← Back to the service

Privacy policy

Version 2026-10-v1 · Last updated 19 October 2026 · Deutsche Fassung

[Lawyer: confirm that the German version prevails and that this clause is valid. For German-speaking users the German version is the main text.]

This policy explains what personal data we process when you use our service that shows a house on your own photo, and why. We keep it short and specific. If a point is unclear, write to us.

1. Who is responsible

Markus Schmidt IT Beratung
Hackstraße 82, 70190 Stuttgart, Germany
Email: bms166@gmx.net

2. Overview: what we process, why, and for how long

DataPurposeLegal basis (GDPR)Kept for
The photo you upload (after your browser has shrunk it and removed metadata) Create the image you asked for Contract, Art. 6(1)(b), and your consent, Art. 6(1)(a) Not stored by us. It exists only in memory while it is processed and sent to Google (see section 3).
The generated image Show it to you and let you download it Contract, Art. 6(1)(b) Deleted automatically after 24 hours, or immediately when you press “Delete now”.
Order data: package, amount, order time, payment time, transaction hash, wallet address the payment came from, exchange rate on the day, country derived from your IP address Match your payment to your order, deliver the credits, accounting and tax, proof of where the customer is located for VAT Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c) Paid orders: for the statutory retention period, which is 8 years counted from the end of the calendar year of the payment [confirm with tax adviser]. Orders that still have unused credits are kept as long as the credits exist. Unpaid orders that expire are deleted after 7 days.
Payments we cannot match (amount, transaction hash, sending wallet address) Find your payment when you contact us, and refund it where appropriate Legitimate interest, Art. 6(1)(f), in resolving payment problems 12 months after receipt, then deleted automatically.
Consent record: time and version of the consent text you accepted Prove that you consented Legal obligation to demonstrate consent, Art. 7(1) and Art. 6(1)(c) As long as the related order data.
Access code and credit balance. We store only a one-way hash of the code, not the code itself. Give you access to your credits Contract, Art. 6(1)(b) While you have credits. It is deleted together with the order data above once the credits are used up and the retention period has ended.
Connection data such as your IP address and browser information, handled by Cloudflare Deliver the site, keep it secure, block bots and abuse Legitimate interest, Art. 6(1)(f) We do not store IP addresses in our database. Cloudflare keeps its own technical logs for a limited time under its own terms.
Sign-up for free credits: email address, language, time and version of your consent to the terms and privacy policy, country derived from your IP address (not the address itself), and the campaign name from the link you came from, if there is one Send you the confirmation link, create your free credits and access code, send you the access code, prevent repeated sign-ups and abuse (for this we keep a one-way hash of your email address), and see which channels bring visitors Contract, Art. 6(1)(b); legitimate interest in preventing abuse and in measuring which channels work, Art. 6(1)(f) Unconfirmed sign-ups: 7 days. Email address: until 30 days after your free credits expire (120 days after confirmation). The sign-up record (hash, consent record, country, source) is deleted 365 days after confirmation. The credit grant is deleted 30 days after the free credits expire. [confirm periods]
Emails you send us Answer you Contract, Art. 6(1)(b), or legitimate interest, Art. 6(1)(f) Deleted 12 months after the matter is closed, unless tax or commercial law requires us to keep them longer.
Data in your own browser: your access code and an open payment request So you do not lose your credits when you reload the page Strictly necessary for the service you requested, section 25(2) no. 2 TDDDG Until you clear your browser data. A payment request is removed when it expires.

3. Your photo and AI processing

When you create an image, this happens:

  1. Your browser shrinks the photo and saves it again as a JPEG. This removes location data (GPS) and other hidden metadata before anything leaves your device.
  2. The photo is sent to our server and passed on to Google’s Gemini service, which creates the image. Together with the photo we pass on a simple placement sketch (coloured boxes showing where a building should stand) and the building dimensions and image settings you chose. We keep the original photo in memory only for this purpose and do not write it to any storage.
  3. The generated image is stored for up to 24 hours so that you can view and download it. You can delete it at any time.

Please do not upload photos that show identifiable people, license plates, or other personal data of third parties. If a photo does show such data, you are responsible for having the right to use it.

Google acts as our processor for this step [verify before publishing: use the paid Gemini API or Vertex AI with a data processing agreement, and confirm in Google’s current terms whether prompts and images are retained for abuse monitoring and for how long, and that they are not used to train models. Then state the result here in one sentence.]

No decision that has legal or similarly significant effects on you is made by automated means. The generated image is an illustration only.

4. Payments and the blockchain

You pay in USDC on the Base network, sent directly from your wallet to our wallet. We do not run your wallet, we never have access to your private keys, and we do not ask for your name to accept a payment.

Blockchain transactions are public and permanent. Your wallet address, the amount and the time of your payment are visible to anyone on the blockchain. We cannot change or delete them, and this is outside our control. To read new payments, we use a blockchain data provider ([name of your RPC provider]). It sees our wallet address and the public payments made to it.

We do not carry out identity checks on customers. We can link a payment to you only through the order you created and, if you contact us, through the transaction hash you tell us.

5. Who receives data

We do not sell your personal data and we do not use it for advertising or profiling. We do not use analytics or advertising cookies.

6. Transfers outside the EU

Cloudflare and Google are based in the United States. Where data is transferred there, we rely on [confirm for each provider: EU-US Data Privacy Framework certification and/or Standard Contractual Clauses]. You can ask us for a copy of the safeguards.

7. Security and bot protection

We use Cloudflare Turnstile before you can place an order or sign up for free credits. Turnstile checks that you are not an automated program and may read information from your browser for this purpose. It is used only for security, not for advertising. Generated images are stored in EU storage, connections are encrypted, and the private key of our wallet is never stored on the web server.

8. Your rights

Under the GDPR you have the right to:

To use these rights, write to bms166@gmx.net. Please include your transaction hash so that we can find your order, since we do not know who you are otherwise. We may ask you to show that the payment came from your wallet.

You also have the right to complain to a data protection authority, for example the one where you live or the one responsible for us: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

If you live outside the EU (for example in the United Kingdom, Brazil or California), you may have similar rights under local law. Write to us and we will handle your request in the same way.

9. Children

The service is meant for adults. Please do not use it if you are under 18.

10. Changes

If we change how we process data, we will update this page and its version number. The version of the consent text you accepted is stored with your order.

11. Spokes Dojo (wheel preview)

[Lawyer: please review this section before publication.]

If you use the wheel preview Spokes Dojo instead of the house tool, the following applies in addition to the sections above:

12. CabinDojo (comparison pages)

[Lawyer: please review this section before publication.]

If you only browse cabindojo.com (houses, accessories, pools) without using the house or wheel tools, the following applies in addition to the sections above: