GENA.

Privacy policy

Last updated: October 2026

This English version is provided for your convenience. In case of any discrepancy, the German version prevails.

1. Controller

Evasto GmbH, Alfred-Feierfeil-Straße 3, 2380 Perchtoldsdorf, Austria — email: gena-interior@evasto.cloud (see legal notice).

2. What data we process

  • Account data: email address, password (stored encrypted), display name, language setting — to provide your account (Art. 6(1)(b) GDPR).
  • Room photos and results: photos of your rooms that you upload, analyses derived from them (measurements, floor plan data), markings and AI-generated images. This content is private and only accessible to your account (Art. 6(1)(b) GDPR).
  • Product data: product links you import and the product information read from them.
  • Usage data: the number of your generations per month, to account for your quota.
  • Technical data: server log data (IP address, time, page accessed) to ensure operation (Art. 6(1)(f) GDPR).

3. AI processing of your photos

For room analysis, image generation and product recognition we transmit your room photos to Google (Gemini API, Google Ireland Ltd. / Google LLC, USA) and, where applicable, to Replicate Inc. (USA). For the product search, a generated image may be transmitted to SerpApi (USA); your original room photo is not included. The transmission takes place to perform the contract (Art. 6(1)(b) GDPR); data processing terms including EU standard contractual clauses are in place with the providers. The photos are processed there only to handle your request.

4. Hosting and storage

Our application and database are operated by Railway Corp. (USA); the transfer is safeguarded by EU standard contractual clauses. Photos and generated images are kept in private, access-protected storage.

5. Payments

When you upgrade to a paid plan, Stripe Payments Europe Ltd. (Ireland) processes the payment. We do not receive complete payment data, only a confirmation and a subscription reference (Art. 6(1)(b) GDPR).

6. Cookies

We always use technically necessary cookies — for your login session and your language choice. No consent is required for these.

With your consent we additionally use the Meta Pixel (see section 6a). This consent is voluntary; you can withdraw it at any time via “Cookie settings” in the footer. Until you agree, no advertising cookie is set and no script from Meta is loaded.

6a. Meta Pixel

To measure our advertising on Facebook and Instagram we use — only with your express consent (Art. 6(1)(a) GDPR) — the Meta Pixel of Meta Platforms Ireland Ltd. Information about your visit (including pages visited, IP address, device and browser data) is transmitted to Meta and also passed on to the USA. Meta is certified under the EU-US Data Privacy Framework. You can withdraw your consent at any time with effect for the future.

In addition — likewise only with this consent — we send three events directly from our server to Meta (Conversions API): registration, start of checkout and purchase. This transmits your email address only as an irreversible hash, your IP address, browser information, the Meta cookie identifiers and, for purchases, the amount and currency. This lets Meta measure the success of our advertising even when the browser blocks the pixel script. Without consent, nothing is transmitted.

7. Newsletter

If you sign up for our newsletter, we process your email address on the basis of your consent (Art. 6(1)(a) GDPR). Sign-up uses the double opt-in procedure: you receive a confirmation email and are only added after clicking the link it contains. We store your email address, the time of sign-up and confirmation, and your language. You can withdraw your consent at any time with effect for the future — via the unsubscribe link in every email or by email to the address given in the legal notice.

7a. Automated emails

We send a few automated emails ourselves (without an external marketing service) that relate to your account: reminders if you have not confirmed your account yet, if you started an upgrade but did not complete it, if your free quota is used up, or if your plan has ended — some with a personal, single-use discount code created for this purpose at our payment provider Stripe. For this we process your email address, your language, the time of the occasion and which email you received when (Art. 6(1)(b) and (f) GDPR). You can object to the offer emails at any time via the unsubscribe link in each of these emails; emails required for your account will still reach you. Sending takes place via the mail server of Zoho (Zoho Corporation B.V., Netherlands; servers in the EU) as a processor.

8. Storage period

Your content is stored as long as your account exists. If you delete a photo, a project or your account, the associated data is deleted; statutory retention obligations (e.g. for invoice data) remain unaffected.

9. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR), as well as the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). Please contact gena-interior@evasto.cloud.