← Back to Stagify.ai

Privacy Policy

Last updated: September 17, 2026  ·  Effective date: September 17, 2026

Stagify LLC ("Stagify", "Stagify.ai", "we", "us", or "our") operates the website at stagify.ai and related products, including virtual staging, mask editing, AI Designer, PDF floor-plan tools, Stagify+ subscriptions, and enterprise domain plans (collectively, the "Service").

This Privacy Policy describes how we collect, use, disclose, retain, and protect personal information when you visit our website, create an account, upload content, subscribe to a paid plan, or otherwise interact with the Service. It also explains your privacy rights and who owns content you submit or generate.

By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please do not use the Service.

1. Who We Are (Data Controller)

For purposes of applicable privacy laws, including the EU and UK General Data Protection Regulation (GDPR), Stagify LLC is the data controller responsible for personal information processed through the Service.

Mailing address: Stagify LLC, 12 East 72nd Street, New York, NY 10021, United States

Privacy contact: team@stagify.ai

General contact: Contact page or team@stagify.ai

Stagify is operated from the United States. We have not appointed a separate EU or UK representative; please direct all privacy inquiries to the contact above.

2. Scope and Definitions

In this policy:

This policy applies to the Service. It does not apply to third-party websites, services, or integrations that we do not control (such as Stripe’s checkout pages or Google’s sign-in flow), even if linked from our site.

3. Information We Collect

We collect the categories of information below. Not every category applies to every user.

3.1 Account and identity information

3.2 Authentication and session data

3.3 Content you provide

3.4 AI Designer-specific data

3.5 Payment and enterprise information

3.6 Communications and support

3.7 Onboarding and optional profile answers

3.8 Technical, usage, and log data

3.9 Information we do not intentionally collect

We do not ask you to provide government ID numbers, financial account numbers (beyond what Stripe collects directly), precise geolocation, biometric identifiers, health information, or children’s data. Uploads may incidentally contain personal belongings or reflections in room photos; you control what you upload.

4. How We Collect Information

5. Data Ownership and Generated Content

This section describes ownership of your content. It applies to all users, including free, Stagify+, and enterprise accounts.

5.1 You retain ownership

As between you and Stagify, you retain all ownership rights in:

Stagify does not claim copyright, ownership, or other proprietary rights over your Uploads or Generated Output. We do not sell, publicly display, or license your Uploads or Generated Output for our own marketing or commercial purposes separate from operating the Service.

5.2 Limited license you grant to Stagify

By using the Service, you grant Stagify a limited, non-exclusive, worldwide, royalty-free license to host, store, transmit, reproduce, and process your Uploads and Generated Output solely as necessary to:

This license is scoped to operating the Service for you and ends when your content is deleted from our active systems, except where a longer period is required by law or reasonably necessary for encrypted backups, security logs, billing records, or dispute resolution.

5.3 Your responsibilities

5.4 No training on your content

We do not use your Uploads or Generated Output to train Stagify’s own machine-learning models. We submit content to third-party AI APIs solely to produce results for you. Those providers process data under their own terms and privacy policies (see Section 10).

5.5 Your gallery of saved renders

When a render finishes, we save it so you can come back to it. Three files are stored for each entry: the staged image, a thumbnail of it, and the original photo you uploaded, kept at a reduced size so the before-and-after comparison works. Furniture and reference photos you upload are stored separately and addressed by a hash of their contents, so the same reference uploaded twice is stored once.

5.6 Share links

Every finished render in your gallery has a public share link. Please read this subsection carefully, because it is the one place where something you created can become visible to someone who is not signed in.

5.7 Enterprise accounts

Enterprise domain access does not transfer ownership of user Uploads or Generated Output to the enterprise organization or to Stagify. Individual users retain the ownership rights described above. Enterprise administrators may receive aggregated usage reporting (such as generation counts per domain) but do not receive ownership of user content through that reporting.

6. How We Use Information

We use personal information for the following purposes:

We use advertising cookies to measure the performance of our ads and to build remarketing audiences, which is a form of cross-context behavioral advertising. See Section 9 for what is set, Section 10 for who receives it, and Section 16.3 for how to opt out.

