1. Who controls your data
Spatialist is the controller for account, project, marketplace and support data.
Data controller: FABRICA ORATIONIS SOLUTIONS S.R.L.
Registered office: Aleea Albatrosului nr. 7, ap. 28, 900091 Constanța, România
Company registration: J13/4075/2021
VAT: Not registered for VAT
Privacy contact: ryan@spatialist.io
Stripe acts as an independent controller for certain identity, compliance, fraud-prevention and payment activities and as a processor for certain services, as described in Stripe’s own privacy documentation and data-processing agreement.
2. Data we process
- Identity and account data: name, email, user identifier, role, country and account status.
- Professional data: business identity, qualifications, portfolio and Stripe Connect verification status. Stripe receives identity documents and bank details directly; Spatialist is designed not to store full card or bank-account numbers.
- Project data: briefs, counterparties, proposals, milestones, deliverables, decisions, messages and dispute evidence.
- FrameFlow media and processing data: uploaded photographs, filenames, capture metadata, selected style and transform settings, cloud-import source, previews, finished results, processing measurements, ratings and remedy requests.
- FrameFlow Personal Model data: selected source and edited image pairs, room or style labels, training settings, evaluation results and account-specific model files where a user deliberately starts Personal Model training.
- FrameFlow Contributor data: contributor identity and authority, business and location details, separately selected source and finished images, property baskets, file hashes, rights declarations, electronic signature, agreement versions, review decisions and promotional-credit records.
- Research and evaluation data: images, annotations, limited metadata, licence information and benchmark results obtained from published or controlled-access research repositories. These sources may incidentally contain people, properties or location context.
- Payment records: amounts, currency, fees, Stripe references, funding, refund, dispute and transfer status.
- Supplier and referral data: supplier business identity, catalogue details, quote or sample requests, project context, personal FrameFlow referral codes, referral attribution, eligibility and credit-reward records, disclosure acknowledgements and any manually verified supplier commission record.
- Consent and audit data: accepted policy versions, timestamps and material project events.
- Security and technical data: limited request, device and diagnostic information required to protect and operate the service.
- JARVIS conversation data: questions, selected language and the limited recent conversation context needed to answer questions about Spatialist services.
Please do not upload special-category data, government identifiers, building access codes or unrelated personal information unless specifically requested through a secure, lawful process.
3. Why we use data and our legal bases
3A. FrameFlow research and model training
Customer media is not shared-model training data by default. Spatialist does not use uploaded photographs, finished results, support files or Personal Model material to train or fine-tune a shared or general FrameFlow model unless the account holder makes a separate, specific opt-in choice. Buying credits, uploading files, requesting support or accepting these policies is not consent to shared-model training.
Personal Model training is account-specific. Where this feature is offered and a user deliberately starts training, Spatialist processes only the selected photographs, edits, labels and resulting model files to create, test and operate that user's account-specific model. Personal Model material remains segregated from shared-model development.
The Contributor Programme is a separate, deliberate path. A signed-in rights holder may create an application, organise work by property and separately upload source exposures and corresponding finished edits. Files remain in private quarantine until human rights and quality review. Only accepted pairs may enter shared-model research and training; rejected pairs remain outside training. Acceptance may produce promotional FrameFlow credits under the Contributor Agreement.
Copyright permission and data protection are different. A contributor licence cannot waive the rights of an identifiable person. Contributors must avoid unnecessary personal data and hold required client, property and privacy permissions. Spatialist records the applicable legal basis, honours valid rights requests, and assesses the effect of deletion or objection requests on retained files and model artifacts in light of technical feasibility and applicable law.
Public research is segregated from production. Spatialist may evaluate editing quality, dynamic-range handling, window preservation, alignment and artifact detection with properly documented third-party research datasets. Research images, targets and experimental weights are kept outside the commercial FrameFlow training pipeline. Only aggregate measurements and independently implemented engineering lessons may influence the product. We do not attempt to identify, contact or profile people incidentally visible in research images.
Current research sources
Each source remains subject to its own licence and published citation. Before adding another source, Spatialist must document provenance, permitted use, data categories and the applicable balancing or rights assessment.
