Privacy Policy

Last updated: October 26, 2025

At RoomsThatSell (“we,” “our,” or “us”), we are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our virtual staging platform and services.

RoomsThatSell is the data controller for personal information processed under this policy. Address: 11095 McKissick Road, Peyton, CO 80831. Privacy contact: privacy@roomsthatsell.com.

1. Information We Collect

1.1 Personal Information

• Account Information: Name, email address, phone number (optional), and billing information when you create an account
• Profile Information: User preferences and optional professional details you choose to provide
• Communication Data: Messages, support requests, and feedback you provide to us

1.2 Property Images and Data

• Property Images: Photos of rooms and properties you upload for virtual staging
• Staged Images: AI-generated staged versions of your property images
• Project Data: Property details, room types, style preferences, and staging specifications
• Usage Data: Information about how you use our platform, including features accessed and processing history

1.3 Technical Information

• Device Information: IP address, browser type, operating system, and device identifiers
• Usage Analytics: Pages visited, time spent on platform, interaction patterns, and feature usage tracked through PostHog
• Session Recordings: When using the dashboard (not marketing pages), PostHog captures user interactions including clicks, scrolls, and navigation patterns to help us improve user experience and identify issues. Session recordings are retained for up to 90 days, subject to our PostHog plan terms
• Cookies and Tracking: We use cookies and similar technologies to enhance your experience (see Section 1.4 below)

1.4 Cookies and Tracking Technologies

We use cookies and similar tracking technologies to provide and improve our services:

• Essential Cookies: Required for authentication (Clerk), security, and basic platform functionality
• Analytics Cookies: PostHog cookies to track usage patterns, page views, and user behavior on both marketing pages and the dashboard
• Performance Cookies: Session recordings (dashboard only) to understand how users interact with our platform for UX improvement
• Third-Party Cookies: Stripe payment processing, Clerk authentication, and PostHog analytics
• Managing Cookies: You can manage or disable cookies through your browser settings; however, disabling essential cookies may impact platform functionality and prevent you from accessing certain features
• Opt-Out: To opt out of analytics tracking and session recordings, you can use browser privacy settings or contact us at support@roomsthatsell.com
• PostHog Privacy: For more information about PostHog's data practices, visit PostHog Privacy Policy

EEA/UK users: Where required, we obtain your consent before placing non-essential cookies (e.g., analytics). You can withdraw consent at any time via your browser or in-product controls (where available).

Do Not Track: Our Services do not currently respond to “Do Not Track” signals. We honor GPC opt-out signals where required by law (see Section 10.6).

2. How We Use Your Information

2.1 Service Provision

• Process and stage your property images using AI technology
• Provide access to our virtual staging platform and tools
• Manage your account, billing, and subscription services

2.2 Communication and Support

• Respond to your inquiries and provide customer support
• Send important updates about your account or our services
• Share product updates, new features, and educational content

2.3 Platform Improvement

• Analyze usage patterns to improve our platform and services
• Develop new features and enhance existing functionality
• Ensure platform security and prevent fraud
• Important: Your property images are NOT used to train AI models or improve our AI technology (see Section 4.1 for details)

2.4 AI Processing

Our platform uses Google Gemini AI to process your property images and generate staged versions with automated furniture placement, style application, color selection, and décor additions based on carefully crafted prompts. These AI-generated outputs are provided for your review only - we do not automatically publish, share, or use staged images on your behalf. You maintain complete control over whether and how to use any AI-generated content. We strongly recommend thorough review of all staged images before use in professional real estate marketing or MLS listings.

3. Information Storage and Security

3.1 Secure Cloud Storage

Your property images and staged outputs are stored using Cloudflare R2. We use encryption in transit and at rest and apply access controls designed to protect your data.

