Log inGet started
Legal

Privacy Policy

Last updated 7 September 2026

This notice explains what Spatia does with personal data, under the UK GDPR and the Data Protection Act 2018. It covers both the Spatia application and the free-tour offer at /free-tour.

1. Who we are

Spatia is the data controller for the personal data described here. Spatia is a sole trader established in the United Kingdom. You can reach us at hello@spatia.build, and our correspondence address is available on request from the same address.

Spatiais registered with the Information Commissioner’s Office under registration number ZC239568, which you can check on the ICO’s public register.

2. What we collect

When you request a free tour, we collect what you type into the form:

  • your name;
  • your business email address;
  • your company website; and
  • a link to one of your property listings.

We also record technical information sent by your browser — your IP address, your user agent string and the advertising campaign you arrived from. We keep this to evidence when and from where a request and any consent were given, and to detect automated abuse of the form.

To build the tour we process the photographs published on the listing you send us. Those images are not usually personal data, but they can contain it incidentally — a person at a window, a name on a letterbox, a vehicle registration. We do not seek that data out and we do not use it for anything other than producing your tour.

If you hold a Spatia account, we also process your account email, your plan and usage, and the properties, floor plans and photographs you upload.

3. Why we process it, and our lawful basis

  • To build and send your free tour — necessary to take steps at your request before entering into a contract, and to perform it (Article 6(1)(b)).
  • To run and secure the service, including rate limiting and abuse prevention — our legitimate interests in keeping a free offer from being abused (Article 6(1)(f)).
  • To send you marketing about Spatia— your consent where you gave it (Article 6(1)(a)), or, where you asked us for a tour and we are writing to you about our own similar services, our legitimate interests together with the "soft opt-in" at regulation 22(3) of the Privacy and Electronic Communications Regulations 2003. Either way you can stop it at any time, and every marketing email carries a one-click unsubscribe link.
  • To measure our advertising — your consent, which is off until you give it (see cookies, below).
  • To meet legal obligations, such as tax and accounting records where you become a paying customer (Article 6(1)(c)).

Requesting a free tour does not require you to accept marketing. The marketing tick box on the form is optional and is never pre-ticked, and declining it does not affect the tour you receive.

4. Who we share it with

We do not sell personal data and we do not share it with third parties for their own marketing. We use the following providers to run the service, each acting on our instructions:

  • A cloud hosting and content-delivery provider — Runs the application and serves the site (UK/EU edge, US).
  • A cloud database and file-storage provider — Stores your details, your tours and their images (EU).
  • An AI image-processing provider — Generates the virtual tour from the listing photographs (US).
  • A transactional email provider — Delivers the email we send you (EU/US).
  • Meta Platforms — Advertising measurement — see the cookies section (US).
  • A payment processor — Takes payment, only if you later buy a paid plan (US).

Your photographs are not used to train AI models. The image-processing provider receives them under paid API terms that permit it to use them only to return the tour we asked it for, and that state it does not use prompts or the files sent with them to improve its own models. It keeps them briefly to detect abuse of the API, not to learn from them. We do not train models of our own on them, we do not put them in any training set, and we do not send them to any other AI service. The only thing they are processed for is producing your tour.

We may also disclose data where we are legally required to, or to establish or defend a legal claim.

5. Cookies and advertising measurement

The Meta pixel is off until you accept it. No measurement cookie is set and nothing is reported to Meta before then. A small bar at the bottom of the page asks once, with Decline and Accept offered equally; declining is remembered, so it does not ask again. Off is what applies until you answer, and our cookies page lists every cookie by name and lets you change your answer at any time.

With measurement accepted, the pixel tells us that a visit came from an advertisement, and when a request is submitted we send Meta a matching server-side event so the same conversion is not counted twice. The email address you submit is hashed before it is sent— Meta receives an irreversible fingerprint of it, not the address itself — and it is used to match the event to an existing Meta account and to measure our ads. Meta acts as an independent controller for that measurement, and its own handling is described in Meta's privacy policy. With measurement off — the default — neither the browser half nor the server half happens at all.

Storage that is strictly necessary to serve the site is used without consent, as the regulations permit: your login session, and the record of any cookie choice you make. You can also block or delete cookies in your browser, and you can control how Meta uses data about you in your Meta account's ad settings, whatever any website does.

6. International transfers

Some of the providers listed above are established in the United States. Where personal data is transferred outside the UK, we rely on the UK Addendum to the European Commission's standard contractual clauses, on the UK Extension to the EU–US Data Privacy Framework where the provider is certified, or on the transfer being necessary to perform our contract with you.

7. How long we keep it

  • Free-tour requests — for as long as we are in contact with you about it and for up to 24 months afterwards, then deleted. If you unsubscribe, we keep your email address on a suppression list indefinitely, because that is the only way to guarantee we do not email you again.
  • Account data — for as long as your account is open, and for up to 6 years afterwards where we need it for tax and accounting records.
  • Tours and their images — until you ask us to remove them, or we withdraw the tour under the free-tour terms.

8. Your rights

You have the right to:

  • ask for a copy of the personal data we hold about you;
  • have inaccurate data corrected;
  • have your data erased, and have any tour we built for you taken down;
  • restrict or object to our processing, including any processing based on legitimate interests;
  • receive your data in a portable format;
  • withdraw consent at any time, which does not affect processing carried out before you withdrew it; and
  • object to direct marketing at any time — an absolute right, which we always honour.

To exercise any of these, email hello@spatia.build. We will respond within one month. There is no charge.

9. Complaints

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

10. Changes

We may update this notice as the service changes. The date at the top is the effective date, and we will tell you directly if a change materially affects how we use data you have already given us.