If research material contains your personal data, or you believe a source was included unlawfully, you may request a review. Provide enough information to locate the relevant material without sending unnecessary identity documents.
4. Payments and Stripe
Stripe processes checkout, saved payment methods, automatic FrameFlow credit recharges, card authentication, professional onboarding, identity verification, fraud checks, connected-account balances and payouts. Card details are entered into Stripe-controlled interfaces and are not intended to pass through Spatialist servers. We retain Stripe customer and payment-method references, transaction identifiers and status so that we can operate credit purchases, optional automatic recharge, milestones, refunds, releases and disputes.
Stripe may process data outside the EEA under its applicable Data Processing Agreement, Data Transfers Addendum, Standard Contractual Clauses and other lawful safeguards.
5. Who receives data
We disclose only what is necessary to:
- the client and professional working on the same project;
- a supplier when a signed-in user deliberately requests a quote, sample or introduction;
- Stripe and its banking, identity and fraud-prevention partners;
- Google Drive or Dropbox when the user deliberately chooses or connects that provider for FrameFlow imports;
- Google, acting as the image-generation technology provider, only when a signed-in user expressly requests an optional FrameFlow AI Finish;
- OpenAI and n8n, acting as technology providers for JARVIS conversations under the applicable contractual and data-protection safeguards;
- hosting, private file storage, image-processing, security, email, support and professional advisers acting under appropriate obligations;
- tax, judicial, regulatory or law-enforcement bodies where legally required; and
- a successor in a properly safeguarded merger, financing or business transfer.
Spatialist does not sell personal data. It does not share project data for third-party behavioural advertising.
6. International transfers
Where data is accessed outside the EEA, we use an adequacy decision, the European Commission’s Standard Contractual Clauses, the EU–US Data Privacy Framework where valid and applicable, or another lawful safeguard. We assess supplementary measures where required and minimise the data transferred.
7. Retention
We delete or anonymise data when the relevant period ends unless a legal hold, unresolved dispute or statutory duty requires longer retention.
8. Your GDPR rights
Depending on the circumstances, you may request access, correction, deletion, restriction, portability or objection; withdraw consent without affecting earlier lawful processing; and object to direct marketing at any time. You may also complain to your local supervisory authority or to Romania’s ANSPDCP.
Send a request to ryan@spatialist.io. We may need proportionate identity verification. We normally respond within one month, with any lawful extension explained. Rights can be limited where data must be retained for tax, payment, fraud or legal-claim obligations.
9. Automated decisions
Spatialist does not currently make solely automated decisions that produce legal or similarly significant effects. Stripe and financial institutions may use automated fraud, sanctions and authentication systems under their own responsibilities. Where applicable law provides a right to human review, contact us and we will direct or assist the request.
10. Cookies and local storage
The site stores a theme preference on your device and may use strictly necessary security, authentication and payment technologies. These are required to provide a service you request. Google Analytics 4 is loaded only after you choose “Allow analytics”; advertising storage, signals and personalisation remain disabled. Your analytics choice is kept locally on your device and can be changed at any time through “Analytics preferences” in the footer.
11. Security and privacy by default
Measures are designed to include least-privilege access, server-side authorisation, encrypted transport, Stripe-hosted payment collection, data minimisation, separated payment identifiers, signed webhook verification, idempotent payment actions, audit trails, backups and incident procedures. No service can promise absolute security; controls must be reviewed as the platform, risks and law change.
Where a personal-data breach is likely to risk individuals’ rights, Spatialist will assess notification to the competent authority within the legally required period and notify affected people where the risk is high.
12. Children
Spatialist is intended for adults and business users. We do not knowingly offer accounts or payment services to anyone under 18.
13. Changes and launch readiness
Before public payment activation, Spatialist must complete and document its controller identity, processor register, records of processing, retention ownership, security response plan, lawful-transfer review, consumer flow and, where risk requires it, a data-protection impact assessment. This statement supports GDPR transparency but cannot by itself guarantee compliance in every EU jurisdiction.
