1. Who this policy applies to

There are three groups of people whose data we may process:

Retailers and other business customers who hold an account with us and subscribe to our service.
End userswho interact with the Visualiseo widget embedded on a retailer's website — for example, to upload a photo of a space and generate a product visualisation.
Website visitors who browse visualiseo.co.uk without signing up.

The rules that apply to you depend on which of these you are.

2. Our role: controller, joint controller, or processor

Data protection law treats the person who decides why data is collected (the controller) differently from the person who processes it on their instructions (the processor). Where two organisations jointly decide the why and how, they are joint controllers under Article 26 UK GDPR. Our role changes depending on the context:

For retailer account data (your name, email, company, payment records) we are the controller.
For photos uploaded by end users through a retailer's widget in order to generate a render, the retailer is the controller and we are the processor acting under a Data Processing Agreement (see /dpa).
For the public gallery that we run at visualiseo.co.uk and that retailers run on their own sites, we and the retailer are joint controllers. A plain-English summary of that arrangement is available at /legal/joint-controller-summary.
For the “Email me this render” feature — where an end user asks us to email their render and that address is passed to the retailer as a sales lead — the retailer is the controller and we are the processor acting on their behalf (see section 6).
For the chat and quote assistantthat a retailer embeds on their own website — the conversation itself, any name, email address or phone number you give, and your answers to the retailer's quote questions — the retailer is the controller and we are the processor, acting under the same Data Processing Agreement. The retailer receives the conversation as a sales enquiry and handles it under their own privacy notice.
For a quote you ask for on our own pages, we are the sole controller — there is no retailer behind it. If you consent, we pass your details to worktop companies who buy the enquiry as a lead. Each of those companies is an independent controller from the moment they receive your details: they are not our joint controllers and not our processors, and they answer to you separately under their own privacy notice. See section 6.
For our own server logs, security telemetry, and aggregate usage statistics about the widget, we are the controller.
For renders generated through a demo or free visualiser that we host on our own site(for example the “try it” tool on our homepage or our free flooring and worktop visualiser pages), there is no retailer involved — so we are the sole controllerof everything you do there, including the photo upload and render, the short-lived rate-limit counters, the pseudonymous session analytics, and any optional gallery publication. The data we handle and our legal bases are exactly the same as described elsewhere in this policy; only our role differs. Where this policy says the retailer is the controller, or that the gallery is run under joint controllership, or refers to “the retailer's privacy notice”, that does not apply to our own hosted demos — for those, we are the controller you exercise your rights against, at privacy@visualiseo.co.uk.

3. What information we collect

From retailer account holders

Your name, email address, and a password (stored only as a bcrypt hash — never in plain text).
Your company name and website URL.
Billing identifiers generated by Stripe. We never see or store your card number, CVV, or bank details.
API keys and allowed installation domains you configure.
Product images and custom prompts you upload to the dashboard.
Monthly render counts and telemetry about renders generated through your account.

From end users of the widget

The photo you upload to generate a render. The photo is sent to our AI sub-processors to produce the output; it is not stored on our servers. Photos of people are automatically rejected before they are processed (see section 11 below).
The generated render, which is returned to your browser as an image. It is not stored on our servers unless you explicitly tick “Share publicly” on the Save popup, in which case it is saved to both our public gallery and the retailer's gallery (joint controllership) pending retailer review.
If you tick “Save on this device” on the Save popup, the render is kept in your browser's IndexedDB storage so you can see your recent renders the next time you open the widget on the same device. It is never sent to our servers.
Your email address, only if you tick “Email me this render” on the Save popup. We use it to send you the render you asked for, and we share it — together with the render and the product visualised — with the retailer whose widget you used, so they can follow up about that product (see section 6). Receiving ongoing marketing from the retailer is a separate, optional opt-in shown next to the email field and is never ticked by default. We do not use your address for our own marketing and we never sell it.
What you type into the chat or quote assistant.Where a retailer has switched it on, we store the conversation — every message you, the assistant and the retailer's team send — together with any name, email address or phone number you choose to give, your answers to the retailer's quote questions, and the product or render the conversation relates to. If a question asks for photos — a kitchen plan, a drawing, or the room itself — we store the ones you attach (up to three per question, and you can skip the question). We remove the hidden location data cameras add to photos before storing them, and photos are never sent to an AI. Your messages are sent to our AI sub-processor to produce the assistant's replies, and the retailer can read the whole conversation in their dashboard. We do this for the retailer, as their processor. Please do not put anything into the chat that you would not say to the retailer directly. Section 8 says how long we keep it.
Pseudonymous session timestamps (when you opened, uploaded, generated, or closed the widget), identified only by a random session ID. They are tied to the retailer's account, not to you personally. Each session also stores a one-way hash of your network address (not the address itself) so the retailer can see how many distinct visitors return — never used to identify you.

