Privacy Policy

Last updated: November 2026

In brief

This website does not set any cookies for visitors, does not measure visits and does not load anything from third-party servers. We only process your data if you write to us, call us or book an appointment, and only for that purpose.

For our platform for virtual tours, the information in the section REALONAUT 360 also applies, including to anyone who views a tour.

Controller

REALONAUT GmbH, Feldgasse 12, 1080 Vienna, Austria
Phone +43 650 283 37 87, email office@realonaut.com

Hosting and server logs

The website is hosted by easyname GmbH in Vienna. Each time a page is accessed, the server automatically stores technical information: IP address, date and time, the address accessed, browser and operating system. This is necessary to deliver the page and to detect attacks. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) of the General Data Protection Regulation, GDPR). We have concluded a data processing agreement with easyname. The logs are deleted automatically in line with easyname's retention periods. We also send our emails, such as the confirmation of an appointment booking, via easyname.

Cookies, analytics, fonts

This website does not set any cookies for visitors. There is no visitor analytics and there are no advertising or social media scripts. Cookies are only set when we ourselves sign in to maintain the website. If you come to this website through a Google ad, the address contains a click ID from Google. The website only passes it on to the REALONAUT 360 sign-up link and does not store it.

The fonts are stored on our own server. No data is transferred to third parties to load them.

Phone calls and email

If you call us or write to us, we process your details in order to answer your enquiry and, where applicable, to prepare a quotation (Art. 6(1)(b) GDPR). We keep the correspondence for as long as necessary for the enquiry. If it leads to an order, the statutory retention periods apply, usually seven years.

Emails to customers and former customers

We send information about current contracts and news about our services using the WordPress plugin MailPoet, which runs on this website, via our own email mailbox at our hosting provider in Austria. For this purpose we store your email address, your first name and surname and whether you wish to receive the emails. We do not analyse opens or clicks.

We send you information about your contract in order to perform the contract (Art. 6(1)(b) GDPR). We inform former customers about our services on the basis of our legitimate interest (Art. 6(1)(f) GDPR). Every email contains a link to unsubscribe; you can also object informally by email at any time. After that, we will not send you any more such emails and will remove your details from the list.

Booking an appointment

Appointment booking is part of this website and works without an external provider. When you book an appointment, we process your name, your email address, the selected appointment and, if you provide them, your business, your phone number and what you would like to discuss.

We use this information to enter the appointment, to send you and us a confirmation with a calendar entry and to prepare for the conversation (Art. 6(1)(b) GDPR). The booking is deleted automatically 30 days after the appointment. Anything retained beyond that, such as email correspondence, is governed by the section “Phone calls and email”.

To prevent misuse, we store a short encrypted value derived from your IP address for no more than one hour, in order to prevent more than three bookings per hour (Art. 6(1)(f) GDPR).

The website checks which times are available on our server, using our own calendar. No data about you is transferred to the calendar provider in the process. If we add your appointment to our calendar, it is stored with Apple (iCloud). Apple participates in the EU-US Data Privacy Framework.

We hold the conversation itself via FaceTime. If you follow the link in the confirmation, Apple processes the data required for the video call, such as your display name and connection data. FaceTime calls are end-to-end encrypted. If you prefer another way, such as a phone call, just let us know.

Videos in posts

If a post contains a video from YouTube or Vimeo, you initially only see a placeholder. The video, and with it a connection to the provider, is only loaded when you click “Play video”. We then load YouTube videos via youtube-nocookie.com and Vimeo videos with the “do not track” setting.

REALONAUT 360

REALONAUT 360 is our platform on which companies, especially estate agencies, create and publish virtual 360-degree tours. This section applies to accounts on the platform and to anyone who views a tour, either directly or embedded on another website.

Our role regarding the content of tours

Photos, floor plans, texts and contact details in a tour are added by the company that created the tour. That company is the controller for this content; we process it on its behalf on the basis of a data processing agreement (Art. 28 GDPR). If you have questions about the content, for example because you appear in a photo, please contact that company first. We forward any requests that reach us.

Account and registration

When you register, we process the company name, your first name and surname, your email address and your password. We store the password only in encrypted form as a verification value, never in plain text. We also store when you accepted the General Terms and Conditions and the Data Processing Agreement, and which version. You confirm your email address via an email we send you. If you are invited by your company, an authorised person in your company has entered your name, your email address and your role; you set your password yourself.

You may voluntarily provide a title, phone number, mobile number and profile picture. This information is public: it appears in the tours you manage. Depending on the plan, your company's logo and link as well as a phone number and email address for enquiries also appear in its tours.

The purpose is to provide the platform and to perform the contract with your company (Art. 6(1)(b) GDPR); for invited employees, the legitimate interest of your company and of us in the use of the platform (Art. 6(1)(f) GDPR). We store the data for as long as the account exists. If an account is deleted, the tours it managed remain with the company and then show the company's contact details.

