Privacy policy
The German version is authoritative. German version
Convenience translation. Only the German version is legally binding.
Draft (as of 17 October 2026) – have it reviewed legally before publication.
Privacy policy
This policy applies to the website https://3d-roomtour.de, including ordering and the customer portal, and to the tour pages at https://….3d-roomtour.de.
1. Controller
RS Innovations GmbH, Hauptstraße 31, 59872 Meschede, Deutschland Managing director: Robin Strang Email: info@neonuvola.de
You can reach us at this address for all questions about data protection.
2. Visiting the website
Server log files. On every access, our server stores the IP address, date and time, the address accessed and the browser identifier. The purpose is secure and stable operation. The legal basis is Art. 6 Abs. 1 lit. f DSGVO; our legitimate interest is secure operation. We delete the log files after 14 days.
Cookies. We use only technically necessary cookies: for signing in to the customer portal (for up to 30 days or until you sign out), for the language you select and to protect forms against misuse. The legal basis for storage on your device is § 25 Abs. 2 Nr. 2 TDDDG, and for the processing Art. 6 Abs. 1 lit. b and f DSGVO. We do not use analytics, tracking or advertising services.
Audience measurement. We count page views with Plausible Analytics, which we run ourselves on our server in Germany. Plausible sets no cookies, does not access your device and stores no IP addresses: an identifier is formed from the IP address and browser identifier together with a random value that changes daily, and it is discarded after 24 hours. This only produces aggregated statistics (for example pages viewed, referring website, country, device type) without reference to individual persons. The data is not passed on to anyone. We do not measure in the customer portal. The purpose is to improve the website. The legal basis is Art. 6 Abs. 1 lit. f DSGVO; our legitimate interest is a data-minimising analysis of usage. You can object (see no. 9).
3. Orders, customer portal and emails
When you place an order, we process your name, email address, telephone number (voluntary), company, customer type and language, the order data (level of detail, floor area, use, price, listing link, property address, notes) and your messages and replies to queries.
The purpose is the conclusion and performance of the contract, including the customer portal, invoicing and communication. The legal basis is Art. 6 Abs. 1 lit. b DSGVO; if you order for a business, we process the contact person’s data under Art. 6 Abs. 1 lit. f DSGVO. Statutory retention duties are covered by Art. 6 Abs. 1 lit. c DSGVO. We need the information marked as mandatory for the contract; without it, an order is not possible.
If you use the withdrawal function or the button “Verträge hier kündigen” (cancel contracts here), we process your details (name, email address, order reference or tour link, content and time of the declaration) and the IP address in order to assign, confirm and be able to prove the declaration (Art. 6(1)(c) and (f) GDPR).
In the customer portal you sign in without a password, using a link that we send you by email. We keep customer data, orders and invoices in HighLevel’s CRM, through which we also send our emails.
4. Creation of the tour
Your materials. We use floor plans, photographs, listing data and the property address only for your order. We do not publish photographs, and the tour does not show the property address. Please avoid uploading photographs in which people, identity documents or other personal papers can be recognised.
Artificial intelligence. When creating the tour, we use AI models from Anthropic (Claude). For this purpose we transmit floor plans, photographs, listing data and, where necessary, the property address to Anthropic. Anthropic is our processor, does not use the data to train AI models under the agreed terms, and, according to its own information, generally deletes them within 30 days.
Surroundings. For terrain, neighbouring buildings and aerial imagery, our servers query public geoservices. In doing so we transmit only the property address or map coordinates, not names or contact details.
Reuse. We may reuse general furniture models and technical parameters that do not relate to a person for later orders. We use your photographs and textures derived from them only for your order.
The legal basis is Art. 6 Abs. 1 lit. b DSGVO. Where photographs show other people, we rely on Art. 6 Abs. 1 lit. f DSGVO (interest in performing the order).
5. Payment
We create your invoice in the CRM. Payment is made online via Stripe. We do not receive your full payment details, only the payment status. Stripe processes data in part as its own controller, for example for fraud prevention and to comply with statutory duties; details are at https://stripe.com/de/privacy. The legal basis is Art. 6 Abs. 1 lit. b and c DSGVO.
