Viewsitu Privacy Notice
Version: 1.7
Last updated: 27 October 2026
1. Who we are
Viewsitu is a trading name of Verdine Ltd, a company registered in England and Wales (company number 17228684), registered office 6 Bushmead Avenue, Bedford, MK40 3QL ("Viewsitu", "we", "us"). We are the controller of the personal data described in this notice, which covers our website, our waitlist and mailing list and the Viewsitu app.
Contact: privacy@viewsitu.com or by post to the address above. ICO registration number: ZC282349.
How you can use the app, including tokens, refunds and your rights in your content, is set out in our Terms of Service.
2. What we collect
When you visit our website
- Usage data: pages viewed, buttons clicked, referring site, and browser and device type. On the public site we count visitors without cookies or other identifiers stored on your device. Our analytics provider ensures that we cannot identify you and cannot link your visits across days. We use it only to produce aggregate statistics, and you can opt out on our website: viewsitu.com.
- Technical data: your IP address, browser and device information, and security logs, which our hosting and security providers process to deliver the site and protect it from attacks.
- Sign-up source: if you join the mailing list or create an account, we save the referring site, campaign tags and landing page from that visit with your sign-up, so we know which channels people come from.
When you join our mailing list
When you join our mailing list it means you agree to receive our marketing emails (see section 5). Joining our waitlist means joining our mailing list.
- Your email address, your name and the type of user you are.
- A record of your consent: when and where you signed up, the wording you agreed to, and whether you confirmed your email address.
When you send us a complaint about content
If you tell us that content on Viewsitu infringes your rights, we collect what you send us: your name, postal address, telephone number, email address, and the details of your complaint.
When you create an account and use the app
- Account details: email address, name, and sign-in records.
- Your content: artwork images and room photos you upload, the mockups we generate, and the settings you use (placement, sizes, frames and similar).
- Account choices and records: whether you use Viewsitu personally or for your business, which versions of our Terms of Service you agreed to and of this notice you were shown, and when.
- Tokens: your token balance and history.
- Purchases: what you bought, when, and the amount, and your country, billing address and, if you buy as a business, your VAT number, which we need to charge the right VAT. Payments are handled by Stripe, which shows your saved card in its billing portal. We do not see or store your card details.
- Product usage: the pages you visit and actions you take in the app, linked to your account ID, together with the domain of your email address (for example gallery.com, never the full address) and the type of user you are, so we can understand use by different kinds of organisation.
- Technical data: your IP address, browser and device information, and sign-in and security logs.
- Communications: messages you send us, such as support requests.
Please avoid uploading room photos that show people or personal documents. If you do, they are processed in the same way as your other content. Only upload photos of other people if you have their permission.
We do not knowingly collect special category data (such as health or religious beliefs).
You must give us your email address to join the mailing list or create an account; without it we cannot provide either. Information we do not need is marked as optional.
3. How we use your data and our legal bases
We rely on the UK GDPR.
| Purpose | Legal basis |
|---|---|
| Providing the app: storing your content and generating mockups | Contract |
| Support and fixing problems, including our staff viewing your content where needed | Contract; legitimate interests: running a reliable service |
| Taking payments and keeping financial records | Contract; legal obligation (tax records) |
| Service emails to account holders: sign-in, security, receipts, changes to our terms | Contract |
| Marketing emails, including waitlist updates and beta invitations | Consent |
| Measuring use of the public website, without identifying you | Legitimate interests: understanding and improving our website |
| Linking your sign-up source and mailing-list record to your account | Legitimate interests: understanding which channels bring customers |
| Product analytics in the app | Legitimate interests: finding problems and improving the app |
| Enforcing our terms: removing content, restricting or closing accounts, and reporting unlawful content to the authorities | Legal obligation; legitimate interests |
| Handling complaints about content, including sharing what the user concerned needs to respond | Legitimate interests: protecting rights holders and our service |
| Using your mockups in our marketing, only with your explicit permission for that use | Consent |
| Security, fraud and abuse prevention | Legitimate interests |
| Complying with the law and handling legal claims | Legal obligation; legitimate interests |
Where we rely on legitimate interests, you can object (see section 9), and we will give you a summary of how we balanced our interests against yours on request. You can switch off product analytics in your account settings at any time.
