Privacy policy
Privacy policy
What we process, why, for how long, and what leaves Europe.
Last updated: 16 October 2026.
The essentials
- Your photographs are used to produce your edits and nothing else. They are never used to train a model.
- They are stored in the European Union, in a private space with no public address.
- The engine that edits them is operated by OpenAI, in the United States: for the time of the processing, the image leaves Europe. That is the only transfer, it is covered by safeguards, and it is explained below.
- No advertising in the product, no advertising trackers on the site, no resale of data. The public site sets no cookie, and counts its visits with a tool that sets none either.
- If you arrive through one of our Google ads, we tell Google only if you tick the box offered when you sign up: to measure the ad, never to target you.
- You delete your account from the settings, without writing to anyone.
Who is responsible
The service is published by Teddy Verneuil, entrepreneur individuel, 14 bis rue Magellan, 56860 Séné, France, SIRET 792 687 576 00043. As such, they are the controller of your personal data under the UK GDPR and the EU GDPR. Contact: contact@maiso.app.
When you upload a photograph of a property, you remain responsible on your side: you decide to process it, and you publish it.
What we process
| Data | Why | Legal basis |
|---|---|---|
| Email address, name, encrypted password | Create the account, log you in, write to you | Performance of a contract |
| Agency name, colleagues, roles | Share folders, split access rights | Performance of a contract |
| Photographs uploaded and images produced | Provide the service you ask for | Performance of a contract |
| Folders, property names, addresses you type | Keep your photographs in order | Performance of a contract |
| Edit log: tool used, cost in credits, date, result | Count credits, invoice, show you the history | Performance of a contract |
| Plan, payments, invoices | Keep accounts and meet tax law | Legal obligation |
| IP address, browser type, technical errors | Run the service and fix what breaks | Legitimate interests |
| Campaign and landing page, when you come from one of our ads | Know which ads bring customers | Legitimate interests |
| Identifier of the click on a Google ad, dates of your sign-up, first render and first payment, with its amount | Tell Google that the ad worked | Consent (box at sign-up) |
We do not ask for any sensitive data and ask you not to upload any. A photograph of a property can still show a person or a number plate, which is why you agree to upload only images you have the right to process.
Artificial intelligence processing, and what leaves Europe
To produce an edit, the photograph and the matching instruction are sent to the OpenAI application programming interface, which operates the image model. Today that call is made on OpenAI’s global infrastructure, located in the United States.
What that means, put simply: for the few seconds of the processing, your photograph leaves the European Union. It comes back as the image produced, which is stored in Europe like the original.
- OpenAI does not use the data sent through its programming interface to train its models. That is its contractual policy for business customers, and it is what we commit to towards you.
- The transfer is covered by the standard contractual clauses of the European Commission, together with the addendum issued by the UK Information Commissioner’s Office for data from the United Kingdom.
- No other processing sends your photographs outside Europe.
We would rather write this plainly than hide behind “your photos stay in Europe”: the storage is European, the computing is not yet. Moving that computing to Europe is on the roadmap.
Who else receives something
| Service | What it receives | Where |
|---|---|---|
| Supabase Inc. | Account, agency, folders, edit log | European Union (Frankfurt) |
| Cloudflare, Inc. | Stored photographs, traffic of the site and the app | Storage in the European Union jurisdiction |
| OpenAI | Photograph and instruction, for the time of the processing | United States |
| Stripe Payments Europe Ltd | Email address, amount, payment method | Ireland |
| Resend | Email address and content of transactional messages | United States |
| Sentry | Technical errors, IP address, page concerned | European Union |
| Google Ireland Limited | If you agreed: the identifier of the click on our ad, and the date of your sign-up, first render and first payment, with its amount | Ireland, with possible transfers outside Europe |
None of these services resells your data. All of them process it on our behalf, except Google, which receives the measurement of its ads as the controller of its own processing, under its advertising terms. We never send it your name or your email address. We have no data broker and no advertising profiling tool.
How long we keep it
- Your account and your data: for as long as the account exists. Deleting it from the settings erases your personal data immediately.
- A photograph put in the bin: thirty days, then erased for good.
- An interrupted upload left unfinished: twenty-four hours.
- Your photographs after a subscription ends: thirty days, so that you can export them.
- Invoices and accounting records: ten years, because French tax law requires it.
- Technical logs and errors: ninety days at most.
- The identifier of a click on a Google ad: one hundred days after sign-up.
Cookies
The public site sets no cookie. It measures its audience with Cloudflare Web Analytics, a tool that uses neither cookies nor local storage in your browser, and that does not identify visitors by IP address or browser: it counts page views and measures how fast pages load. That is why it asks you nothing when you arrive.
The app sets one session cookie, strictly necessary to keep you logged in. It has no advertising purpose and so does not require consent.
Our Google ads
We advertise Maiso in Google search results. When you click one of these ads, Google adds a click identifier to the page address. The site reads it only to copy it into the “Create an account” link: nothing is stored in your browser, no cookie and no local storage, and the site loads no Google tag.
At sign-up, an unticked box asks whether you agree that we tell Google your sign-up came from an ad. If you tick it, we send Google the click identifier and the date of three steps: email address confirmed, first render, first payment with its amount excluding VAT. This measures the ad; it is never used to target you or follow you elsewhere. If you leave it unticked, the identifier is forgotten and Google learns nothing.
The click identifier is erased one hundred days after sign-up. You can withdraw your consent at any time by writing to contact@maiso.app: we erase it straight away. What has already been sent to Google then falls under Google’s own retention rules.
Your rights
You have the right of access, rectification, erasure, restriction, objection and portability.
- Erasure: account settings, “delete my account”. Immediate, with no need to ask twice.
- Portability: the export of your photographs in full resolution, from the app.
- Anything else: write to contact@maiso.app. We answer within one month.
You can also complain to the regulator. We are based in France, so our lead authority is the Commission nationale de l’informatique et des libertés (cnil.fr). If you are in the United Kingdom, you can complain to the Information Commissioner’s Office (ico.org.uk).
Security
Everything that travels is encrypted in transit. Photographs sit in a private space with no public address and no shareable link; every access goes through a signed address that is valid for a few minutes.
The database applies isolation by agency at the level of the database itself, not only in the app: a query that tried to leave its agency returns nothing. A security review was carried out on 19 September 2026.
No security is absolute. In the event of a data breach that puts your rights at risk, you would be told within the time limits the law sets.
Children
The service is aimed at professionals and is not meant for children. We do not knowingly collect their data.
Changes
This policy changes with the product. The update date at the top of the page is the reference, and any significant change is announced in the app.