If you reach the registration page via a link containing information about where you came from (for example from our newsletter or from a partner), we store this information (source, medium, campaign) with your company, so that we can see how customers find us. We do not set an additional cookie for this and do not store an IP address; we do not pass the information on. The legal basis is our legitimate interest in measuring our reach (Art. 6(1)(f) GDPR). We delete it together with the company, at the latest two years after registration.

If you reach the sign-up page through one of our ads on Google, the address contains a click ID from Google. We store this ID with your company, together with the details of where you came from, so that we can see which ads lead to sign-ups (Art. 6(1)(f) GDPR). We do not set a cookie for this, and no Google script runs on our pages.

Only if you tick the separate, optional box when signing up do we tell Google once a week that the click led to a sign-up and, where applicable, to the first paid subscription. We only send the click ID, the time, the type (sign-up or subscription), the amount for a subscription and an internal number without name or email address. We do not tell Google who you are, and we do not allow Google to use the data for personalised advertising. The legal basis is your consent (Art. 6(1)(a) GDPR). We record when you gave it.

Google processes the data as an independent controller: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google may also process data in the USA; the transfer is covered by the EU-US Data Privacy Framework. Google's privacy policy applies (policies.google.com/privacy).

You can withdraw your consent at any time with effect for the future, for example by email to support@realonaut.com. After that we no longer report anything to Google and delete the click ID. Otherwise we delete it at the latest 120 days after sign-up.

Signing in and security

After you sign in, the platform sets technically necessary cookies: a session cookie that expires after 120 minutes of inactivity, and a cookie that protects against forged requests. If you select “Stay signed in”, a further cookie is added that recognises you for 30 days. The platform does not set advertising or analytics cookies. For each session we store the IP address and browser identifier, so that we can detect misuse and end sessions. Expired sessions are deleted automatically on an ongoing basis.

We limit the number of sign-in attempts. For a second factor, we send you a code by email or you use an authenticator app; we store codes and keys only in encrypted form or as a verification value.

We log important changes: who changed what and when, for example roles, blocks, deletions, changed email addresses and transfers of tours, with the state before and after, never passwords. We delete this log after three years. Transfers of a tour also remain recorded with the tour for as long as it exists. The legal basis is the performance of the contract and our legitimate interest in secure operation (Art. 6(1)(b) and (f), Art. 32 GDPR).

Support requests

If you send a request to our support team on the platform, we store the topic, subject, your messages and our replies, together with your account, your company and, if you select one, the tour concerned. We also store the page of the platform from which you sent the request. Only if you report a bug do we additionally store your browser identifier, so that we can reproduce the bug. We do not accept attachments.

The request can be seen by you, the owners and admins of your company and our administrators. We do not pass requests on to an external support service. We notify you of new replies by email; the email contains only the number, the subject and a link, not the text of the message. The legal basis is handling your request under the contract with your company (Art. 6(1)(b) GDPR) or our legitimate interest in a functioning support service (Art. 6(1)(f) GDPR).

If we have replied and you do not respond for 30 days, the request is considered resolved. We delete resolved requests, including their history, three years later. We will delete a request at any time on request.

Reporting content

Using the “Report content” link in the tour or at realonaut.com/en/report/, you can notify us of content that you consider illegal. In doing so, we process the tour and room concerned, your explanation of the reasons and, if you provide them, your name and email address. We do not store the notice on the website; we send it by email to our support mailbox. If you provide your email address, you receive an acknowledgement of receipt and our decision. The legal basis is our obligation under the Digital Services Act (Art. 16 of Regulation (EU) 2022/2065, DSA; Art. 6(1)(c) GDPR). To prevent misuse, we store a short encrypted value derived from your IP address for no more than one hour (Art. 6(1)(f) GDPR).

We do not pass on your name and email address to the company whose tour is concerned without your consent. We delete the notice three years after the review has been completed.

Emails

We send you the emails that are necessary for using the platform, such as invitations, confirmation of your email address, codes for the second factor, password resets and security notices. We only send news and offers if you ticked the separate, voluntary box for this when registering (Art. 6(1)(a) GDPR and section 174 of the Austrian Telecommunications Act 2021, TKG 2021, which governs electronic marketing messages). We store when you gave your consent. You can withdraw your consent at any time, for example by email to support@realonaut.com. We send the emails via a mailbox at easyname GmbH in Vienna.

Payments and VAT ID verification

We process paid plans via the payment service Stripe. You enter card details directly with Stripe; they do not reach us. We transmit to Stripe the company name, the email address of the person managing the account, the address, the VAT identification number (VAT ID), the language and our internal customer number. We store the customer number at Stripe, the type and last four digits of the payment method and the status of the subscription.