3.2 Data Retention

• Property Images (Original & Staged): Retained while your account is active plus 30 days after account deletion or termination for backup and recovery purposes. After 30 days, images are permanently deleted from Cloudflare R2 storage
• Account & Profile Data: Retained while your account is active plus 30 days after deletion for account recovery purposes
• Financial & Billing Data: Retained for 7 years after your last transaction for tax compliance, legal requirements, and financial record-keeping (includes invoices, payment records, and Stripe transaction data)
• Usage Analytics: Aggregated and anonymized usage data may be retained indefinitely for platform improvement and business intelligence
• Immediate Deletion: You may request immediate deletion of your images and account data by emailing privacy@roomsthatsell.com, subject to legal retention requirements for financial data

3.3 Security Measures

• Optional phone verification for enhanced account security
• Regular security audits and vulnerability assessments
• Access controls and data protection practices
• Incident response procedures for any security breaches
• Encryption of data both in transit (HTTPS/TLS) and at rest
• Signed URLs with expiration for secure image access

3.4 Data Breach Notification

In the event of a data breach involving personal information, we will notify affected users without undue delay and, where legally required, within applicable statutory timeframes.

• Notifications will describe the nature of the incident, the data involved, steps we have taken, and recommended actions
• We will report to authorities where required by law
• For security concerns, contact security@roomsthatsell.com

4. Information Sharing and Disclosure

4.1 Third-Party Service Providers

We work with trusted third-party providers to deliver our services. These providers are located in the United States and/or European Union and process data on our behalf:

• Convex (US-based): Database and backend services for account management, project data, and platform functionality
• Clerk (US-based): Authentication and user management services for secure login and account access
• Cloudflare R2 (Distributed globally): Secure cloud storage for your original and staged images with encryption at rest
• Google Gemini (US-based): AI processing for virtual staging generation. Important: Your images are processed ephemerally and are NOT retained by Google or used to train AI models. Images are sent to the AI service, staged output is generated, and images are not stored by Google beyond the processing session
• Stripe (US-based): Payment processing and billing management for subscriptions and transactions
• Vercel (US-based): Hosting and content delivery services for platform availability and performance
• PostHog (US/EU-based): Usage analytics and session recordings for product improvement and user experience optimization

AI Training Data Policy: We do not use your property images to train our AI models or build proprietary AI technology. Your images are processed by Google Gemini solely to generate your staged outputs and are not retained by Google or RoomsThatSell for training purposes. You retain all rights to your original and staged images. We do not sell or share your images with third parties for any purpose other than the services described above.

4.2 Legal Requirements

We may disclose your information when required by law, court order, or to:

• Comply with legal obligations or government requests
• Protect our rights, property, or safety
• Prevent fraud or illegal activities
• Respond to legal proceedings

4.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of the transaction, with appropriate safeguards to maintain privacy protection.

5. Your Rights and Choices

5.1 Access and Control

• Account Access: View and update your account information at any time through your account settings
• Data Export: Request a copy of your data in a portable format by emailing privacy@roomsthatsell.com
• Data Deletion: Request deletion of your account and associated data through account settings or by emailing privacy@roomsthatsell.com
• Marketing Communications Opt-Out: Unsubscribe from marketing emails using the link at the bottom of any marketing email, manage preferences in your account settings, or email support@roomsthatsell.com. Opt-out requests are processed within 10 business days. Note: Essential service emails (billing notifications, security alerts, account changes) cannot be opted out while your account is active

5.2 Image Rights

You retain all rights to your original property images. Staged images generated by our AI are provided to you for your professional and personal use. If using staged images in MLS listings or real estate marketing, you are responsible for ensuring compliance with applicable MLS and advertising regulations. We are not responsible for how staged images are used after they are downloaded from our platform, but we strongly recommend verification for MLS compliance before publication.

6. MLS Compliance and Professional Use

Our platform is designed to help real estate professionals meet MLS compliance requirements:

• Automatic watermarking of staged images with “Virtually Staged” disclosure
• AI prompting designed to modify only furniture and décor, not structural elements
• Dual export capabilities providing both original and watermarked staged images
• Images resized to MLS-standard dimensions

While we provide these compliance tools, you are solely responsible for verifying that your use of staged images complies with your specific MLS board requirements and local regulations.

