Privacy policy
Last updated: 2026-11-07
This policy explains what personal data HomeStaged processes, why, on what legal basis, and what rights you have. It follows Regulation (EU) 2016/679 (GDPR) and Spain's Organic Law 3/2018 (LOPDGDD).
The short version: there is no sign-up, we do not keep your photos or the generated images, and the only things we store are an anonymous identifier in your browser, your credit balance and, if you buy, the email address and order number the payment platform sends us.
1. Data controller
- Controller: Guillermo Julián Gallego González
- Tax ID (NIF): 77236594H
- Address: República Argentina, 5, El Limonar, Málaga (España)
- Email: guillermojulian.gallegogonzalez@gmail.com
No data protection officer has been appointed, as the conditions of Article 37 GDPR do not apply.
2. What data we process and where it comes from
| Data | Source | Where it is stored |
|---|---|---|
Anonymous visitor identifier (hs_uid cookie, a random UUID) |
Generated by the Site on your first visit | Your browser and our database (Upstash) |
Language preference (hs_lang cookie) |
Chosen by you or inferred from your browser language | Your browser |
| Credit balance, free-use flag, creation and update timestamps | Generated by the Site when you use the tool or buy | Our database (Upstash) |
| Purchase email address and order numbers | Sent to us by Lemon Squeezy when you complete a payment | Our database (Upstash) |
| Order number and email you type into the credit recovery form | You | Used for the check and linked to your identifier |
| IP address | Your connection | Temporary counters to limit free use (24 hours at most) and the hosting provider's technical logs (Vercel) |
| Photos you upload and the generated images | You | Not stored. They are processed in memory and sent to the AI model provider to produce the result; the result is returned to your browser and discarded |
| Aggregated usage data (page views, country, device type) | Vercel Analytics, without cookies or persistent identifiers | Vercel |
We do not process special categories of data. Please do not upload photos showing people; the tool is designed for empty or furnished rooms, not portraits.
3. Purposes and legal bases
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Providing the service: recognising your browser, keeping your credit balance, generating the images you request | Performance of a contract (Art. 6(1)(b)) |
| Assigning purchased credits to your identifier and letting you recover them on another device | Performance of a contract (Art. 6(1)(b)) |
| Limiting free use and preventing abuse and fraud (counters per identifier and per IP) | Legitimate interest in protecting the service (Art. 6(1)(f)) |
| Handling support requests, refunds and data subject rights | Performance of a contract and legal obligation (Art. 6(1)(b) and (c)) |
| Keeping transaction records for tax purposes and for the defence of claims | Legal obligation and legitimate interest (Art. 6(1)(c) and (f)) |
| Measuring aggregated Site usage with Vercel Analytics (no cookies) | Legitimate interest in improving the service (Art. 6(1)(f)). The data cannot identify you |
We make no automated decisions with legal effects and build no profiles. We send no marketing emails.
4. Recipients and processors
We rely on the following providers, acting as processors or, in the case of Lemon Squeezy, as an independent controller for the sale:
| Provider | Role | Data it receives | Location and safeguards |
|---|---|---|---|
| Vercel Inc. | Hosting of the website and API; technical logs; cookieless analytics | IP address, request headers, images in transit | United States and European Union. Standard Contractual Clauses. Policy: https://vercel.com/legal/privacy-policy |
| Google (Google LLC / Google Ireland Limited) | Provider of the AI model (Gemini API) that generates the image | The photo you upload and the generation instruction. We do not send your identifier or email | United States and other countries. Under the Gemini API terms for paid services, Google does not use submitted content to train its models. Terms: https://ai.google.dev/gemini-api/terms |
| Lemon Squeezy, LLC | Merchant of record: processes payment, issues the invoice, remits taxes and handles refunds | The data you enter in its checkout (name, email, billing address, payment details). We never see your card details | United States. Independent controller for the sale. Policy: https://www.lemonsqueezy.com/privacy |
| Upstash, Inc. | Database (Redis) where we store identifier, credits, email and orders | Identifier, balance, purchase email, order numbers, counters | United States and European Union depending on the region selected. Standard Contractual Clauses. Website: https://upstash.com |
We do not sell or share data with third parties for advertising. We may disclose data to public authorities where the law requires it.
5. International transfers
Some providers are established in the United States. Transfers rely on the Standard Contractual Clauses approved by the European Commission and, where the provider is certified, on the EU-US Data Privacy Framework. You can ask for more information about these safeguards at guillermojulian.gallegogonzalez@gmail.com.
6. Retention periods
| Data | Period |
|---|---|
| Photos and generated images | Not retained. Discarded when the request completes |
| Free-use counters per IP | 24 hours at most |
hs_uid identifier, credit balance and purchase email |
While you have credits or have used the service in the last 24 months. Then deleted |
| Order numbers and purchase-related data | The period required by tax and consumer law (generally 4 years from the transaction, up to 6 under commercial law) |
| Hosting technical logs | Whatever period Vercel applies to its logs (days) |
| Aggregated analytics | Contains no identifying data; kept as statistics |
7. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction and portability at any time by writing to guillermojulian.gallegogonzalez@gmail.com and stating which right you are exercising. To locate your data we will need your order number or your hs_uid identifier (visible on the credit recovery page). We reply within one month.
If you delete the hs_uid cookie without saving your order number, you lose access to the credit balance linked to it. You can recover it at https://homestaged.app/en/recuperar with the order number and purchase email.
If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Authority (AEPD), C/ Jorge Juan 6, 28001 Madrid, https://www.aepd.es, or with the supervisory authority of your country of residence.
8. Security
All communication with the Site is encrypted (HTTPS). The hs_uid cookie is flagged HttpOnly and SameSite=Lax, so third-party scripts cannot read it. Database access is protected by credentials that are not shared. Photos are never written to disk at any point in the process.
9. Minors
The service is intended for people aged 18 or over. We do not knowingly process data of children under 14.
10. Changes to this policy
Changes are published on this page with the update date in the header. If a change affects purposes or legal bases, we will flag it prominently on the Site.