Data processing terms
How we process personal data on behalf of the agencies and companies that use Stailer (Article 28 of the GDPR).
Draft: this text has not been legally reviewed yet and may change before launch.
Parties and scope
These terms are part of the terms of service. They apply when a company that uses Stailer (you, the controller) sends us personal data in listing material. Stailer Solutions Oy (we, the processor) processes that data on your behalf. How we handle our own customers' account details is in the privacy policy.
What we process
- Purpose: furnishing listing photos virtually, as you order through the service.
- Data: photos and floor plans of homes, which can show people or their belongings; addresses; listing links and listing texts; and what you write about a staging (wishes, change requests and the text on the photo).
- People concerned: owners, tenants and residents of the homes, and anyone who appears in the photos.
- Duration: until you delete the staging, or your account together with your company, or the agreement ends.
What we do
- We process the data only on your documented instructions: what you order through the service, and these terms. If we think an instruction breaks data protection law, we tell you.
- Everyone at Stailer who processes the data is bound to confidentiality.
- We protect the data with appropriate technical and organisational measures: encrypted connections, access only for those who need it, each company's data kept apart, and deletion when you delete.
- We help you answer the requests of the people concerned and meet your own obligations (security, breach notifications, impact assessments), as far as the nature of the processing allows.
- We tell you without undue delay when we become aware of a personal data breach that affects your data.
- When you delete a staging, its data is deleted at once. When the agreement ends, we delete your data within 30 days unless the law requires us to keep it; download the photos before that.
- We give you the information needed to show that these terms are met, and allow a reasonable audit by you or an auditor you choose, once a year on 30 days' notice, at your cost.
Subprocessors
You authorise us to use the subprocessors below. We tell you in advance about new ones: we update this page and email your company's owner. You can object within 30 days; if we cannot meet the objection, you can end the agreement.
| Subprocessor | What it does | Where |
|---|---|---|
| netcup GmbH | Servers and storage | Germany |
| Cloudflare, Inc. | The network in front of the site and protection against attacks | EU and USA |
| Anthropic | The AI stager: plans the furniture and checks the results | USA |
| kie.ai | Access to the AI image models (currently ByteDance Seedream) and to the models that read the photos and floor plans | Outside the EU/EEA |
| Scaleway SAS | France | |
| OpenAI | An alternative AI stager, if we use it instead of Anthropic | USA |
Transfers outside the EU/EEA rely on the European Commission's standard contractual clauses or an adequacy decision.
What you do
- You have a lawful basis for the material you send us, and you inform the people concerned as the law requires.
- You don't send special categories of personal data, such as health data, or identity documents. If a photo shows people, documents or other private details, crop or remove them before sending.
Everything else
The terms of service apply to liability and to everything these terms don't cover. If the two conflict in a matter of data protection, these terms prevail.
This version is from 18 October 2026.