In short: we collect what we need to make and deliver your videos and bill you. We don't sell your data, we don't use it for advertising, and the site you're reading sets no tracking cookies.
1. Who we are
realfly.ai is run by Micah Brook, a sole trader, based in Australia ("realfly", "we", "us"). We're responsible for your personal information as the "controller" (under the GDPR and UK GDPR) and as an "APP entity" (under Australia's Privacy Act 1988).
Information about other people that you put into realfly (for example, an agent's name on a video) is handled on your behalf to provide the service to you.
2. What we collect
| Category | What it includes |
|---|---|
| Account details | Your email address and name; your business name, phone, website and email for your brand kit; your logo and brand colours. |
| Listing photos | The photos you upload. They show the inside and outside of homes, and can show people, personal belongings, house numbers or car plates. Photo files can also contain embedded details such as the camera, the time and sometimes the location. |
| Floor plans and project details | Floor plans (images or PDFs), the listing address, the name and phone of the agent you're making the video for, the tour order, your choices of format, music and market, and the videos we make. |
| Compliance records | Your confirmation that you have rights to the photos, your approval of each video, and any change to the AI-disclosure setting: who made it, when, from which IP address, and the statement accepted. We also keep a fingerprint (SHA-256 hash) of every final video. Each video file carries a C2PA Content Credentials manifest that marks it as AI-generated; it holds fingerprints of the source photos but no address, client or agent names. |
| Payment data | Payments are handled by Stripe. We don't receive or store your full card number. We receive your billing name, email and address (Stripe Tax uses the address to work out any tax), any tax ID you enter, your plan and invoices, the card brand and last four digits, and a card fingerprint that Stripe provides, which we use only to enforce one trial per card. |
| Messages | What you send us through the contact form, the in-app help panel or email. |
| Technical data | Server logs from using the app and site: IP address, browser and device type, pages requested, and errors. |
| Creators | If you join the creators program, Content Rewards shares the post links you submit, your view counts and payout status. Your referral link records signups made through it. |
We don't ask for sensitive information (such as health or political views), and we ask you not to upload photos that show it.
3. How we use it, and our legal bases
- To provide realfly: signing you in, processing photos and floor plans into videos, checking videos, branding them, hosting your share pages and delivering downloads. (GDPR basis: performing our contract with you.)
- To bill you: subscriptions, the trial, top-ups, invoices, trial reminders and preventing repeat trials. (Contract; legal obligation for tax records; legitimate interest in preventing fraud.)
- To comply with sanctions law: we check the country of your connection and billing address to block regions where realfly isn't available, and may screen account and billing names against sanctions lists. (Legal obligation; legitimate interest.)
- To send service emails: sign-in links, video-ready notices, trial reminders and billing notices. These aren't marketing and can't be switched off while you have an account.
- To keep compliance records about photo rights, approvals and AI disclosure, so we and you can show what was agreed. (Legitimate interest; legal obligation where it applies.)
- To support you and improve realfly: answering messages, fixing errors and understanding which features are used. (Legitimate interest.)
- Marketing emails only if you opt in, and you can unsubscribe at any time. (Consent.)
We don't sell personal information, don't share it for cross-context behavioural advertising, and don't use your photos or videos to train AI models of our own.
4. Who processes it for us
We use these service providers to run realfly. Each one processes data only to provide its service to us, under its own data-processing terms.
| Provider | What it does | Data |
|---|---|---|
| Stripe | Payments, subscriptions, invoices, fraud checks | Billing and payment data |
| Supabase | Database, sign-in and file storage | Account data, photos, floor plans, videos, records |
| Vercel | Hosting for the app and this website | Technical data; data passing through the app |
| fal.ai | Runs the AI models that animate photos and check videos. For image-understanding steps, fal routes requests to third-party AI model providers through OpenRouter. | Listing photos, floor plans and generated frames |
| Resend | Sends service emails | Email address and email content |
| Google (Places API) | Finds publicly listed real-estate agencies near a project for the "agents near you" email, sent if a project isn't marked sold within 24 hours of its video being ready | The project's suburb or city only. The email lists public business-directory details (business name, phone, website) |
| Content Rewards (Whop) | Runs the creators campaign and pays creators (creators only) | Submitted post links, views, payouts |
We may also share information if the law requires it, to protect people's safety or our legal rights, or with a buyer if realfly's business is sold (we'd tell you first).
6. International transfers
We're based in Australia, and most of our providers are in the United States or process data there and in other countries. When data leaves the EU, UK or Australia, we rely on the providers' standard contractual clauses or equivalent safeguards, and we take reasonable steps (under Australian Privacy Principle 8) to make sure they handle it in line with Australian privacy law.
7. How long we keep it
| Data | Kept for |
|---|---|
| Account and brand-kit details | While your account is open, then deleted within 90 days of closing it. |
| Listing photos, floor plans and videos | While your account is open, so your share pages keep working. You can ask us to delete a project or everything at any time; we delete within 30 days of your request, or within 90 days of your account closing. |
| Compliance records (rights confirmations, approvals, disclosure changes, video fingerprints) | 7 years after the project, because they're evidence if a video is ever questioned. |
| Billing records and invoices | As long as tax law requires (generally 5 to 7 years). |
| Messages to us | 2 years after the conversation ends. |
| Server logs | Up to 30 days, unless needed to investigate a problem. |
Our providers may keep backups for a short time after deletion, according to their own schedules.
8. Security
Photos and videos are kept in private storage and served through signed links that expire. Sign-in is by single-use email links, and payments never touch our servers. No system is perfectly secure; if a breach is likely to cause you serious harm, we'll tell you and the relevant regulator as the law requires.
9. Your rights
Wherever you live, you can ask us to show you, correct, export or delete your personal information, and we'll answer within 30 days. Email team@realfly.ai or use the contact form. We may need to confirm it's you. We won't treat you differently for using your rights. We may have to keep some records, such as invoices, where the law requires it.
EU and EEA (GDPR) and the UK (UK GDPR)
You have the right to access, correct, erase, restrict or object to processing, to data portability, and to withdraw consent at any time. You can complain to your local data protection authority; in the UK, that's the Information Commissioner's Office (ico.org.uk).
Australia (Privacy Act 1988 and the Australian Privacy Principles)
You can ask to access and correct your personal information. If you have a complaint, tell us first and we'll respond within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).
United States, including California (CCPA as amended by the CPRA)
- You can ask to know what personal information we've collected about you, and to delete or correct it.
- We don't sell or "share" personal information (as the CCPA defines those terms), so there's nothing to opt out of, and we don't use sensitive personal information to infer things about you.
- The categories we collect are listed in section 2, the sources are you, your use of the service and Stripe, and the purposes are in section 3.
- You can use an authorised agent to make a request for you.
Residents of other US states with privacy laws (such as Colorado, Connecticut, Virginia or Texas) can make the same requests.
11. People in listing photos
realfly is for photographing homes, not people. We ask users to leave out photos where people can be identified. If you appear in a photo or video made with realfly and want it removed, contact us with the share-page link and we'll work with the account holder to remove it.
12. Children
realfly is for businesses and isn't meant for anyone under 18. We don't knowingly collect children's personal information.
13. Changes
We'll update this page if our practices change, and email account holders about significant changes before they take effect. The date at the top shows the latest version.
14. Contact and complaints
Email team@realfly.ai or use the contact form.