Our staff may view your images and mockups where needed to provide support, find and fix problems with the service (for example when a mockup fails), or prevent misuse. Access is limited to people who need it.
We do not sell your personal data or make decisions about you by automated means that have legal or similarly significant effects.
4. How we use AI services
To analyse your room photos and generate mockups, we send your uploaded images and settings to AI providers acting on our behalf: OpenAI and Google. Under the API terms that apply to us, they do not use your content, including the rooms and artworks you upload, to train their AI models. They may keep it for a limited time to detect misuse, after which it is deleted. We do not use your images or mockups to train AI models.
5. Emails we send
- Service emails are needed to run your account, so you will receive them while you have one. They do not contain marketing.
- Marketing emails (launch news, testing invitations, product news, tips and offers) are sent only if you have joined our mailing list or ticked the box to receive these emails when signing up. You can stop them at any time with the unsubscribe link in every marketing email or in your account settings.
- The waitlist is our mailing list. If you unsubscribe, you also leave the waitlist. We send different emails depending on whether you have created an account, for example to tell waitlist members who have not yet signed up about the app. If the waitlist closes before you create an account, you stay on our mailing list until you unsubscribe.
- Measuring our emails: we do not track whether you individually open our emails or click their links. Links in our emails carry campaign tags so we can see which emails bring visitors and sign-ups to our website. We look at these in aggregate, not at what individual people do.
If you joined our mailing list before creating an account, your mailing-list choice carries over to your account and you can change it there.
6. Who we share your data with
We use these service providers, who process data on our behalf under contract and only on our instructions:
| Provider | Purpose | Where data is stored |
|---|---|---|
| Supabase | Database, file storage and sign-in | European Union |
| Resend | Mailing list and sending emails | United States |
| PostHog | Website and product analytics | European Union |
| Cloudflare | Hosting, delivery and security | Global network |
| OpenAI | Image analysis and generation | United States |
| Image analysis and generation | United States / global | |
| Email for our support and privacy addresses | United States / global |
Some providers that store data in the EU can also access it from other countries, including the United States; see section 7.
Stripe processes your payments as an independent controller under its own privacy policy, which applies to the information you give it.
We may also share data with professional advisers; with regulators, courts or law enforcement where required by law; with the user concerned, if you send us a complaint about their content (only what they need to respond); with an alternative dispute resolution provider, if a complaint goes to one; or with a buyer if the business is sold, in which case you would be told. We do not share your data with anyone for their own marketing.
7. International transfers
Some providers are based in, or access data from, countries outside the UK and EU/EEA, including the United States. Where this happens we rely on UK data bridge (adequacy) regulations (including the UK Extension to the EU-US Data Privacy Framework where the provider is certified), or on approved safeguards such as the UK International Data Transfer Agreement or the EU Standard Contractual Clauses with the UK Addendum. The safeguard for each provider is:
| Provider | Safeguard |
|---|---|
| Supabase | UK Addendum to the EU Standard Contractual Clauses |
| PostHog | UK-US data bridge (UK Extension to the EU-US Data Privacy Framework), with the UK Addendum to the EU Standard Contractual Clauses as back-up |
| Resend | UK-US data bridge (UK Extension to the EU-US Data Privacy Framework) |
| Cloudflare | UK-US data bridge (UK Extension to the EU-US Data Privacy Framework), with the UK Addendum to the EU Standard Contractual Clauses as back-up |
| OpenAI | UK Addendum to the EU Standard Contractual Clauses |
| Google (AI and email) | UK-US data bridge (UK Extension to the EU-US Data Privacy Framework) |
You can ask us for a copy of the relevant safeguard at privacy@viewsitu.com.
