Privacy Policy

This policy explains how augenlicht creative GmbH collects, uses, and protects personal data when you use HospitalityLens.

Last updated: October 5, 2026

This Privacy Policy explains how augenlicht creative GmbH ("we", "us") collects, uses, and protects personal data when you use HospitalityLens (the "Service"). We comply with the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

1. Data Controller

augenlicht creative GmbH
Brüsseler Straße 73, 50672 Köln, Germany
Registered at Amtsgericht Köln, HRB 126191 · USt-IdNr.: DE461169597
Contact for privacy and data-protection requests: support@hospitalitylens.com
Full legal disclosure: Impressum.

2. Data We Collect

Account data

• Email address, hashed password, display name (optional).
• Host type (hotel, short-term rental, real estate) collected during onboarding.
• Account creation timestamp, last sign-in timestamp.

Content data

• Property photos you upload and the enhanced outputs we generate from them.
• Project and folder names, generation settings, revision history.

Payment data

• Stripe handles all card data directly — we never see or store your full card number.
• We retain Stripe customer IDs, transaction IDs, amounts, currency, and (for B2B invoices) billing name, address, and VAT ID.

Technical data

• IP address, browser user-agent, device type, basic interaction logs, and error reports.
• Strictly necessary cookies for session authentication. Optional cookies for Analytics (Google Analytics, Microsoft Clarity, Mouseflow) and Marketing (Meta Pixel, TikTok Pixel, conversion measurement) are grouped as separate categories in our cookie banner. You may accept or reject each category independently and change or withdraw your choice at any time via the Cookie preferences link in the site footer — withdrawing consent is as easy as granting it (Art. 7(3) GDPR).

3. Why We Process Your Data (Legal Bases)

• Contract performance (Art. 6(1)(b) GDPR) — to provide the Service, run enhancements, deliver outputs, and process payments.
• Legitimate interests (Art. 6(1)(f) GDPR) — service reliability, fraud prevention, abuse detection (including automated hallucination scoring for our revision bonus system), and product analytics.
• Legal obligation (Art. 6(1)(c) GDPR) — tax and accounting retention requirements under German law (typically 10 years for invoices).
• Consent (Art. 6(1)(a) GDPR) — for optional marketing emails, withdrawable at any time via the unsubscribe link or by emailing us.

4. AI Processing & Property Images

Uploaded photos are transmitted to third-party AI infrastructure to run enhancement and quality-check models. Outputs and intermediate artifacts are stored in our backend so you can review, revise, and download them. We do not use your photos to train public foundation models.

Third parties in your photos. Property photos may incidentally contain personal data of third parties — guests, tenants, staff, passers-by, visible license plates, or distinctive facades (see ECJ, Ryneš, C-212/13). Under our Terms you warrant that you have a lawful basis to upload and have such images processed by AI, and you act as controller for those third parties (we act as processor — see our Data Processing Agreement).

Photo storage and access. Images are transmitted over TLS and stored encrypted at rest. Access to account and project records requires authentication and is restricted by database access rules. However, our current image-delivery storage uses public URLs: anyone who obtains an uploaded-photo or generated-image URL can open that image without signing in. These URLs are not expiring, account-only download links. A signed upload link authorizes the transfer of a file; it does not make the stored image private. Avoid uploading confidential images or personal details that should not be accessible to someone with the image link. Images are permanently deleted within 30 days of project or account deletion; copies downloaded or shared by others are outside our control.

Using HospitalityLens in ChatGPT

When you connect your HospitalityLens account in ChatGPT, the integration can read your photo allowance and project names, accept photos you explicitly select, and run enhancements you request. We receive the selected image, its filename, your chosen processing settings and project, and the account identifier needed to perform the request. Photo links, processing status and results are returned to ChatGPT so you can view them there. If you provide portfolio size or monthly photo counts, those counts are saved with an enhancement to measure portfolio use. The integration does not request your complete chat history. Uploading a photo does not itself spend a photo credit; processing starts after a separate enhancement request.

OpenAI processes the content you share with ChatGPT under its own privacy policy. Disconnecting the integration stops future account access from that connection, but does not delete photos already saved in HospitalityLens. You can delete projects or your account, or contact us using the address below.

5. Sub-processors

We share data with the following sub-processors strictly to operate the Service:

• Supabase (database, auth, storage) — EU region where available.
• Stripe — payments and invoicing.
• n8n / serverless workers — enhancement pipeline orchestration.
• Google AI (Gemini) — hallucination scoring and image-quality analysis.
• Resend / email infrastructure (notify.hospitalitylens.com) — transactional and verification email.
• Lovable Cloud — application hosting and edge functions.
• Google Analytics (Google Ireland Limited) — anonymous traffic measurement, loaded only after you grant consent via our cookie banner.
• Meta Pixel (Meta Platforms Ireland Limited) — conversion measurement for our advertising, loaded only after you grant consent via our cookie banner.

Where a sub-processor is located outside the EU/EEA, transfers are protected by the European Commission's Standard Contractual Clauses (SCCs) or an adequacy decision.

6. Retention

• Uploaded and generated images: kept for as long as your account is active. You may delete individual projects at any time. Deletion is permanent within 30 days.
• Account data: kept while the account exists; deleted within 30 days of account closure, except where retention is legally required.
• Invoices and payment records: retained for 10 years to comply with German tax law (§ 147 AO).

7. Your Rights (GDPR)

You have the right to:

• Access the personal data we hold about you (Art. 15).
• Request correction of inaccurate data (Art. 16).
• Request erasure where applicable (Art. 17 — "right to be forgotten").
• Restrict or object to processing (Art. 18, 21).
• Data portability — receive your data in a structured, machine-readable format (Art. 20).
• Withdraw any consent at any time, with future effect.
• Lodge a complaint with a supervisory authority. Our competent authority is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf — ldi.nrw.de. You may also lodge a complaint with the authority of your country of residence.

To exercise any of these rights, email support@hospitalitylens.com. We respond within 30 days. You may also permanently delete your account and all associated data yourself at any time from the Account tab of your dashboard — the self-service Delete account action triggers a cascading purge of your profile, projects, uploaded photos, and generated outputs (subject to legally required retention for invoices).

8. Security

We apply industry-standard technical and organizational measures, including encryption in transit (TLS) and at rest, hashed passwords, row-level security in our database, and least-privilege access controls for staff.

9. Children

The Service is not intended for users under 18. We do not knowingly collect personal data from children.

10. Changes to This Policy

We may update this Policy. Material changes will be announced by email or in-app at least 14 days before they take effect.

Disclaimer: This document is a starting draft prepared by the operator for general use. It is not legal advice. Before relying on it for material commercial activity, please have it reviewed by a qualified lawyer admitted in your jurisdiction.

See how HospitalityLens works · Review before-and-after examples · View current pricing