Collected automatically

IP address, browser, and device type — contained in our standard server logs for security and fraud prevention.
Short-lived rate-limit counters— to protect retailers' render allowances and our service from abuse, we briefly store a counter keyed to your IP and the retailer you are using, so we can tell when a single visitor has exceeded a fair-use threshold (typically 10 renders per hour / 20 per day; retailers may adjust this). These counters are automatically deleted within 48 hours and are never used for analytics, profiling, or marketing. Lawful basis: Art. 6(1)(f) legitimate interest — documented LIA.
Technical metadata on the images you upload (dimensions, file size). Before anything is sent to an AI provider or stored, we strip EXIF, GPS, and other embedded metadata from every image.
Approximate location and marketing-page analytics.When you visit our own pages (not a retailer's widget), we record cookieless analytics — the page, referrer, device type, scroll depth, and time on page — together with an approximate location (city and country) derived from your IP address at the moment you load the page. We do notstore your IP address; only the resolved coarse location (e.g. “London, United Kingdom”) is kept. No cookie or browser storage is used — the visit identifier exists only in your browser's memory and is discarded when you reload — so no consent banner is required. Lawful basis: Art. 6(1)(f) legitimate interest in understanding how our marketing pages perform; you can object at any time at privacy@visualiseo.co.uk.

Indirectly

In some cases a retailer may pass us metadata about an end user's session (for example, a product ID) that the retailer has gathered on their own site. Where this is the case, the retailer is responsible for telling you about that collection in their own privacy notice.

4. How we use your information, and our legal basis

Purpose	Legal basis (UK GDPR Art. 6)
Create and administer your account, deliver the service	Art. 6(1)(b) — contract
Process payments and maintain billing records	Art. 6(1)(b) contract + Art. 6(1)(c) legal obligation (HMRC)
Send transactional emails (welcome, password reset, billing notices)	Art. 6(1)(b) — contract
Generate renders from end-user uploads	We process on behalf of the retailer as their processor; the retailer's own legal basis (typically Art. 6(1)(f) legitimate interest in offering a visualisation tool) applies. See the retailer's privacy notice.
Run a retailer's chat and quote assistant and store the conversation so the retailer can reply and follow up	We process on behalf of the retailer as their processor; the retailer's own legal basis applies — typically Art. 6(1)(f) legitimate interest in answering a sales enquiry, or Art. 6(1)(b) steps taken at your request before entering a contract. See the retailer's privacy notice.
Generate the assistant's replies with an AI language model	Same processor role and the same retailer legal basis as above. The conversation text is sent to Google (Gemini) as our sub-processor under a paid contract that prohibits training on it.
Publish a render in the public gallery	Art. 6(1)(a) explicit consent of the end user; Art. 9(2)(a) explicit consent for any special-category data that may incidentally be revealed.
Email a render to an end user who requested it ("Email me this render")	Art. 6(1)(b) / Art. 6(1)(a) — the end user's own request. We act as the retailer's processor for this.
Share that email + render with the retailer so they can follow up about the product	The retailer's Art. 6(1)(f) legitimate interest in responding to a product enquiry. We act as the retailer's processor.
Send the end user ongoing marketing about the retailer's products and offers	Art. 6(1)(a) — separate, optional opt-in, never pre-ticked, withdrawable at any time.
Show your quote enquiry from visualiseo.co.uk to worktop companies with your name, email and phone removed, so they can decide whether to quote	Art. 6(1)(a) — your consent, given when you ask for the quote. See section 6.
Give your name, email and phone to a worktop company that buys your enquiry, so they can contact you about the job	Art. 6(1)(a) — your consent, given when you ask for the quote. Not pre-ticked, and the quote is not sent without it. See section 6.
Detect fraud, abuse, and keep the service secure	Art. 6(1)(f) legitimate interest — documented LIA
Monitor usage against your plan limits	Art. 6(1)(b) — contract
Improve the service (aggregate, non-identifying metrics)	Art. 6(1)(f) legitimate interest — documented LIA