8. How long we keep your data
| Data | How long |
|---|---|
| Account details, uploaded images and mockups | While your account is open. You can delete individual images, mockups and drafts at any time: they stay in Trash for 30 days, unless you delete them permanently sooner. If you delete your account, you can restore it for 30 days. After that we delete your images, mockups and personal details. We keep anonymous records of how the service was used. |
| Closed accounts | Your name, email address, payments, the terms you accepted and your marketing choices: 6 years after you delete your account, in case of a legal claim. Purchase records can be kept longer, as below. |
| Purchase records | 6 years after the end of the financial year of the purchase, as required for tax purposes, or for sales to customers in the EU, 10 years after the end of the year of the sale, as EU VAT rules require. This applies even if you delete your account. |
| Mailing list | Until you unsubscribe. We then keep your email address on a suppression list, holding only what we need for this, so we do not email you again. |
| Unconfirmed mailing-list sign-ups | 7 days, if you do not confirm your email address |
| Record of your consent | While you are subscribed and for 6 years after |
| Sign-up source | As long as the account or mailing-list record it belongs to |
| Public website analytics | Up to 24 months |
| Product analytics | Up to 24 months. If you delete your account, we stop collecting it straight away. |
| Sign-in and security logs | Up to 12 months |
| Email delivery records | Up to 30 days, set by our email provider |
| Support messages | Up to 2 years after the conversation ends. |
| Complaints about content | 6 years after the complaint is closed, in case of a legal claim and so we can identify repeated infringement. |
9. Your rights
You have the right to:
- access the personal data we hold about you
- correct inaccurate data
- have your data deleted
- restrict or object to our use of it
- object to direct marketing at any time, in which case we will stop
- receive your data in a portable format
- withdraw consent at any time, without affecting anything done before you withdrew
You can delete images, mockups, and your account, change email preferences and switch off product analytics yourself in the app. For anything else, email privacy@viewsitu.com. We respond within one month (extendable in limited cases, and we will tell you if so), we will not charge you, and we may need to confirm your identity.
10. Complaints
If you are unhappy with how we have handled your personal data, contact us first at privacy@viewsitu.com. For other complaints, contact support@viewsitu.com. We will acknowledge your complaint within 30 days and respond without undue delay. You can also complain to the UK Information Commissioner's Office (ico.org.uk). If you are outside the UK, you may also be able to complain to your local data protection authority.
11. Cookies and similar technologies
We do not currently use advertising cookies or cross-site tracking. If we introduce them, for example to measure advertising campaigns, we will ask for your consent first and update this notice.
- Public website: analytics run without cookies or other identifiers stored on your device. Visitors are counted using a code that changes daily, as described in section 2. If you opt out, we store your choice in your browser so we can respect it.
- Essential storage: Cloudflare sets a security cookie to protect the site from bots. When you sign in, we keep your login session in your browser's storage. Neither can be switched off, because the site and app need them to work securely.
- In the app: product analytics are linked to your account rather than stored on your device. We use them only to produce statistics on how the app is used and to improve it. You can switch them off at any time in Account → Preferences.
- Payments: checkout takes place on Stripe's website, which uses its own cookies, including for fraud prevention, under Stripe's policies.
12. Additional information for specific regions
- United States: we do not sell or "share" personal information or use it for targeted advertising, as those terms are defined in US state privacy laws. Whether or not a state law applies to us, you can make any request in section 9 and we will not discriminate against you for doing so.
- Canada, Australia, Brazil and elsewhere: you have the rights in section 9 and can also contact your local privacy regulator.
13. Children
Viewsitu is not intended for anyone under 18 and we do not knowingly collect their data. We ask you to confirm that you are 18 or over when you sign up. If you are the parent or guardian of a child who has given us their data, contact us and we will delete it.
14. Security
We use providers with appropriate security measures, encrypt data in transit and at rest, and restrict access to personal data to people who need it. We use multi-factor authentication on our systems. No system is completely secure; if a breach is likely to put you at high risk, we will tell you.
15. Changes to this notice
We will post changes on this page and update the date above. If a change materially affects how we use your data, we will email you before it takes effect. If we want to use your data for a new purpose that requires your consent, we will ask for it separately and will not use your data for that purpose unless you agree. Previous versions of this notice are available on request.