PropriX

GDPR overview

Implementation is concrete and documented. PropriX AG names itself controller with its commercial register number and UID, and works under both the revised Swiss FADP and the GDPR. It states plainly that no data protection officer has been appointed because the Article 37 thresholds are not met, and routes access, rectification, erasure and objection requests to hello@proprix.ch. An Article 27 representative is designated in the European Union: Talha Aktas in Magstadt, Germany. Transfers to the United States rest on the EU-US Data Privacy Framework adequacy decision of 10 July 2023 together with standard contractual clauses. A full data processing agreement is published, listing thirteen named sub-processors with purpose and location, with thirty days' notice before any change and a right to object. Every plan lists GDPR compliance as a feature.

Who owns the data?

Ownership is split explicitly. Content the customer publishes on their landing page remains the customer's property where intellectual property law protects it, and the customer warrants they hold the rights to every source file they upload. In exchange they grant PropriX the right to process those files to deliver the AI features and to pass them to its named processors. Everything belonging to the platform itself, its images, trademarks, logos and layouts, stays the exclusive property of PropriX AG, which grants no licence over them. For end-user personal data the roles reverse: the customer is the controller and PropriX acts as processor under a published data processing agreement.

Reuse rights

The customer keeps their published content and can reuse it freely, subject to holding the rights to the source material. PropriX processes uploaded files only to run the AI features, virtual staging, furniture removal, close-up renderings, text generation and translation, and analysis of uploaded content, and transmits them to OpenAI Ireland and Google Ireland as processors for that purpose. The vendor states that under those providers' API terms the content is not used to train their models, and applies the same principle to Gmail and Outlook data under Google's Limited Use policy. AI output is labelled automatically, and the customer is made solely responsible for reviewing, approving and publishing it, including meeting the labelling duty in Article 50 of the EU AI Act. Using the AI features for deepfakes of identifiable people, or to depict structural elements that do not exist, is prohibited.

Data retention & training

Hosting summary

Personal data is processed in Switzerland, and may be handled by third parties operating within the European Economic Area. The published sub-processor list gives a location for each: database hosting, authentication and storage with Supabase in Frankfurt; analytics with PostHog in Frankfurt on AWS EMEA; payments through Stripe Payments Europe in Ireland; transactional email via Resend within the EU; domains and DNS with Hetzner and Openprovider in Germany and the Netherlands. Generative AI runs on OpenAI Ireland, and connected Gmail mailboxes on Google LLC, both of which may involve the United States under the EU-US Data Privacy Framework adequacy decision of 10 July 2023, backed by standard contractual clauses. Daily automated backups are retained for seven days with point-in-time recovery and are geographically redundant inside the EU. Authentication and database access events are logged with timestamps and kept for ninety days.