Privacy Policy

Last updated October 12, 2026

This Privacy Policy explains how Simplisik LLC (“Simplisik”, “we”, “us” or “our”) collects, uses, shares and protects personal information through Scenava. Scenava includes the mobile app, the dashboard at app.scenava.com, tours we host at scenava.com and view.scenava.com, tours embedded on other websites, and the scenava.com website (together, the “Services”). It also explains your choices and rights.

The short version

We collect what we need to turn your scans into tours, host them and run your account.
Tours you publish can be seen by anyone who has the link or visits a page where they are embedded.
Tour analytics use a random identifier instead of cookies. We do not store visitors’ IP addresses with analytics.
We do not sell personal information, share it for targeted advertising, or use advertising trackers.
We do not use facial recognition or create biometric identifiers.
You can ask us to access, correct, export or delete your information.

1. Scope and our role

This policy covers information about:

people who create accounts or join workspaces (“customers” or “you”);
people who view tours hosted or embedded through Scenava (“visitors”);
people who visit scenava.com;
people who appear in, or whose details are added to, tours that customers create.

Our role. We decide how account and website information is used, so for that information we are responsible as a “controller” or “business”. Tours belong to the customers who publish them. When we collect analytics about visitors to a customer’s tour, or process personal information inside the content a customer uploads, we act on that customer’s behalf as a “service provider” or “processor”. The customer’s own privacy practices also apply in those cases. If you contact us about a customer’s tour, we may refer you to that customer and help them respond.

This policy does not cover third-party websites, including sites where customers embed tours and sites linked from tours.

2. Information we collect

Information you give us

Account information: your name, email address and password. We store passwords only as salted hashes. We also store your workspace or company name, your role, and the email addresses of people you invite.
Billing information: your plan, billing period and subscription status, and the email we use as your billing contact. Stripe, our payment processor, collects and stores your card details. We never receive your full card number, but we can see limited details such as card brand, last four digits and expiry date.
Tour content: tour names and street addresses, room names, and property details such as type, bedrooms, bathrooms, area and price. It also includes hotspot labels, descriptions, links and the images or videos you upload, your brand name, color and logo, and any contact details you choose to show on a tour (name, email, phone, call-to-action link).
Communications: what you send us when you email or call us.

Information from scanning with the app

Photos: the photos taken during a scan. They show the space and anything in it, which can include people, personal belongings, documents or screens.
Camera data: camera position and orientation, lens settings, timestamps, exposure and a sharpness score for each photo. We use this to align photos into panoramas.
Room layout: floor outlines, floor and ceiling heights and, on supported iPhones, the positions of doors, windows and openings and the outlines and labels of furniture (for example, “sofa”).

Your phone uses depth and LiDAR data during a scan to measure floors and ceilings. We do not upload raw depth or LiDAR data. The app does not collect your GPS location, does not add location data to photos, and does not record audio. A scan stays on your phone until it uploads, which by default happens only on Wi-Fi.

Device and technical information

Device details: device model, operating system version, app version and whether the device has LiDAR.
Push token: if you allow notifications, a push notification token for your device.
Sign-in records: when you signed in and when your session was last used.
Request data: our servers and hosting provider automatically receive technical information with each request, such as IP address, browser or device type and the page or file requested. We use it to deliver and secure the Services. For example, we use IP addresses to limit repeated sign-in, sign-up and tour-password attempts.

Tour visitor analytics

When someone views a published tour, whether on scenava.com, on view.scenava.com or embedded on another site, the tour viewer records:

that the tour was viewed, and whether it was embedded;
which rooms were viewed and for how long;
clicks on hotspots and on the contact button;
changes between viewing modes;
the domain of the referring website (for example, example.com);
the visitor’s country, which our hosting provider derives from the IP address.

To count unique visitors, the viewer saves a random identifier in the browser’s local storage, along with a separate identifier for each visit. We do not store visitors’ IP addresses, full referring URLs or names with analytics, and we do not use cookies for analytics. Tour owners see this information as aggregate statistics, such as views, unique visitors, time per room and traffic sources. Visitors can reset the identifier by clearing their browser’s site data.

Our website

scenava.com does not use analytics or advertising cookies. It loads fonts from Google Fonts, so your browser sends your IP address and browser information to Google. Our dashboard and tour pages load the same fonts.

Information from third parties

Stripe tells us whether payments succeed and the status of your subscription. Apple and Google may give us aggregated statistics about app downloads and usage.

3. How we use information

To provide the Services: create accounts and workspaces, process scans into panoramas and tours, host and display tours, link your phone to your account, and notify you when a tour is ready.
To give tour owners analytics about how their tours are viewed.
For billing: process payments, manage trials and subscriptions, and prevent payment fraud.
To communicate with you: send service, security, billing and legal messages and respond to your requests. If we send marketing emails, you can unsubscribe at any time.
For safety and security: authenticate users, prevent abuse, fraud and illegal activity, and enforce our Terms of Service.
To fix and improve the Services: troubleshoot scans that fail, fix bugs and improve processing quality. Staff may look at captures only as far as needed for these purposes.
For legal reasons: comply with the law and legal process, and establish or defend legal claims.
With your consent, or as you direct.

We do not use your photos or tours to train machine-learning models. If that changes, we will update this policy and ask for your consent before using your content that way. We may create aggregated or de-identified information that cannot reasonably identify you or any individual, and use it for any lawful purpose.

When you publish

Anyone who can view a tour can see its photos, room names, property details, branding and any contact details you added. When a tour link is shared in a messaging app or on social media, a preview may show the tour’s name, address, property details and cover image. Search engines may index public tours. For unlisted and password-protected tours, we ask search engines not to index them, but anyone with the link can still open an unlisted tour.

Within your workspace

Members of a workspace can see each other’s names and email addresses, and the workspace’s tours and analytics, depending on their role. Workspace admins can access and manage content created in their workspace.

Service providers

We share information with companies that help us run the Services. They may use it only to provide services to us. We require them, by contract, to protect it with safeguards at least as protective as those described in this policy.

Provider	What they do for us	Information involved
Cloudflare, Inc.	Hosting, databases, file storage, scan processing, content delivery, security and logs	All categories described in this policy
Stripe, Inc.	Payments and subscriptions	Billing contact, workspace name, payment details
Expo (650 Industries, Inc.)	Sending push notifications, through Apple and Google’s notification services	Push token, notification text (such as a tour name and link)
Google LLC (Google Fonts)	Web fonts on our website, dashboard and tour pages	IP address and browser information

We do not send your photos, tours or other personal information to third-party AI services.

Platform providers

Apple and Google distribute our app under their own privacy policies. On Android, the app runs on Google Play Services for AR (ARCore), which is provided by Google and governed by the Google Privacy Policy.

Other disclosures

Legal and safety: to comply with law, subpoenas or court orders, and to protect the rights, property or safety of our users, the public or us.
Business transfers: in a merger, acquisition, financing, reorganization, sale of assets or bankruptcy. The commitments in this policy will continue to apply to the transferred information.
With your consent or at your direction.

We do not sell personal information. We do not share it for cross-context behavioral (targeted) advertising, and the Services contain no advertising trackers or SDKs. We have not done either of these in the past 12 months.

5. Cookies and local storage

We use a small number of cookies and browser storage items, all set by Scenava itself. None are used for advertising.

Name	Where	Purpose	How long
scn_session (cookie)	Dashboard	Keeps you signed in. Essential.	30 days, renewed while you use it
scn_t_… (cookie)	Password-protected tours	Remembers that you entered the tour’s password. Essential.	7 days
scn_vid (local storage)	Tour pages and embeds	Random identifier for counting unique visitors	Until you clear it
scenava.workspace, scenava.analytics-days (local storage)	Dashboard	Remember your selected workspace and analytics date range	Until you clear it

The mobile app keeps your sign-in token in the iOS Keychain or Android Keystore, and keeps scans in progress, settings and a cached tour list in the app’s private storage.

You can block or clear cookies and site data in your browser, but the dashboard and password-protected tours will not work without their essential cookies. We do not sell personal information or use it for targeted advertising, so Global Privacy Control and Do Not Track signals currently have nothing to opt you out of. If that ever changes, we will treat Global Privacy Control as a valid opt-out request.

6. How long we keep information

Information	How long we keep it
Account and workspace information	While your account is active. Deleted within 45 days after you ask us to delete your account, except as described below.
Original scan photos and capture data	While the tour exists, so we can re-process and improve it. Deleted when you delete the tour or your account.
Published panoramas, tour content and uploaded media	Until you delete them, the tour or your account.
Tour visitor analytics	While the tour exists, so owners can see historical statistics. Deleted with the tour.
Billing records	As long as needed for tax, accounting and legal purposes (generally up to 7 years). Stripe keeps its own records under its privacy policy.
Security records, such as sign-in sessions and rate-limit records	As long as reasonably needed for security and to prevent abuse.
Scans on your phone	Until they upload (the app then deletes them automatically), or until you delete the scan or the app. Signing out does not delete scans that have not uploaded.

Deleted information may remain in backups and caches for a short time. Images from public tours may also stay in browser, network or third-party caches, such as social media link previews, for some time after deletion. We do not control those copies. We may keep information longer if the law requires it, or to resolve disputes, prevent fraud or enforce our agreements.

7. Your choices and rights

In the Services

You can edit tour content, change who can see a tour, and delete tours from the dashboard at any time. You can turn off push notifications in your device settings. Workspace admins can remove members.

Your rights

Several U.S. states, including Tennessee and California, give residents privacy rights. We honor the following rights for all users, wherever they live:

Access: confirm whether we process your personal information and get a copy of it.
Correction: correct inaccurate personal information.
Deletion: delete your personal information, including your account.
Portability: get your personal information in a portable, commonly used format.
Opting out of the sale of personal information, targeted advertising and profiling. We do not do any of these.
Non-discrimination: we will not treat you differently for using your privacy rights.

How to make a request

Email privacy@scenava.com from the email address on your account, or write to us at the address below. To delete your account, use the account deletion option in the app or dashboard where available, or email us. Deleting your account deletes your tours, scans and their visitor analytics. If you are the only admin of a workspace that has other members, we will work with you on what happens to that workspace.

We verify requests by matching them to the information on your account, for example by confirming the request from your account email. You can use an authorized agent if they give us your signed permission and we can verify your identity. We respond within 45 days. If we need more time, we will tell you why, and may take up to 45 more days.

Appeals

If we decline your request, you can appeal by emailing privacy@scenava.com with the subject “Privacy appeal”. We will respond within 60 days and explain our decision. If we deny your appeal, you can contact your state attorney general. In Tennessee, that is the Tennessee Attorney General’s Division of Consumer Affairs.

Requests about someone else’s tour

If you visited, or appear in, a tour that one of our customers published, you can contact the tour owner. Their contact details are often shown on the tour. You can also contact us, and we will forward your request where appropriate or help you directly.

8. People and property shown in tours

Our customers decide which spaces to capture and publish. Our Terms of Service require them to have permission to capture and publish each space, and to remove identifiable people or get their consent.

We do not use facial recognition, do not try to detect or identify people in captures, and do not create or store biometric identifiers such as face geometry. The only automatic editing of people is removing the area directly beneath the camera, where the person scanning stands, from floor views. This is based on the camera’s position, not on recognizing anyone.

If you appear in a tour, or a tour shows your home or belongings without your permission, contact the tour owner or email us at privacy@scenava.com with the tour link. We will review the request and may remove or disable the content in line with our Terms and the law.

9. Security

We protect information with technical and organizational safeguards, including:

encryption in transit (HTTPS);
encryption at rest by our hosting provider;
passwords and sign-in tokens stored only as cryptographic hashes;
role-based access to workspaces;
original scan photos that are never publicly accessible.

No system is perfectly secure, so we cannot guarantee security. Use a strong password that you do not use anywhere else. If a security breach affects your personal information, we will notify you as the law requires.

10. Children

The Services are for adults, and you must be 18 or older to create an account. They are not directed to children under 13, and we do not knowingly collect personal information from them. If you think a child has given us personal information, contact us at privacy@scenava.com and we will delete it.

11. Where we process information

We are based in the United States, and the Services are intended for users in the United States. Our service providers, including Cloudflare, operate globally and may process information in the United States and other countries. If you use the Services from outside the United States, your information will be transferred to and processed in the United States, where privacy laws may differ from those where you live.

12. Additional disclosures for U.S. state residents

Some state laws, including California’s, require us to describe what we collect using specific categories. In the past 12 months, we collected the following:

Category	Examples	Disclosed to
Identifiers	Name, email, account ID, IP address, push token, random visitor ID	Service providers
Customer records	Name, email, phone (if added to a tour), billing details	Service providers; the public, for contact details you publish
Commercial information	Plan, subscription and payment history	Service providers
Internet or network activity	Tour views, time per room, clicks, referring domain, sign-in records	Service providers; tour owners
Approximate location	Country, derived from IP address (never precise location)	Service providers; tour owners
Audio, electronic or visual information	Photos taken during scans, images and videos you upload (no audio)	Service providers; the public, for tours you publish
Sensitive personal information	Account login (email and password)	Service providers, only to authenticate you

The sources, purposes and retention periods for this information are described above. We use sensitive personal information only to provide the Services, as the law permits, and never to infer characteristics about you. We do not sell personal information or share it for cross-context behavioral advertising. We do not disclose personal information to third parties for their own direct marketing.

13. Changes to this policy

We may update this policy from time to time. The “Last updated” date above shows the current version. Before a material change takes effect, we will notify you by email or in the Services. Where the law requires, we will ask for your consent.

14. Contact us

Questions or requests about privacy:

Simplisik LLC
Attn: Privacy
5510 Old Hickory Blvd, Suite B #32
Hermitage, TN 37076
Phone: (615) 879-5066
Email: privacy@scenava.com