The contractual partner for payment processing is Stripe Payments Europe, Limited, Dublin, Ireland. Stripe processes the payment data as an independent controller. Stripe may also process data in the USA; the transfer is safeguarded by the EU-US Data Privacy Framework and standard contractual clauses.

Before you book a paid plan, we verify your VAT ID via the EU VAT Information Exchange System (VIES). In doing so, we transmit your VAT ID, your company name and your address as well as our own VAT ID, and store the result with the time, the confirmation number and the match of name and address. The legal basis is the performance of the contract and our tax obligations (Art. 6(1)(b) and (c) GDPR). We retain invoice data for the statutory periods, usually seven years.

Photos and metadata

360-degree photos contain technical information (EXIF), often including the location where they were taken. We store this information in order to process the images correctly, but we never publish the location. Areas that a company blurs in the editor are rendered into the image on our own server; the original remains private and is deleted together with the room. We only pass photos on to artificial intelligence services if a company orders an add-on service that requires this.

When you view a tour

When you open a tour, your browser transmits, for technical reasons, the IP address, the time, the address accessed, the browser identifier and, where applicable, the address of the website in which the tour is embedded. We use this information to deliver the tour and to defend against attacks (Art. 6(1)(f) GDPR). We delete the server logs containing IP addresses after 14 days. If a tour is embedded on another website, that website's privacy policy also applies.

So that companies can see how often their tours are viewed, we count views, viewing time, device type, the embedding website and the rooms viewed. For this we set no cookies, store no IP addresses and create no profiles. We only distinguish visitors by a value that changes every day, so that nobody is recognised across several days. The value is based on a random value that expires after two days. We delete individual views after seven days; after that, only daily totals without any personal reference remain. The legal basis is our legitimate interest, and that of our customers, in measuring reach (Art. 6(1)(f) GDPR).

Fonts, images and program code of the tours come from our own server; services such as Google Fonts, Google Analytics or advertising networks are not loaded.

Access to locked rooms

Some companies only show individual rooms of a tour on request. If you request access, we process your name, your email address, your phone number (if you provide it), the language of the request, the tour requested and the proof of your request (times, wording, shortened IP address) on behalf of the company that publishes the tour. That company is the controller; its privacy policy is linked in the form. We delete unconfirmed requests after 7 days and all other requests 12 months after the last activity. If you end contact via the link in our emails, we delete your name, email address and phone number immediately; we keep the proof until the end of that period. If you enter an access code, the tour stores an access key in your browser's storage, so that you do not have to enter the code again each time you visit; the key becomes invalid when the access expires, at the latest after 30 days. The tour does not set any cookies.

Where the data is stored and who receives it

We operate the platform on servers of Hetzner Online GmbH in Nuremberg, Germany; the images are also stored there. Backups are kept on separate Hetzner storage in the European Union. We send emails via easyname GmbH in Vienna. We only pass on data where this is necessary for operation, and only to service providers working on our behalf under Art. 28 GDPR: for hosting and backups (Hetzner) and for sending emails (easyname). Payments are handled by Stripe as an independent controller (see above). If you have consented, we report a sign-up through an ad to Google (see “Signing up through a Google ad”). We continue to operate the previous REALONAUT system at ipax in Vienna for as long as individual customers still use it; the data from the period before 17 October 2026 is also stored there. To safeguard the migration, we also keep a copy of this data on our own server in Vienna, accessible only to our administrators. We will delete both as soon as they are no longer needed. Within your company, authorised persons see the data that their role requires. Our administrators only access data where this is necessary for operation and support; every change they make is logged.

For companies that used REALONAUT before 17 October 2026, we transferred the company, the active users with name, email address and encrypted password, and the tours from the previous system, so that they can continue working without interruption (Art. 6(1)(b) GDPR). We did not transfer users who were no longer active. The company confirms the new General Terms and Conditions and the Data Processing Agreement when it first signs in.

How long we store data

Account and profile
until the account is deleted
Tours
until deleted by the company; after the company or account has been deleted, 14 days, during which the deletion can be reversed
Origin of registration
until the company is deleted, for no more than two years
Click ID from a Google ad
120 days after sign-up
Log of important changes
three years
Support requests
three years after resolution, including their history
Access requests to locked rooms
7 days without confirmation, otherwise 12 months after the last activity
Notices about content
three years after the review has been completed
“Stay signed in”
30 days
Server logs of the platform
14 days
Individual views recorded for statistics
seven days, then only daily totals without any personal reference
Backups
no more than six months; deleted content may remain in backups for that period
Invoices
statutory retention period, usually seven years

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection. To exercise these rights, please contact office@realonaut.com.

If you believe that the processing of your data infringes data protection law, you can lodge a complaint with the Österreichische Datenschutzbehörde (Austrian Data Protection Authority): Barichgasse 40 to 42, 1030 Vienna, dsb.gv.at.

Call Book a call