Automated decision-making. We do not carry out automated decision-making that produces legal or similarly significant effects on you within the meaning of Articles 22 / 22A–22D UK GDPR. Render generation is automated but produces a visual preview, not a decision about you. You have the right to contest any automated processing and to request human intervention; contact privacy@visualiseo.co.uk.

We never use your uploaded images to train AI models. Every AI provider we use is engaged under a paid commercial contract that contractually prohibits training on customer inputs.

5. Special-category data

A photograph is not automatically special-category data under UK law; it becomes so only where it is processed for biometric identification (Art. 9 UK GDPR). We do not carry out biometric identification and our AI providers have confirmed contractually that inputs are not used for face-matching or identification.

However, a photograph of a space may incidentally reveal information that is special-category data under Art. 9 (for example, religious markers in the home, visible mobility aids, or details that suggest ethnicity). We minimise this risk by prohibiting and rejecting photos of people before any AI processing occurs and by stripping EXIF / GPS metadata from every upload.

For the render itself (the processing that happens even if you never publish to the gallery), we rely on your explicit consent under Art. 9(2)(a) UK GDPR, captured at the widget's pre-flight notice — the consent tick covers Article 6(1)(a) and Article 9(2)(a) and is the basis we use for any special-category information that might incidentally appear in the photo of your space.

For gallery publication, we rely on a separate, more granular explicit consent under Art. 6(1)(a) and Art. 9(2)(a) — captured at the Save popup, withdrawable via a tokenised link shown on the widget result screen at the moment of publication for you to copy and keep.

You may withdraw either consent at any time. Withdrawal stops future processing — it does not make past processing unlawful. The provider's file-API copy of your photo is deleted automatically within 48 hours regardless.

6. Who we share data with

We rely on a small set of trusted sub-processors to run the service:

Provider	Purpose	Location
Google (Gemini API)	AI image generation (primary) and generating the retailer chat and quote assistant's replies	United States
Google Cloud Vertex AI	AI image generation (alternate model chain, Gemini Enterprise)	United States / European Union
OpenAI	AI image generation (alternate model chain)	United States
Google Cloud Storage	Product and gallery image storage	European Union
Neon	PostgreSQL database hosting	European Union
Vercel	Web application hosting	United States / global edge
Stripe, Inc.	Payment processing	United States / Ireland
Resend	Transactional email delivery	United States
Pusher	Real-time delivery of chat messages — both our own support chat and conversations between a visitor and a retailer	United States

The canonical list is published at /sub-processors. We give retailers at least 30 days' email notice of any material addition or replacement of a sub-processor, and retailers can object on reasonable data-protection grounds.

Email leads. Separately from the sub-processors above, when you ask us to email a render to you we share your email address, the render, and the product visualised with the retailer whose widget you used, so they can follow up about that product. The retailer is an independent controller of that lead and handles it under their own privacy notice. We pass it to them as their processor; we do not use it for our own purposes.

Quote enquiries made on visualiseo.co.uk. This applies only if you asked for a worktop quote on one of our ownpages — not to a quote form on a retailer's own website, which is covered above. When you ask for a quote here, you are asked to confirm that you are happy for worktop companies to contact you about the job. If you do not agree, the enquiry is not sent and none of the following happens.

