Privacy Policy

Last updated: 2026

1. Who we are

Casafy is operated by Whypes. Whypes is the data controller responsible for personal data processed through the Casafy service (the "Service").

2. Data we collect

• Account data: name, email address, password (hashed), and profile information.
• Uploaded content: listing photos and any metadata you submit for processing.
• Usage data: log data, device identifiers, IP address, browser type, and telemetry about how you use the Service.
• Support communications: messages you send to us.
• Billing data: handled by Stripe (see below). Whypes receives limited transaction metadata such as plan, status, and invoice references — not full card details.

3. How we use data

• To create and operate your account and deliver the Service (contract);
• To process images and generate AI outputs you request (contract);
• To prevent fraud, abuse, and secure the Service (legitimate interests);
• To improve the Service, models, and user experience (legitimate interests);
• To respond to support requests (contract / legitimate interests);
• To send service updates and, where permitted, marketing (consent or legitimate interests).

4. Sharing your data

We share personal data with:

• Stripe, our payment processor (and Merchant of Record for transactions with end-to-end compliance handling enabled), for payment processing, subscription management, tax compliance, and invoicing;
• Service providers and subprocessors such as cloud hosting, database, email, analytics, and AI model providers used to deliver the Service;
• Professional advisers (legal, accounting) where necessary;
• Authorities where required by law or to protect our rights.

We do not sell your personal data.

5. International transfers

Your data may be processed in countries other than where you live. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.

6. Retention

We keep personal data for as long as necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. Uploaded images and generated outputs are retained while your account is active and deleted or anonymised within a reasonable period after account closure, unless we are required to keep them longer.

7. Your rights

Depending on your location, you may have rights to access, correct, delete, restrict, port, or object to the processing of your personal data, and to withdraw consent. EU/UK users may also lodge a complaint with their local supervisory authority. To exercise your rights, contact us through support.

8. Security

We use appropriate technical and organisational measures (encryption in transit, access controls, least-privilege backend access) to protect personal data. No system is completely secure; we encourage strong, unique passwords.

9. Cookies

We use essential cookies to operate the Service (e.g., authentication session) and limited analytics cookies to understand usage. You can manage cookies through your browser settings.

10. Children

The Service is not directed to children under 16, and we do not knowingly collect personal data from them.

11. Changes

We may update this Privacy Policy. Material changes will be communicated through the Service.

12. Contact

For privacy questions, contact Whypes through the support channel in your account.