1. Data Controller

The data controller is Elidat Technologies, s.r.o., Company ID: 223 91 223, registered at No. 125, 289 03 Sloveč, Czech Republic (hereinafter "Controller").

Contact email for data protection matters: stepan@elidat.com

2. Scope and Purpose of Data Processing

The Controller processes personal data of Users to the extent necessary for providing the Elidat service — a web application for creating AI-powered property video tours. Personal data is processed for the following purposes:

Purpose	Data Scope	Legal Basis	Retention Period
Registration and account management	Name, surname, email, phone, company name, company ID	Contract performance (Art. 6(1)(b) GDPR)	Duration of account + 30 days
Service provision (video creation)	Property photographs, addresses and GPS coordinates, text descriptions	Contract performance (Art. 6(1)(b) GDPR)	Duration of account + 30 days
Voice cloning	Voice recordings provided by User	Consent (Art. 6(1)(a) GDPR)	Duration of consent, max until account deletion + 30 days
Billing and payments	Billing details, payment history, bank account number	Legal obligation (Art. 6(1)(c) GDPR)	10 years from transaction
Marketing communications	Email address	Legitimate interest / consent (Art. 6(1)(f) or (a) GDPR)	Until consent withdrawal or unsubscription
Analytics and service improvement	IP address, browser type, application usage data, cookies	Legitimate interest (Art. 6(1)(f) GDPR)	26 months
Technical support	Support communications, issue details	Contract performance / legitimate interest	3 years from last contact
Team management (Office plan)	Names and emails of team members, assigned roles	Contract performance (Art. 6(1)(b) GDPR)	Duration of account + 30 days
AI Copilot / Autopilot	Listing text, project description, assistant conversation, photographs and video frames (content analysis), title deed data (cadastral area and parcel numbers)	Performance of contract (Art. 6(1)(b) GDPR)	Conversation for the life of the project; photo analysis results at most 7 days; the uploaded title deed is not retained
Photographer collaboration	Photographer's name, email and access permissions; record of the Photographer's activity in the Client's projects	Performance of contract (Art. 6(1)(b) GDPR)	For the duration of the Collaboration + 30 days
Photographer profile and directory	Name, photo, description of services, contact details and portfolio published by the Photographer	Consent (Art. 6(1)(a) GDPR)	Until consent is withdrawn / profile deleted
Partner and referral program	Referral code, identifier of the referred account, status and amount of the claim, participant's billing details	Performance of contract / legal obligation (Art. 6(1)(b) and (c) GDPR)	For the duration of participation; accounting documents 10 years
Project retention	Email address, project name, date of last change (pre-deletion notice)	Performance of contract (Art. 6(1)(b) GDPR)	Inactive project 60 days (subscribers 365 days), then deleted including media

3. Recipients and Data Processors

The Controller may transfer personal data to third parties only to the extent necessary for providing the Service. The main categories of recipients and processors are:

Infrastructure: Vercel (hosting and file storage, USA/EU), Neon (database, EU), Inngest (background job processing), Resend (email delivery), Stripe (payments).
AI models: Anthropic — Claude (listing text, project description, assistant conversation, analysis of photographs and video frames, extraction of title deed data); OpenAI — GPT Image (photographs for visualizations and enhancement); Google — Gemini (photographs, document data extraction, geocoding and map data); Kuaishou — Kling (photographs for animation and video transitions); ElevenLabs (commentary text, voice sample for cloning); Replicate (photo enhancement and upscaling).
Map and satellite data: Mapbox, the Czech cadastral office (ČÚZK) and similar cadastral data providers.
Stock media: Pixabay, Pexels (only if used by the User).
Analytics: providers of analytics and measurement tools under Section 5.

AI model providers process the materials only to generate the requested output; under their API terms, User data is not used to train models and is retained at most for the time needed for abuse monitoring (generally up to 30 days). Photographs are analysed only to recognise room type and suitable edits; the Service does not perform recognition or identification of persons.

Within a Collaboration (Art. 15 GTC) the Photographer invited by the Client also gains access to the Client's Content and projects; in that scope the Photographer acts as an independent controller or as the Client's processor, not as the Controller.

The Controller has data processing agreements with all processors in accordance with Art. 28 GDPR.

Personal data may be transferred to third countries (outside the EEA) only with adequate safeguards — for US providers (Anthropic, OpenAI, Google, Vercel, Replicate, ElevenLabs) on the basis of the adequacy decision for the EU-U.S. Data Privacy Framework or standard contractual clauses under Art. 46(2)(c) GDPR; for the provider Kling (China) on the basis of standard contractual clauses. Only the photographs and texts necessary for the given operation are transferred to these services, not the User's account identification data.

4. Data Subject Rights

As a data subject, you have the following rights under GDPR:

Right of access — you have the right to obtain confirmation of whether your personal data is being processed and access to that data.
Right to rectification — you have the right to request correction of inaccurate personal data and completion of incomplete data.
Right to erasure — you have the right to request deletion of your personal data under the conditions of Art. 17 GDPR.
Right to restriction — you have the right to request restriction of processing under the conditions of Art. 18 GDPR.
Right to data portability — you have the right to receive your personal data in a structured, commonly used, machine-readable format.
Right to object — you have the right to object to processing based on legitimate interest at any time.
Right to withdraw consent — where processing is based on consent, you may withdraw it at any time.
Right to lodge a complaint — you have the right to lodge a complaint with the supervisory authority (Office for Personal Data Protection, Czech Republic, www.uoou.cz).

To exercise your rights, contact the Controller at stepan@elidat.com. The Controller will process your request within 30 days.

5. Cookies and Tracking Technologies

The Platform uses cookies and similar technologies for functionality, analytics, and improving user experience.

Necessary cookies — ensure basic Platform functionality (login, security). Cannot be declined.
Analytics cookies — used for traffic analysis and Platform usage. Processed based on User consent.
Marketing cookies — used for displaying relevant advertising. Processed based on User consent.

Users can manage cookie preferences through the cookie banner on the Platform or through browser settings.

6. Data Security

The Controller implements appropriate technical and organizational measures to protect personal data, including: data encryption in transit (TLS/SSL) and at rest, least-privilege access control, regular data backups, access monitoring and logging, and regular security reviews.

In case of a personal data breach, the Controller will notify the supervisory authority within 72 hours and inform affected data subjects if there is a high risk, in accordance with Art. 33 and 34 GDPR.

7. Processing of Third-Party Data

If a User uploads photographs or other content containing personal data of third parties, the User acts as the data controller for such data. The User must ensure they have an appropriate legal basis and that third parties are informed in accordance with GDPR.

This also applies to title deeds and other cadastral documents, which may contain owners' names, addresses and dates of birth or easements. The User uploads them as an intermediary authorised by the owner. The Service automatically extracts only the cadastral area and parcel numbers from the document; the document as a whole is not retained after processing.

Property photographs may capture persons, licence plates or neighbouring houses. The User is responsible for being entitled to process them; the Service does not recognise or identify persons.

8. Automated Decision-Making

The Service uses automated data processing through AI algorithms for generating Video Outputs. This processing does not have legal effects or similarly significant impact on Users within the meaning of Art. 22 GDPR.

9. Changes to Privacy Policy

The Controller reserves the right to update this Policy at any time. Users will be informed of significant changes via email and/or Platform notification at least 30 days in advance.

10. Contact Information

Elidat Technologies, s.r.o.

Company ID: 223 91 223

Registered office: No. 125, 289 03 Sloveč, Czech Republic

Email: stepan@elidat.com

This Privacy Policy is effective from October 20, 2026.