Privacy Policy

Home Photo AI ("we", "us", "our") provides AI-powered photo enhancement, virtual staging, and empty-room tools for real estate listing photos at homephotoai.com. This Privacy Policy explains what information we collect, why we collect it, how we store and protect it, who we share it with, how long we keep it, and how you can access, correct, or delete your data.

By using Home Photo AI you agree to the practices described here. If you do not agree, please stop using the service and contact us so we can delete any information we hold about you.

1.1 Uploaded property photos

When you use the editor, the batch editor, or any enhancement tool, you upload photos of interior or exterior real estate. We receive the image file, the enhancement mode you selected (Basic Enhance, Empty Room, or AI Staging), any optional custom instructions, and technical metadata such as file size and format. We do not intentionally collect EXIF location data — where present in the source file, it is not surfaced or shared, and it is discarded when the enhanced image is re-encoded.

1.2 Account information

When you register we collect your email address and a hashed password. If you choose to add a display name, brokerage, or profile photo those are stored too. We record your subscription plan, credit balance, edit counts, and the timestamps of your account creation, verification, and last sign-in.

1.3 Payment information

All payments are processed by Stripe, Inc. Home Photo AI never sees or stores your card number, CVC, or bank details — those go directly to Stripe's PCI-DSS certified vault. What we do store from Stripe is: your customer ID, subscription ID, plan / lookup key, the last four digits of the card (as returned by Stripe), the country and postal code Stripe returns for fraud signals, and the status and history of your invoices. Stripe's own privacy practices are described at stripe.com/privacy.

1.4 Website analytics & technical data

We collect anonymized analytics about how the service is used: page views, feature usage (which mode was selected, whether an enhancement succeeded or failed), browser type and version, operating system, screen size, referral source, and a coarse geographic region derived from your IP address. We use this data in aggregate to improve reliability, fix bugs, and prioritize new features. We also write functional cookies (session, auth, PWA install prompt state) — these are essential for the service to work and are not sold.

1.5 Instagram & Facebook data (Meta API)

If you connect an Instagram or Facebook account through the Meta API — for example to publish a finished listing photo directly to your feed — we request the minimum scopes needed for that action. Typically this includes your public profile (name, profile picture, account ID), a list of the pages or business accounts you manage, and permission to publish media on your behalf. We store the OAuth access token securely and only use it to perform the actions you explicitly initiate. We do not read your DMs, do not post without your action, and do not sell or share this data with third parties. You can disconnect at any time from your account settings or from accounts.meta.com/apps, which revokes our access immediately.

1.6 Support communications

If you email us at homephotoai@gmail.com we retain the message and our reply so we can provide continuity of support.

• To generate the enhanced photo you requested (photos are sent to our AI providers, described below).
• To create and maintain your account, authenticate sign-ins, and enforce plan limits.
• To process payments, issue refunds, and prevent fraud (Stripe handles the card data itself).
• To email you transactional messages (verification, password reset, receipts, plan changes).
• To publish content to Instagram or Facebook when you explicitly initiate that action.
• To improve reliability and quality of the AI output using aggregate, de-identified analytics.
• To comply with legal obligations and respond to lawful requests.

We do not sell your personal information, and we do not use your uploaded photos to train foundation AI models. Photos are used only to produce your requested output and are subject to the retention window described below.

To generate results we send your photo (and the text of your prompt) to third-party AI providers who process the request on our behalf under their standard data agreements:

• Google (Gemini) — image generation via the Gemini image models.
• OpenAI — lightweight vision classification (auto-detecting room type / interior vs. exterior).
• Emergent — our platform and hosting provider, which routes requests to the AI providers above.

We also use Stripe for payments, Resend for transactional email, MongoDB Atlas for database storage, and Cloudflare in front of our servers for DDoS protection and caching. Each of these providers only receives the data required to perform its function.

• Uploaded photos & enhanced results — kept for 30 days so you can revisit them in your Library, then automatically deleted from the database via a TTL index. You can delete an individual result any time from the Library page.
• Account information — kept for as long as your account is active. If you delete your account we remove it within 30 days, except records we are legally required to keep (e.g. tax invoices).
• Payment records — kept for the period required by tax and accounting law in the U.S. (typically 7 years for invoices).
• Analytics logs — retained in aggregate for up to 24 months, then deleted or fully anonymized.
• Meta / Instagram tokens — kept only while the connection is active. Disconnecting revokes and deletes the token.

• All traffic is served over HTTPS with TLS 1.2 or higher.
• Passwords are stored as salted bcrypt hashes — we cannot read your password.
• Access tokens (session, Meta OAuth) are stored server-side and never exposed to third-party scripts.
• Databases are hosted on managed cloud infrastructure with encryption at rest.
• Access to production data is limited to the small number of engineers who need it, gated by 2FA, and logged.
• We follow the principle of least privilege for every sub-processor listed above.

No online service is perfectly secure. If we ever discover a breach that affects your personal information we will notify you promptly and, where required by law, notify the appropriate regulators.

We share personal information only in these limited situations:

• With the sub-processors listed in Section 3, strictly to deliver the service you requested.
• With Meta, when you explicitly publish to Instagram or Facebook.
• To comply with the law — court orders, subpoenas, or lawful requests from law enforcement, only after verifying the request.
• In a business transfer — if Home Photo AI is acquired or merges, data may transfer to the new owner, who must honor this policy.

We do not sell, rent, or trade personal information to advertisers or data brokers.

Depending on where you live you may have the right to:

• Access the personal information we hold about you.
• Correct information that is inaccurate.
• Delete your account and associated data (see Section 8).
• Export a copy of your account data in a machine-readable format.
• Object to or restrict certain processing.
• Withdraw consent for optional features (Instagram / Facebook connection).
• Lodge a complaint with your local data-protection authority.

To exercise any of these rights, email us at homephotoai@gmail.com from the address on file. We will respond within 30 days.

You can request full deletion of your Home Photo AI account and all associated data at any time. To do so:

1. Send an email to homephotoai@gmail.com from the email address on your Home Photo AI account.
2. Use the subject line "Data Deletion Request".
3. Tell us whether you want (a) full account deletion, or (b) deletion of a specific set of uploaded photos / edits.

We will confirm receipt within 3 business days and complete the deletion within 30 days. Once deletion is complete you will receive a confirmation email. Records we are legally required to retain (e.g. Stripe payment receipts for tax purposes) will be retained in a restricted archive and not used for any other purpose.

To revoke Home Photo AI's access to your Instagram or Facebook account without deleting your Home Photo AI account, visit accounts.meta.com/apps. Access is revoked immediately by Meta.

Home Photo AI is intended for real estate professionals and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe we have collected information from a child, contact us and we will delete it.

Home Photo AI is hosted in the United States. If you use the service from outside the U.S. your information will be transferred to and processed in the U.S. and other countries where our sub-processors operate. By using the service you consent to this transfer.

We may update this policy from time to time. When we do, we will update the "Effective" date at the top and, for material changes, notify you by email or through an in-app notice at least 7 days before the change takes effect.

For any privacy question or request, please email us: