AInventoryPrivacy Policy
Last updated: 26 October 2026
In short: your photos and inventory are stored privately in the EU (Stockholm, Sweden). Only the picture of one object at a time is sent to an AI model, never the photo of a whole room. With bought credits, AI providers may not keep or train on your data. We sell nothing and show no ads.
1. Controller
Israel Choque Gutierrez, trading as Gutierrez SoftwareLerchenauer Str. 298B, 80995 München, Germany
Email: contact@ainventory.de
We are responsible for the processing of personal data in AInventory and on ainventory.de under the EU General Data Protection Regulation (GDPR).
2. What we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| Account: email address, name if you give one, user ID (through our login provider Clerk) | Sign-in, your account, service emails (for example before an inactive account is deleted) | Art. 6(1)(b) GDPR (contract) |
| Your inventory: photos you upload (the cut-out picture of each object, a small preview, the whole photo if you keep it, photos of places), item names, descriptions, categories, details, places, quantities, hints you type for the AI | Providing the inventory, recognising objects, showing your items on your devices | Art. 6(1)(b) GDPR |
| Search data: searches by meaning, and "vectors" (lists of numbers that describe an item's text, made by an AI model) for each item | Search by meaning, warnings about possible duplicates | Art. 6(1)(b) GDPR |
| Credits: balance and every credit added or spent, with the reason | Charging for AI actions, showing your history, refunds | Art. 6(1)(b) GDPR |
| Payments (handled by Paddle; we receive the transaction ID, pack, amount and date, never card details) | Adding credits, refunds, accounting | Art. 6(1)(b) and (c) GDPR (contract, tax law) |
| Access keys for AI assistants (MCP): name, creation and expiry date, last use; the key itself is stored only as a hash | Letting assistants you choose read your inventory; daily limits | Art. 6(1)(b) GDPR |
| Consent to free processing and when you gave it | Using free AI models for free credits (section 3) | Art. 6(1)(a) GDPR (consent) |
| Technical data: IP address, time, requested address, browser type, error messages | Operating the service, security, preventing abuse; server logs are deleted after 7 days | Art. 6(1)(f) GDPR (legitimate interest in a secure service) |
| Messages you send us | Answering you | Art. 6(1)(b) or (f) GDPR |
We do not sell personal data, show no advertising and build no advertising profiles. We don't use your photos to train AI models, and with bought credits our AI providers may not either.
3. How the AI sees your photos
- Objects are found on your device. Only the cut-out picture of each object you confirm (at most 512 pixels), any hint you typed and your list of category names are sent to an AI model. The photo of the whole scene is never sent to an AI model.
- Requests go through OpenRouter, which forwards them to the provider of the AI model (currently mainly Google's Gemini models) and doesn't keep their content.
- With bought credits (and for vectors, always), requests are only sent to providers that don't store the content after answering and don't use it for training ("zero data retention").
- With free credits, and only after you agree in the app, items may be processed by free AI models. Their providers may store the pictures and text and use them to improve their models. You can withdraw your consent at any time by email; free credits are then no longer used for AI actions. Items paid with bought credits never go to free models.
- A Gold scan also searches the web: the AI model writes search terms (for example a brand and model name), which are sent to the search provider Exa. No pictures are sent to the search provider.
4. Service providers
| Provider | Role | Location |
|---|---|---|
| Amazon Web Services EMEA SARL | Hosting, database, storage of photos, this website | Stockholm, Sweden (EU) |
| Clerk, Inc. | Sign-in and account management | USA |
| OpenRouter, Inc. | Forwarding requests to AI models | USA |
| AI model providers chosen through OpenRouter, currently mainly Google LLC; for free credits also other providers of free models | Recognising objects, writing descriptions, vectors | USA and other countries |
| Exa Labs, Inc. | Web search for Gold scans (search terms only) | USA |
| Paddle.com Market Ltd | Merchant of Record: checkout, payment, invoices, tax. Paddle acts as an independent controller under its own privacy policy. | UK / EU |
| Namecheap, Inc.; Google LLC (Gmail) | Forwarding and storing emails you send to @ainventory.de addresses | USA |
Transfers to the USA and other countries outside the EU rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the EU Standard Contractual Clauses (Art. 46 GDPR). We have data processing agreements with our processors.
5. Cookies and storage in your browser
This website (ainventory.de) sets no cookies and uses no analytics. The app uses only what it needs: Clerk's login session cookies, cookies set by Paddle's checkout while you pay, and your browser's storage for preferences (language, design, light or dark mode) and for a copy of your own pictures, so they don't have to be downloaded again. We use no advertising or tracking cookies, so no consent banner is needed (§ 25(2) TDDDG).
6. How long we keep data
- Inventory and account data: while your account exists. An item you delete is removed with its pictures and vectors.
- When you ask us to delete your account, we delete it, with all pictures, within 30 days. Database backups are overwritten within a further 35 days.
- Accounts that have never bought a pack and have not been signed in to for 24 months are deleted after an email warning 30 days before.
- Purchase records we must keep for tax law: up to 10 years.
- Server logs: 7 days. Uploads that were never used: 1 day.
7. Your rights
You can ask for access (Art. 15), correction (Art. 16), deletion (Art. 17), restriction (Art. 18) and a copy of your data (Art. 20; the app's export gives you your inventory as a file at any time), and you can object to processing based on legitimate interest (Art. 21). You can withdraw consent at any time, with effect for the future (Art. 7(3)). Write to contact@ainventory.de.
You also have the right to complain to a data protection supervisory authority, for example the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach) or the authority of the country where you live.
8. Children
AInventory is not meant for people under 16, and we don't knowingly process their data.
9. Changes
We update this policy when our service changes. The date at the top shows the latest version. We tell account holders about important changes by email.