Privacy Policy

Last updated: 2026-04-24

This policy explains how Diane ("Diane", "we") collects, uses and protects the personal data of users of the platform accessible at www.diane.estate (the "Platform"). It applies to real-estate agents, agencies and professionals who use Diane to generate automated video tours of their listings. For the Diane Import browser extension, see the separate policy at /privacy-extension.

1. Data controller

The data controller is Diane, the company operating the Platform. For any question regarding your personal data, contact [email protected].

2. Data we collect

We collect the following categories of data, depending on how you use the Platform:

  • Account data: first name, last name, email address, password (stored as a hash), organization name, role within the organization, preferred language.
  • Agent profile data: profile photo, cloned voice (voice fingerprint generated from an audio sample you provide), custom video signature.
  • Listing data: title, price, surface, description, features, address, photos and videos of the properties you create on the Platform.
  • AI-generated content: sales scripts, TTS audio, avatar videos and final rendered videos produced from your listings.
  • Billing data: subscription plan, payment history, invoiced amounts. Credit card data is never stored on our servers, it is handled directly by Stripe (see section 5).
  • Technical data: IP address, browser type, operating system, pages viewed, actions taken on the Platform, connection timestamps.
  • Analytics data: anonymised or pseudonymised usage events (logins, listing creations, video renders, errors).

3. Purposes and legal bases

  • Service delivery (contract performance): account creation, authentication, organization management, video creation and rendering, AI script and voice generation, final video delivery.
  • Billing (contract performance and legal obligation): subscription management, invoicing, collection.
  • Communication (contract performance and legitimate interest): transactional emails (welcome, video ready, password reset, team invites), status notifications.
  • Service improvement (legitimate interest): aggregated usage analysis, bug detection and resolution, improvement of the AI models used.
  • Security (legitimate interest and legal obligation): fraud detection, abuse prevention, security audits.
  • Legal obligations: retention of accounting records, responses to requests from competent authorities.

4. AI-generated content

The Platform uses AI models to generate sales scripts, synthetic voices and avatar videos from your listing data. This content is created at your request and remains your property. The AI providers we use (Anthropic, Cartesia, fal.ai) do not retain generated content for their own purposes and do not use it to train their models under our commercial agreements with them.

Cloned voice: if you provide an audio sample to generate a cloned voice, that sample and the associated voice fingerprint are stored on our servers and used exclusively to generate the audio for your videos. You may request their deletion at any time.

5. Subprocessors and third parties

We use technical subprocessors to operate the Platform. Each is subject to a GDPR-compliant contract and confidentiality commitments:

  • Microsoft Azure (Ireland / EU): database hosting, photo and video storage, processing queues.
  • Stripe (Ireland / United States): payment processing and subscription management. Stripe is PCI-DSS Level 1 certified.
  • Anthropic (United States): AI sales-script generation (Claude).
  • Cartesia (United States): voice synthesis, voice cloning and transcription of audio samples.
  • fal.ai (United States): avatar video generation from a photo and an audio track.
  • Brevo (France / EU): transactional email delivery.
  • PostHog (European Union): product usage analytics.

We do not sell or rent your data to third parties for commercial or advertising purposes.

6. Transfers outside the European Union

Some subprocessors are established outside the European Union (notably in the United States). In such cases, transfers are covered either by the EU–US Data Privacy Framework or by the standard contractual clauses adopted by the European Commission, supplemented where necessary by additional technical and organisational measures.

7. Retention periods

  • Account and listing data: throughout your subscription, and up to 90 days after account deletion.
  • Billing data: 10 years from invoice issuance, in accordance with French accounting obligations.
  • Technical logs: 12 months maximum.
  • Analytics data: 24 months in identifiable form, then aggregated anonymously.

8. Your rights

Under GDPR, you have the following rights over your personal data:

  • Right of access: obtain a copy of your data.
  • Right to rectification: correct inaccurate data.
  • Right to erasure: request deletion of your data, subject to legal retention obligations.
  • Right to object: object to processing based on legitimate interest.
  • Right to restriction: request temporary suspension of processing.
  • Right to portability: retrieve your data in a structured, reusable format.
  • Right to withdraw consent at any time, where processing is based on consent.

These rights can be exercised directly from your account (settings) or by writing to [email protected]. You also have the right to lodge a complaint with a supervisory authority (CNIL in France: www.cnil.fr).

9. Cookies

The Platform uses cookies strictly necessary for the service to function (authenticated session, preferences) and usage-analytics cookies (PostHog). No third-party advertising cookies are set. You can manage your preferences through your browser settings.

10. Security

We implement appropriate technical and organisational measures to protect your data: encryption in transit (TLS 1.3) and at rest, role-based access controls, regular audits, backups, password hashing (Argon2), authenticated sessions via Better Auth.

11. Minors

The Platform is intended for professional use and is not available to minors under 16. We do not knowingly collect data from minors.

12. Changes

This policy may be updated to reflect changes in the Platform or legal obligations. The last-updated date appears at the top of this document. Material changes are notified by email to active users at least 30 days before they take effect.

13. Contact

For any question regarding this policy, your rights or the processing of your data, contact [email protected].