6. Tour pages and embedding
Anyone who opens a tour generates server log files as described in section 2. The tour pages do not set cookies. Your browser only stores display settings locally on your device, such as viewing direction or quality level (§ 25 Abs. 2 Nr. 2 TDDDG). Tours do not subsequently load content from third parties and are blocked from search engines (noindex).
If a customer embeds a tour on their website, the visitor’s browser loads the tour from our server. The operator of that website provides information about this in their own privacy policy.
Statistics for 3D tours
We also measure the reach of tours with Plausible Analytics on our own server. The statements about cookies, IP addresses and the identifier that changes daily in “Audience measurement” under section 2 also apply here. In addition, we record the tour identifier, whether it was opened as an embedded tour, the language, whether the visitor interacted with it, and the active usage time. Events are sent from the tour to our tour server and from there to our Plausible server. The IP address is passed on only to create the identifier that changes daily and is not stored. This produces aggregated statistics for our customers without reference to individual persons. The legal basis is Art. 6 Abs. 1 lit. f DSGVO; our legitimate interest is measuring reach for our customers.
7. Recipients and transfers to third countries
| Recipient | Task | Place of processing | Basis |
|---|---|---|---|
| netcup GmbH, Karlsruhe | Hosting of the website, portal, files and tours | Deutschland | Processing on behalf of the controller (Art. 28 DSGVO) |
| HighLevel Inc. with LeadConnector LLC, Dallas | CRM, invoices, sending of emails | USA | Processing on behalf of the controller; EU-US Data Privacy Framework adequacy decision (Art. 45 DSGVO) |
| Anthropic Ireland, Limited, Dublin, with Anthropic PBC, San Francisco | AI processing during creation | Ireland and USA | Processing on behalf of the controller; EU standard contractual clauses (Art. 46 Abs. 2 lit. c DSGVO) |
| Stripe Payments Europe, Limited, Dublin | Payment processing | Ireland and USA (Stripe, LLC) | Stripe’s own controllership; EU-US Data Privacy Framework |
| Public geoservices (e.g. OpenStreetMap, Geobasis NRW, terrain and aerial-image services) | Geospatial data of the surroundings | EU; terrain and aerial-image tiles also from the USA | Property address or coordinates go only to services in the EU; services in the USA receive only the tile coordinates of a map section without any information about you; Art. 6 Abs. 1 lit. b DSGVO |
You can obtain a copy of the standard contractual clauses on request at info@neonuvola.de. Authorities receive data only where we are legally obliged to provide it. We do not sell data and do not pass it on for advertising.
8. Storage period
- Server log files: 14 days.
- Declarations of withdrawal and cancellation: 3 years; we delete the IP address after 14 days.
- Materials (floor plans, photographs, listing data): until 6 months after the tour is made available.
- Tour: for the agreed period of availability (6 months, or longer in the case of an extension).
- Customer data and order history: until the end of the third year after your last order (statutory limitation period).
- Invoices and accounting records: 8 years; business correspondence: 6 years, in each case from the end of the calendar year (§ 147 AO, § 257 HGB).
- At Anthropic: generally up to 30 days.
9. Your rights
You have the right of access (Art. 15 DSGVO), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). An email to info@neonuvola.de is sufficient.
You may lodge a complaint with a data protection supervisory authority (Art. 77 DSGVO). The authority competent for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Postfach 20 04 44, 40102 Düsseldorf, poststelle@ldi.nrw.de, https://www.ldi.nrw.de.
No automated decision-making within the meaning of Art. 22 DSGVO takes place. The AI assists in building the tour, but it does not make a decision about you.
Right to object (Art. 21 DSGVO) Where we process data on the basis of Art. 6 Abs. 1 lit. f DSGVO (for example server log files), you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds which override your interests, or the processing serves the establishment, exercise or defence of legal claims. An email to info@neonuvola.de is sufficient.