7. Legal Bases for Processing (EEA, UK, and Switzerland)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we process personal data under these legal bases:

8. AI Processing Disclosure

Core features of Stagify rely on artificial intelligence. When you use these features:

Do not submit sensitive personal information in prompts unless necessary, and avoid uploading images you are not authorized to share.

9. Cookies and Local Storage

We use cookies and similar technologies (including browser local storage and IndexedDB) as follows:

Every item above except the advertising entry is strictly functional and necessary to operate the Service. The advertising cookies are not necessary, and there are three ways they are switched off: they are not loaded at all if you appear to be in the EEA, the UK, or Switzerland; they are not loaded if your browser sends a Global Privacy Control signal, which we honor automatically on every page; and you can switch them off yourself under Section 16.3. You may also clear cookies and local storage in your browser at any time; doing so may sign you out and reset preferences. If you are located in the EEA or UK, you may contact us to ask which local-storage items are active in your session.

10. How We Share Information

We do not sell your personal information. We do share limited online identifiers with Google for cross-context behavioral advertising, as that term is defined under California law — see Section 16.3, which explains what this means and how to opt out.

We disclose information only to the categories of recipients below, and only as needed:

10.1 Service providers (processors)

The current list, with what each provider receives, is published at stagify.ai/legal/subprocessors.html. These providers are authorized to process personal information only on our instructions and for the purposes described in this policy. Where required by applicable law, we enter into data processing agreements with these providers that impose data-protection obligations consistent with GDPR, UK GDPR, and applicable U.S. state privacy laws.

10.2 Advertising partners (third parties, not processors)

Unlike the providers in Section 10.1, Google is not acting solely on our instructions here, which is why this is listed separately: under California law this relationship is "sharing" for cross-context behavioral advertising rather than disclosure to a service provider. It stops entirely when you opt out under Section 16.3, when you send a Global Privacy Control signal, or when you appear to be in the EEA, the UK, or Switzerland — in each of those cases the tag is never loaded and nothing is sent to Google at all. We do not send Google your Uploads, your Generated Output, your prompts, or the contents of your account.

10.3 Enterprise administrators

If your organization has an enterprise plan, authorized Stagify administrators may access aggregated domain-level usage data (such as total generations). We do not provide enterprise administrators with access to individual users’ Uploads or Generated Output through that reporting.

10.4 Authorized business integrations

Business customers may connect to our server-side staging API using an authorized endpoint key. Those integrations can submit images for processing without an end-user Stagify account. The business customer is responsible for its own privacy notices to its users.

10.5 Legal, safety, and business transfers

11. International Data Transfers

Stagify is based in the United States. If you access the Service from outside the United States, your information may be transferred to, stored in, and processed in the United States and in other countries where we or our service providers operate (including countries that may not provide the same level of data protection as your home jurisdiction).

Where required by applicable law, we implement appropriate safeguards for international transfers, including the Standard Contractual Clauses issued under European Commission Decision 2021/914 (Module Two: controller to processor), the UK International Data Transfer Addendum (IDTA) issued by the ICO, or reliance on adequacy decisions where applicable.

12. Data Retention

We retain personal information only as long as reasonably necessary for the purposes described in this policy:

When retention expires, we delete or de-identify information using reasonable technical and organizational measures.

Backups. Our account database is continuously replicated to encrypted backup storage so that it can be restored after a failure. Deletion and redaction act on the live systems; a backup snapshot taken before you asked us to delete your data still contains it until that snapshot ages out of the backup retention window on its own schedule. We do not restore from backups in order to recover deleted accounts.

13. Security

We implement reasonable administrative, technical, and organizational measures designed to protect personal information, including:

No system is completely secure. You are responsible for maintaining the confidentiality of your account credentials and sign-in token on your device.

If we become aware of a data breach that creates a legal notification obligation, we will notify affected users and regulators as required by applicable law.

14. Children’s Privacy

The Service is not directed to children under 13 years of age (or under 16 where applicable in the EEA/UK), and we do not knowingly collect personal information from children in violation of applicable law, including the Children’s Online Privacy Protection Act (COPPA). If we discover or are notified that an account is held by a user under the applicable minimum age, we will terminate that account and delete the associated personal information. If you believe a child has provided us with personal information, contact team@stagify.ai and we will take steps to delete it promptly.