7. Children's Privacy

Our services are intended exclusively for business and professional use by adults. We are committed to complying with the Children's Online Privacy Protection Act (COPPA):

• You must be at least 18 years of age to create an account or use our services
• We do not knowingly collect personal information from individuals under 18 years of age
• Our services are not designed for or directed at children
• If you are a parent or guardian and discover that your child under 18 has created an account, please contact us immediately at privacy@roomsthatsell.com and we will promptly delete the account and all associated data
• If we become aware that we have inadvertently collected information from a child under 18, we will take immediate steps to delete such information
• RoomsThatSell is not liable for unauthorized account creation by individuals under 18 who misrepresent their age

8. International Data Transfers

Your information may be transferred to and processed in countries other than your own, primarily the United States. When we transfer personal data internationally, we implement appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission and comparable mechanisms under UK law, as applicable. Our service providers are contractually bound to protect personal data consistent with this policy and applicable law.

9. GDPR Compliance (European Economic Area Users)

If you are located in the European Economic Area (EEA), you have specific rights under the General Data Protection Regulation (GDPR):

9.1 Lawful Basis for Processing

We process your personal data based on the following lawful grounds:

• Contract Performance: Processing necessary to provide our virtual staging services to you
• Legitimate Interest: Platform improvement, security, fraud prevention, and analytics
• Consent: Marketing communications and optional features (where you have provided consent)
• Legal Obligation: Compliance with tax laws, financial regulations, and legal requirements

9.2 Your GDPR Rights

Under GDPR, you have the following rights:

• Right to Access: Request a copy of all personal data we hold about you
• Right to Rectification: Correct any inaccurate or incomplete personal data
• Right to Erasure (“Right to be Forgotten”): Request deletion of your personal data, subject to legal retention requirements
• Right to Restrict Processing: Request that we limit how we use your data in certain circumstances
• Right to Data Portability: Receive your data in a structured, machine-readable format and transmit it to another service
• Right to Object: Object to processing based on legitimate interests or for direct marketing purposes
• Right to Withdraw Consent: Withdraw consent at any time for processing based on consent (does not affect prior processing)
• Right to Lodge a Complaint: File a complaint with your local data protection supervisory authority if you believe your rights have been violated

9.3 Data Retention Under GDPR

• Property images: 30 days after account deletion
• Account data: 30 days after account deletion
• Financial records: 7 years for tax and legal compliance
• Marketing data: Until consent is withdrawn or account deleted

9.4 Exercising Your GDPR Rights

To exercise any of your GDPR rights, please email privacy@roomsthatsell.com with your request. We will respond within 30 days. To protect your privacy, we may need to verify your identity before processing your request. For EEA/UK business customers, a Data Processing Addendum (DPA) with SCCs is available upon request at privacy@roomsthatsell.com.

10. CCPA Compliance (California Residents)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA):

10.1 Categories of Personal Information Collected

We collect the following categories of personal information:

• Identifiers (name, email, phone number (optional), IP address)
• Commercial information (payment details, subscription data)
• Internet activity (usage data, analytics)
• Visual information (property images you upload)

10.2 We Do Not Sell or Share Your Personal Information

RoomsThatSell does not “sell” or “share” (as defined by the CPRA) your personal information. We only disclose limited data to service providers under contracts that restrict their use. If our practices change, we will provide a “Do Not Sell or Share My Personal Information” mechanism and honor applicable opt-out signals, including Global Privacy Control (GPC).

10.3 Your CCPA Rights

As a California resident, you have the following rights:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you
• Right to Know About Information Sharing: Request information about whether your personal information is sold or shared, and to whom
• Right to Delete: Request deletion of your personal information, subject to certain exceptions
• Right to Opt-Out of Sale: While we do not sell your information, you have the right to opt out if our practices change
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights

10.4 Exercising Your CCPA Rights

To exercise your CCPA rights, please email privacy@roomsthatsell.com with your request. We will respond within 45 days. We may need to verify your identity before processing your request to protect your personal information.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by email or through our platform, and by updating the “Last updated” date. Your continued use of our services after such changes constitutes acceptance of the updated policy.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

We are committed to addressing your privacy concerns promptly and transparently. For GDPR requests, we will respond within 30 days. For CCPA requests, we will respond within 45 days.