.

Projects you created in a workspace owned by someone else stay with that workspace and are transferred to its owner.

Unused free workspaces
A free workspace that has never been used is removed 180 days after it was created. We email you at least 14 days beforehand; creating a render or upgrading keeps it.

Billing records
Billing records are retained for 7 years as required by Austrian tax law (BAO).

5. Your Rights

Under GDPR and the Austrian DSG you have the right to:

  • Access -- request a copy of your personal data
  • Rectification -- correct inaccurate data
  • Erasure -- request deletion of your data (right to be forgotten)
  • Portability -- receive your data in a machine-readable format
  • Objection -- object to processing based on legitimate interest
  • Restriction -- request that processing be limited
  • Withdrawal of consent -- where processing is based on consent

To exercise any of these rights, email legal@archvisio.ai. We respond within 30 days.

You also have the right to lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehoerde): dsb.gv.at.

6. Security

All data is transmitted over TLS/HTTPS. Passwords are never stored in plain text -- our authentication system keeps only salted hashes, and sessions use secure tokens. Access to data is restricted to authorised personnel only.

7. Children

Archvisio is not directed at children under 16. We do not knowingly collect data from minors.

8. Changes to this Policy

We may update this policy. Material changes will be communicated by email or in-app notice. Continued use after notice constitutes acceptance.

9. Contact

For all privacy-related inquiries: legal@archvisio.ai