We use necessary technologies to run and secure ResiSuite. Optional functional, analytics and marketing technologies stay off unless you choose them. Cookie Policy
How ResiSuite collects, uses, shares and protects personal data.
This Privacy Policy explains how ResiSuite handles personal data. It is intended to provide information required under the EU General Data Protection Regulation (“GDPR” or “RODO”) and to reflect relevant Australian privacy principles where applicable.
1. Controller
The controller of personal data processed for ResiSuite’s own purposes is:
Maksymilian Mielczarek, an individual based in Poland, trading as ResiSuite
For some Customer Content, a business customer may determine why and how personal data is processed. In that case, the customer may be the controller and ResiSuite may act as processor under the Data Processing Addendum.
2. Data we collect
Depending on how the service is used, we may process:
Account and identity data
name;
email address;
profile image;
authentication provider and identifiers;
account and workspace membership;
user roles and permissions.
Project and content data
listing and project names;
property addresses and information entered by users;
photographs and media;
generated videos, edited images and descriptions;
agency branding, logos and instructions;
metadata associated with uploaded or generated files.
Customer Content may incidentally contain people, number plates, documents, family photographs or other personal information. Customers are responsible for submitting such material lawfully.
Billing data
plan, subscription and payment status;
billing name, business name, address, country and tax information;
transaction identifiers and limited payment metadata.
If checkout identifies Stripe as the payment provider, Stripe will process payment-card details. ResiSuite will not need to store full card numbers.
Technical and security data
IP address;
browser, device and operating-system information;
session and authentication data;
timestamps;
security, audit and activity logs;
fraud-prevention and CAPTCHA information;
diagnostic and error data.
Communications and preferences
support requests;
feedback and survey responses;
transactional email records;
marketing preferences;
cookie and consent records.
3. Purposes and legal bases
We process personal data for:
Providing the service
Purposes include account creation, authentication, workspaces, storage, content generation, support, subscriptions and billing.
Legal basis: performance of a contract or steps requested before entering a contract.
Security and legitimate operation
Purposes include preventing fraud and abuse, enforcing limits and policies, maintaining reliability, debugging, protecting legal rights and managing disputes.
Legal basis: legitimate interests in operating and protecting ResiSuite, users and third parties.
Legal and financial compliance
Purposes include tax, accounting and payment records, responding to valid legal requests and complying with applicable law.
Legal basis: legal obligation and, where appropriate, legitimate interests.
Marketing
Purposes include product news, tips, offers and promotional messages where the user has opted in or another lawful basis applies.
Legal basis: consent where required. Marketing consent is optional and may be withdrawn at any time.
Optional analytics and advertising
Non-essential analytics, measurement or advertising technologies will be activated only after appropriate notice and consent where required.
Legal basis: consent where required.
4. AI and automated processing
When the relevant features are activated, ResiSuite may use automated and AI-assisted tools to process user instructions and Customer Content and to create or modify videos, images and text.
The service does not make decisions producing legal or similarly significant effects about users solely through automated processing.
Users must review generated output before publication. Customer Content is not used to train general-purpose AI models unless this is clearly disclosed and lawfully authorised.
5. Sharing and service providers
We may share data with providers that help operate ResiSuite, including providers of:
authentication, databases and file storage;
website and application hosting;
security, DNS, CAPTCHA and email routing;
transactional email;
payment processing;
login services;
AI, image, video and media processing when activated;
diagnostics, error monitoring and analytics when activated;
professional advice and legal compliance.
Current providers are listed on the Subprocessor List.
We may also disclose data to authorised workspace members, where required by law, to protect rights and security, or in connection with a business or legal-structure transfer subject to appropriate safeguards.
We do not sell personal data for money.
6. International processing
ResiSuite’s architecture targets the Sydney, Australia region for its primary Supabase project. The live project region must be confirmed in the hosted Supabase configuration before production publication. ResiSuite is operated from Poland.
Data may be accessed or processed in Australia, Poland, the European Economic Area, the United States and other countries in which service providers operate.
Where required for transfers from the EEA, we rely on lawful mechanisms such as adequacy decisions, standard contractual clauses or other permitted safeguards.
Australian users should understand that overseas recipients may be subject to different privacy laws. The Subprocessor List identifies locations where reasonably available.
7. Retention
Unless a different period is required or communicated:
active account and project data: while the account or project remains active;
deleted project content: removed from active systems within a reasonable operational period;
content after a paid subscription ends: may remain available in a limited account for up to 90 days, then may be deleted;
deleted account data: deleted or anonymised from active systems generally within 30 days;
backups: retained until overwritten or expired under backup cycles;
security and audit logs: generally up to 12 months, longer where required for an investigation;
support correspondence: generally up to 24 months after resolution;
consent records: for as long as needed to demonstrate consent and withdrawal;
billing, transaction and tax records: for the period required by applicable law;
data needed for legal claims: until the relevant limitation period expires.
Residual copies may remain temporarily in backups or logs and will not be restored except for disaster recovery, security or legal purposes.
8. User rights
Depending on applicable law, users may have rights to:
EEA users may complain to the competent supervisory authority. In Poland, this is the President of the Personal Data Protection Office (UODO).
Australian users may contact us with a privacy complaint. We will investigate and respond within a reasonable time. Where applicable, users may also contact the Office of the Australian Information Commissioner.
We may verify identity before responding. Some rights are subject to legal exceptions.
9. Customer responsibilities
Business customers are responsible for:
having a lawful basis for Customer Content;
providing required privacy notices;
handling privacy requests where they act as controller;
configuring workspace access appropriately;
avoiding unnecessary personal or sensitive data in photographs and listings.
10. Children
ResiSuite is not intended for anyone under 18 years old. We do not knowingly create accounts for children.
11. Security
We use technical and organisational measures intended to protect data, including access controls, authentication, private storage controls, encrypted transport, monitoring and service-provider safeguards.
No online system is completely secure. Users must protect account credentials and report suspected incidents promptly.
12. Cookies and local storage
Information about cookies and similar technologies is provided in the Cookie Policy. Non-essential analytics and advertising technologies will not be activated before required consent.
13. Marketing communications
Users may opt in to marketing separately from accepting the Terms. Marketing messages will include an unsubscribe method. Transactional, account, security and billing messages may still be sent where necessary.
14. Changes
We may update this Privacy Policy. Material changes will normally be communicated in advance where appropriate. The effective date at the top indicates the current version.
