Privacy policy

Draft for review — replace bracketed details and approve before accepting real purchases.

Who is responsible

Data controller: [legal company name, address and privacy contact]. You can contact info@estengenai.com with privacy questions. Effective date: [date]. This is a draft awaiting completion.

Information we process

The application stores your name, email address, a salted password hash, session records and saved property briefs and photos. It does not store plain-text passwords or payment card details. Authentication attempt counters help prevent abuse.

How information is used

We use account information to provide access and saved content to provide the requested workspace. Property briefs are processed by OpenAI to create captions, including when you use original photos. Photos selected for AI enhancement are also sent to OpenAI. Original-mode photos and uploaded logos are formatted on our server. Account confirmation and recovery messages use our configured email provider. Payments are currently disabled. Legal bases for processing, the email provider and processing locations: [confirm before launch].

Cookies and providers

An essential HttpOnly session cookie keeps you signed in for 14 days by default, unless you sign out or the session is revoked. A short-lived cookie protects Google sign-in when enabled. A separate cookie remembers your privacy choice for 12 months. Statistics cookies are optional; none are currently installed. See our Cookie policy for names, purposes and durations, or use Cookie settings to change your choice. Hosting may process technical request logs. List all hosting, font, email, AI and payment providers and international transfer safeguards here before launch.

Retention and your choices

Accounts and drafts currently remain until manually deleted by the operator. Authentication counters expire after 15 minutes and expired sessions are removed on session creation. Set documented retention and backup deletion periods before launch. Request access, correction or deletion using the contact email; applicable rights depend on your jurisdiction.

Security and complaints

We use password hashing and session controls. Production accounts require HTTPS. Add the relevant supervisory authority, complaint process, identity-verification procedure and response periods after legal review.