Your enquiry is shown to worktop companies who subscribe to Visualiseo, with your name, email address and phone number removed. They see what you asked for, any photos or visualisation you attached, and your town or postcode — enough to decide whether the job is in their area.
A company can then pay us to receive your name, email address and phone number so they can contact you. This is how the service is funded, and it is the only circumstance in which we are paid for passing on personal data.
More than one company can buy the same enquiry — up to a fixed limit, so you may hear from several. Each of them becomes an independent controller of your details from that point and handles them under their own privacy notice. They are contractually required to contact you only about this job and never to sell your details on.
You can withdraw your consent at any time by emailing privacy@visualiseo.co.uk. That stops any further company being given your details and removes the enquiry from the board. It cannot undo a disclosure already made — a company that has already bought your details keeps them, and you would need to ask that company directly. You can also ask any of them to stop contacting you.

Apart from the lead sale described immediately above, we do not trade or monetise personal data. We do not share it with advertisers. We do not use third-party analytics, cross-site tracking pixels, or behavioural advertising cookies.

We may disclose data where we are legally required to (for example, a court order) or where it is necessary to investigate fraud, abuse, or a threat to safety.

7. International transfers

Some of our sub-processors are based outside the UK and EEA. Where this is the case we rely on safeguards recognised by UK data protection law, in particular:

The UK-US Data Bridge (UK extension to the EU-US Data Privacy Framework) for providers that are DPF-certified.
Standard Contractual Clauses together with the UK International Data Transfer Addendum.
Adequacy decisions issued by the UK government, where available.

We have completed a Transfer Risk Assessment for each international sub-processor. A summary is available on request from privacy@visualiseo.co.uk.

8. How long we keep your data

Data	Retention
Uploaded photo (before render)	Not stored by us. Held briefly by the AI provider and automatically deleted within 48 hours under the provider's file-API retention policy.
Generated render (not shared)	Returned to your browser. Not stored by us.
Render saved on your device	Kept in your browser's IndexedDB until you clear browser data or remove it from the widget's recent-renders panel. Never sent to our servers.
Gallery submissions (public)	Until you withdraw consent or the retailer removes them.
Email leads (address, render reference, marketing opt-in status)	Kept for the retailer to action the enquiry while their subscription is active, and in any event no longer than 24 months. Deleted sooner if you or the retailer ask. Deleted in full when the retailer closes their account.
Visitor conversation with a retailer (no contact details given)	90 days from your last message, then deleted together with the full transcript. This is any conversation where you did not give an email address or phone number and did not complete a quote request.
Visitor conversation with a retailer (contact details given, or quote completed)	Kept for the retailer to action while their subscription is active, and in any event no longer than 24 months from your last message. Deleted sooner if you or the retailer ask. Deleted in full when the retailer closes their account.
Quote enquiry made on visualiseo.co.uk (available as a lead)	Kept on the board while it is still worth quoting for and in any event no longer than 24 months from your last message, on the same schedule as any other quote enquiry. Removed from the board immediately if you withdraw consent, and we then hold it only as a record that you did.
Record of which companies bought your enquiry	Kept while it is needed to bill, refund and audit the sale, and in any event no longer than 24 months. This record is how we can tell you who was given your details.
Retailer account	Until you close the account, then 30 days, then deleted or anonymised. To close your account, email privacy@visualiseo.co.uk. In-dashboard self-serve account closure is planned but not yet available.
Payment and invoice records	6 years (UK tax law).
Render metadata and analytics	24 months.
Marketing-page analytics (incl. approximate location, no IP)	24 months.
Widget session logs	12 months.
Support chat conversations (closed)	12 months from the last message, then deleted with all messages. Open conversations are not auto-deleted.
Security and server logs	30 days.
Complaint records	6 years (to evidence our handling of your right to complain).

9. Your rights

You have the following rights under UK data protection law:

Access the personal data we hold about you.
Correct inaccurate or incomplete data.
Ask us to delete your data (“right to be forgotten”).
Restrict or object to processing based on legitimate interest.
Receive your data in a portable format.
Withdraw consent you have given. For gallery publication, a self-serve withdrawal linkis shown on the widget result screen at the moment you tick “Share publicly”, for you to copy and keep. You can use that link at any time without contacting us. You can also email us at privacy@visualiseo.co.uk, use the complaints form, or use the retailer's own channel.
Complain directly to us using our electronic complaints form at /complaints. This is a statutory right under the DUAA 2025 (amended Art. 77 UK GDPR). We will acknowledge your complaint within 30 days and inform you of the outcome without undue delay.
Complain to the Information Commissioner's Office at ico.org.uk.

