Privacy Policy
Privacy Policy
Last Updated: May 1, 2026
1. Data Controller
Controller: Rajko Stijakovic d/b/a StageSpace
Address: Vara de Rey 15, 07800 Ibiza, Spain
Email: [email protected]
StageSpace respects your privacy. This Privacy Policy explains how we collect, use, store, and protect personal data when you visit our website, contact us, create an account, use the StageSpace app, upload product images, generate visuals, or subscribe to a paid plan.
3. Personal Data We Collect
We may collect the following categories of data:
Account data:
Name, email address, login method, account ID, profile settings, plan type, billing status, and user preferences.
Contact and sales data:
Name, email address, company name, phone number if provided, message content, demo requests, support requests, and communication history.
Product and generation data:
Product photos, reference images, prompts, scene descriptions, style preferences, uploaded brand assets, generated images, generation history, image metadata, workflow settings, quality mode, resolution, and related technical logs.
Billing data:
Subscription plan, billing cycle, checkout status, invoices, payment status, Stripe customer ID, subscription ID, transaction references, credits purchased, credits used, and refund or cancellation status. We do not store full card numbers. Payment details are processed by Stripe.
Technical and security data:
IP address, device and browser information, operating system, pages visited, timestamps, session data, authentication events, server logs, error logs, Firebase App Check or reCAPTCHA signals, and security/debugging information.
Cookie and analytics data:
Cookie identifiers, consent choices, UTM parameters, referral source, page views, interactions, and analytics events, where allowed by your cookie consent.
4. Data You Should Not Upload
StageSpace is designed for product visualization. You should only upload product photos, brand assets, reference images, and other materials that you have the right to use.
Do not upload sensitive personal data, private documents, payment cards, government IDs, health data, biometric data, images of children, or personal images of people unless you have a lawful basis and written permission to do so.
If you use StageSpace on behalf of a company, you confirm that you are authorised to upload the materials and data you provide.
5. Why We Use Personal Data And Legal Bases
We process personal data for the following purposes:
To provide the StageSpace service:
We use account data, uploaded images, prompts, generated outputs, generation history, and technical data to create and save visual outputs, restore sessions, manage projects, and provide the app experience.
Legal basis: performance of a contract or steps before entering a contract.
To process AI generations:
We send uploaded images, prompts, scene instructions, and related metadata to our AI processing providers to generate or refine images.
Legal basis: performance of a contract.
To manage accounts and authentication:
We use account data, login events, and security data to register users, authenticate access, protect accounts, and prevent abuse.
Legal basis: performance of a contract and legitimate interests in service security.
To manage billing, subscriptions, credits, and invoices:
We use billing and usage data to process subscriptions, credit packs, checkout sessions, invoices, refunds, subscription changes, and billing support.
Legal basis: performance of a contract and legal obligations for accounting and tax records.
To respond to contact, demo, and support requests:
We use contact details and message content to reply to you, provide support, and manage business communication.
Legal basis: legitimate interests or steps before entering a contract.
To improve and secure StageSpace:
We use usage data, error logs, diagnostics, and aggregated analytics to fix bugs, improve product reliability, prevent abuse, detect fraud, and understand how the service performs.
Legal basis: legitimate interests.
To send product and marketing emails:
We may send updates, product news, launch information, offers, or educational content if you subscribed or if otherwise permitted by law.
Legal basis: consent or legitimate interests where allowed. You can unsubscribe at any time.
To comply with legal obligations:
We may process data where required for tax, accounting, legal claims, fraud prevention, regulatory obligations, or lawful requests.
Legal basis: legal obligation or legitimate interests.
6. AI Processing And Generated Content
StageSpace uses AI systems to generate and edit images from your uploaded product photos, prompts, reference images, and scene instructions.
We use this data only to provide, secure, support, and improve the StageSpace service. We do not sell your uploaded product assets. We do not use your private uploaded product images or generated outputs to train public models unless we ask for and receive your explicit permission.
Generated visuals may be synthetic or AI-assisted. You are responsible for using generated outputs lawfully, including any disclosure, labelling, advertising, intellectual property, or platform rules that apply to your use case.
StageSpace does not use automated decision-making that produces legal or similarly significant effects about you.