15. Your Privacy Rights

Depending on your location, you may have some or all of the rights below:

How to exercise your rights: Email team@stagify.ai or use our contact page. We may verify your identity before fulfilling a request. We aim to respond within 30 days (or the timeframe required by applicable law, such as 45 days under certain U.S. state laws). Where permitted by applicable law, we may extend this period by up to two additional months for complex or numerous requests, in which case we will notify you of the extension and the reasons within the initial 30-day period.

Appeals: If we decline to act on your request, we will explain why. Residents of states that provide an appeal right (including Colorado, Virginia, and Connecticut) may appeal our decision by emailing team@stagify.ai with the subject line "Privacy Appeal." If we deny your appeal, you may contact your state attorney general to submit a complaint.

Account deletion: You may request account deletion by contacting us. We will delete or de-identify personal information associated with your account, except where retention is required by law or for legitimate business purposes (e.g., billing records, fraud prevention).

EEA/UK complaint: You have the right to lodge a complaint with your local supervisory authority. A list of EU authorities is available at edpb.europa.eu. UK residents may contact the ICO at ico.org.uk.

16. U.S. State Privacy Notice

This section supplements the policy for residents of U.S. states with comprehensive privacy laws, including California, Colorado, Connecticut, Virginia, and others that may become effective.

16.1 Categories of personal information collected (last 12 months)

16.2 Sources, purposes, and sharing

See Sections 3, 4, 6, and 10 for details on sources, business/commercial purposes, and categories of third parties with whom information is shared.

16.3 Sale and sharing

We do not sell personal information. We do share personal information for cross-context behavioral advertising, in one narrow respect: the Google Ads tag described in Section 9 passes online identifiers to Google so that ad clicks can be attributed to signups and so that your browser can be added to a remarketing audience. The categories shared are identifiers (IP address, advertising cookie IDs) and internet activity (the pages you visited on this site). We do not share your Uploads, Generated Output, prompts, email address, or account contents for advertising, and we do not track you across unrelated third-party sites ourselves.

We do not respond to legacy "Do Not Track" browser signals because there is no industry standard for compliance. We do honor Global Privacy Control (GPC) signals as opt-outs from the sharing of personal information, as required under the CPRA — and it is processed automatically: when your browser sends GPC, the advertising tag is never loaded and nothing is sent to Google. You do not need to do anything else, and we do not ask you to create an account to be opted out.

Visitors in the EEA, the UK, and Switzerland. The advertising tag is not loaded there at all, whatever this control says, because those jurisdictions require consent before a non-essential advertising cookie is set and we do not ask for it. We judge this from your browser’s time zone, which the browser already knows and which involves no lookup of your IP address; the check is deliberately broad, so some visitors elsewhere in Europe are covered by it too. If the tag is withheld for this reason the control below will tell you so, and there will be nothing to switch off.

If your browser does not send GPC, use the control below. It is stored in this browser, so repeat it on each browser or device you use. Clearing your browser storage clears the choice.

This control needs JavaScript. You can also opt out by turning on Global Privacy Control in your browser, or by emailing team@stagify.ai — we will confirm and action the request.

16.4 Sensitive personal information

We do not intentionally collect sensitive personal information as defined by California law. Do not upload content containing sensitive data unless you have a lawful basis to do so and accept the risks of processing through AI providers.

16.5 Authorized agents (California)

You may designate an authorized agent to submit a request on your behalf. We may require proof of authorization and direct verification of your identity.

17. Automated Decision-Making

We do not use solely automated decision-making that produces legal or similarly significant effects concerning you. AI features generate content and suggestions based on your inputs but do not determine eligibility for housing, credit, employment, or government benefits.

18. Third-Party Links and Services

Our site may contain links to third-party websites or services (such as Stripe’s customer portal, social media, or partner tools). We are not responsible for their privacy practices. We encourage you to review their policies before providing personal information.

19. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" and "Effective date" at the top of this page. If changes are material, we will provide additional notice where required (such as by email or a prominent notice on the Service). Continued use after the effective date constitutes acceptance of the updated policy, to the extent permitted by law.

20. Contact Us

For privacy questions, data-rights requests, or concerns about this policy:

© 2026 Stagify LLC. All rights reserved. Privacy Policy  ·  Terms of Service  ·  Enterprise MSA  ·  Subprocessors  ·  Home