If you used the widget on a retailer's website for a render, the retailer is the controller for that upload. You can contact either them or us — for the public gallery, because we are joint controllers, you can exercise your rights against either party (Art. 26(3) UK GDPR).

If you are an account holder, email privacy@visualiseo.co.uk or use /complaints. We will respond within one calendar month.

10. Cookies and browser storage

We only use first-party storage. We do not use advertising, analytics, or cross-site tracking cookies, so no cookie banner is shown. Our marketing-page analytics are cookieless and run server-side (see §1).

What	Why	Basis	Lifetime
NextAuth session cookie	Keeps you signed in to the dashboard	Strictly necessary (PECR reg. 6 exemption)	Up to 30 days. If you don't tick "Remember me" the session inside the cookie expires after 24 hours; the cookie itself may persist until you clear browser data.
NextAuth CSRF cookie	Protects sign-in against cross-site attacks	Strictly necessary (PECR reg. 6 exemption)	Session
Widget consent flag (localStorage)	Remembers you accepted the widget safety notice so you don't see it every time	Strictly necessary to deliver the service in line with the pre-flight notice requirement	7 days
Chat session (localStorage, inside the chat frame)	Remembers which conversation is yours — a random visitor ID, the conversation ID and an access token — so you can pick up where you left off	Strictly necessary to deliver the chat you started (PECR reg. 6(4) exemption). Only written once you send your first message; nothing is stored if you never use the chat.	Until you clear browser data
Widget recent renders (IndexedDB)	Shows your 3 most recent renders on the same device	Your explicit opt-in when you tick "Save on this device" in the Save popup	Until you clear browser data or remove the entry in the widget

You can clear any of these at any time through your browser's privacy settings.

11. Children and age assurance

Visualiseo is not directed at children. You must be 18 or over to hold an account or to use the widget. We do not knowingly collect data from anyone under 18.

The widget accepts photographs of spaces only. A server-side check rejects any image that appears to contain a person before it is sent to any AI provider. We believe this restriction, combined with the age statement in the pre-flight notice, removes the material risks that the Children's Code and Online Safety Act 2023 are designed to address.

We have carried out a Children's Access Assessment (under the ICO Children's Code and the Online Safety Act 2023) and have concluded that the service is not likely to be accessed by children in significant numbers. Even so, we apply relevant standards — data minimisation, opt-in publication, no profiling, no dark patterns — as data protection by design.

If you believe a child has used our service, contact privacy@visualiseo.co.uk and we will delete their data.

12. AI-generated content (transparency)

Every render produced by the widget is AI-generated. In line with Article 50 of the EU AI Act (which applies to us when we serve EU users) and our own transparency commitments:

Every image displayed in our public gallery carries a visible “AI-generated” label.
The widget discloses before you upload that the final image is produced by AI and may not exactly match the product's real colour or finish.
We do not use synthetic media to impersonate real people; photographs of people are rejected before any AI processing.

13. How we protect your data

All traffic to and from our servers uses TLS encryption.
Data stored by our providers (Google Cloud Storage, Neon, Vercel) is encrypted at rest using provider-managed keys.
Passwords are stored as bcrypt hashes, never in plain text.
API keys are unique per account and can be rotated by you at any time.
Each retailer's widget installation is restricted to domains they allowlist.
EXIF, GPS, and other embedded metadata are stripped from every uploaded image before it is processed or stored.
Access to production data is restricted to the minimum number of people needed to operate the service.
We operate an incident-response process with 72-hour ICO notification per Article 33 UK GDPR.
We carry out Data Protection Impact Assessments for new processing and review them annually.

14. Changes to this policy

If we make a material change to this policy we will email account holders and update the “Last updated” date at the top of this page. Continuing to use the service after the change means you accept the updated policy.

15. Contact us

Privacy questions and data subject requests: privacy@visualiseo.co.uk
Electronic complaints form: /complaints
General support: support@visualiseo.co.uk

You can also reach us by post at our registered office:

VisualiseO Limited
27 Beverley Close
Normanton
WF6 1BU
United Kingdom