7. Service Providers And Recipients
We use trusted service providers to operate StageSpace. Depending on the feature, these may include:
Framer:
Website hosting and website builder services.
Google Firebase and Google Cloud:
Authentication, database, cloud functions, file storage, security, App Check, hosting, and backend infrastructure.
Google Gemini / Vertex AI:
AI processing for product image generation, editing, analysis, and related visual workflows.
Stripe:
Checkout, subscriptions, invoices, payment processing, billing portal, fraud prevention, and payment records.
MailerLite or email service provider:
Email list management, product updates, transactional or marketing emails, and contact forms.
CookieYes or consent management provider:
Cookie banner, consent preferences, and consent logs.
Google Analytics 4:
Website analytics and usage measurement, only where enabled and only after consent where required.
Sentry:
Error monitoring, performance diagnostics, and crash reporting, where enabled.
We may also disclose data if required by law, to protect rights and safety, to prevent fraud or abuse, or in connection with a business transfer such as a merger, acquisition, or sale of assets.
8. International Data Transfers
Some providers may process data outside the European Economic Area. Where this happens, we rely on appropriate safeguards such as European Commission Standard Contractual Clauses, adequacy decisions, data processing agreements, and additional technical and organisational measures where required.
9. Data Retention
We keep personal data only for as long as needed for the purposes described in this policy.
Account data:
Kept while your account is active and for a reasonable period after deletion where needed for security, legal, billing, or backup purposes.
Uploaded product images and generated outputs:
Kept while your account or generation history is active, unless you delete them or request deletion. Some copies may remain in backups for a limited period.
Billing and invoice data:
Kept for the period required by tax, accounting, payment, and legal obligations.
Contact and support messages:
Kept as long as needed to handle the request and maintain business records.
Marketing data:
Kept until you unsubscribe or ask us to delete it.
Technical logs and security records:
Typically kept for up to 12 months unless needed longer for security, fraud prevention, debugging, or legal reasons.
10. Your Rights
Under GDPR, you may have the right to:
Access your personal data.
Correct inaccurate or incomplete data.
Delete your personal data.
Restrict processing.
Object to processing based on legitimate interests.
Receive a copy of your data in a portable format.
Withdraw consent at any time.
Object to direct marketing.
Lodge a complaint with a supervisory authority.
To exercise your rights, email [email protected]. We may need to verify your identity before responding. We normally respond within one month.
If you are in Spain or the EU, you can also complain to the Agencia Española de Protección de Datos: https://www.aepd.es
11. Cookies And Similar Technologies
We use cookies and similar technologies to operate the website, remember preferences, measure performance, and, where enabled, understand marketing attribution.
Strictly necessary cookies:
These are required for the website or app to function and do not require consent.
Analytics and marketing cookies:
These are used only after you give consent where required. You can accept, reject, or configure cookies from the cookie banner. Accept and Reject options should be presented at the same level and with the same visibility.
You can change your cookie choice at any time through the cookie settings link on the website or through your browser settings.
If Google Analytics, advertising pixels, or other non-essential cookies are enabled, they must remain blocked until consent is given.
12. Security
We use technical and organisational measures designed to protect personal data, including encryption in transit, access controls, authentication, least-privilege access, security rules, monitoring, vendor reviews, and restricted access to production systems.
No online service is completely secure, but we work to protect your data and reduce risk.
13. Children
StageSpace is a business product and is not directed to children. In Spain, children under 14 cannot provide valid consent for online services without parental authorisation. If we learn that we collected personal data from a child without proper authorisation, we will delete it.
14. Business Customers And Customer Data
If you use StageSpace on behalf of a business, you are responsible for making sure you have the right to provide any data, images, or assets uploaded to the service.
If your company needs a data processing agreement for a specific business use case, contact [email protected].
15. Links To Other Website
Our website or app may link to third-party websites, services, or social media pages. Their privacy practices are controlled by their own policies. We are not responsible for third-party websites or services.
16. Changes To This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will update the “Last updated” date and, where appropriate, notify users by email or through the website or app.
17. Contact
For privacy questions, requests, or complaints, contact:
Rajko Stijakovic d/b/a StageSpace
Vara de Rey 15, 07800 Ibiza, Spain
