1. Who we are
YouIn360 is an immersive-media studio based in Wicklow, Ireland, operated as a sole-trader by Filipe Miranda. In this Policy, "YouIn360", "we", "us" and "our" refer to this business. Our website is www.youin360.com.
For any privacy-related question — including to exercise your rights below — write to hello@youin360.com. We are the data controller for the personal data described in this Policy.
📝 Placeholder: add your registered business address and VAT number here once finalised for full GDPR Article 13 compliance.
2. What data we collect
2.1 You send it to us
- Contact & booking forms — name, email, phone, company, the message you typed and any project details you share (budget, deadline, address of the location to film).
- Account & portal — email and (if you sign in with Google) your Google display name and profile picture. We never see or store your password.
- Payments — your billing details, card information and address go directly to Stripe Payments Europe Ltd. We only receive the transaction summary (amount, plan, last 4 digits, customer ID).
2.2 Collected automatically
- Server logs — IP address, browser user-agent and referrer URL, retained for up to 90 days to investigate abuse and protect the site.
- Cookies & similar technologies — only the minimum needed to keep you logged in and remember your cookie preferences. We use additional analytics or marketing cookies only with your consent. See our Cookie Policy for the full breakdown.
2.3 Visual content of you or your property
When we deliver photo, video or drone work for a client, we capture images of the location and may capture identifiable individuals (staff, visitors, residents). The client is responsible for obtaining consent from anyone we record on their premises. Where YouIn360 hosts the final media (e.g. a public 360° tour), we provide a take-down channel at hello@youin360.com.
3. Why we use it (legal basis under GDPR Art. 6)
- Performance of a contract (Art. 6(1)(b)) — to deliver a quote, run a project, send invoices, host your project files and reply to support.
- Legitimate interest (Art. 6(1)(f)) — to keep the site secure, prevent fraud, maintain server logs, and reply to inbound enquiries. You can object at any time.
- Consent (Art. 6(1)(a)) — for non-essential cookies (analytics, marketing) and for any direct-marketing email you opt in to. Withdrawable at any time without affecting prior processing.
- Legal obligation (Art. 6(1)(c)) — to keep invoices and tax records for the period required by Irish Revenue (currently 6 years).
4. Who we share it with (processors)
We do not sell personal data. Ever. We share it only with the third-party processors needed to deliver the service:
- Google LLC — Firebase Hosting, Firestore (database), Firebase Auth, Firebase Storage (file delivery) and Gemini (AI lead qualification). Data processed in EU regions where available; transfers to the US are covered by the EU-US Data Privacy Framework.
- Stripe Payments Europe Ltd. — payment processing. Ireland-based controller for card data.
- Anthropic PBC — Claude is used to generate destination page drafts (you are not the subject of these calls) and may be used to summarise discovery notes for briefings.
- Telegram FZ-LLC — internal team notifications about new leads and payments. Only the metadata we describe in Section 2 is forwarded.
- n8n GmbH (or our self-hosted n8n instance at
n8n.youin360.ie) — workflow orchestration between the site and the other processors.
Where any processor lies outside the EU, we rely on Standard Contractual Clauses or an adequacy decision under GDPR Chapter V.
5. How long we keep it
- Contact-form submissions / leads: 24 months from last interaction.
- Client project files & deliverables: for the life of the engagement plus 3 years.
- Invoices and tax records: 6 years (Irish Revenue requirement).
- Server logs: 90 days.
- Cookies: as set out in the Cookie Policy.
6. Your rights
Under GDPR you have the right to:
- access the personal data we hold about you (Art. 15);
- have inaccurate data corrected (Art. 16);
- have your data erased where there is no legal reason for us to keep it (Art. 17);
- ask us to restrict processing while a complaint is being resolved (Art. 18);
- receive a copy of the data you gave us in a portable format (Art. 20);
- object to processing based on legitimate interests (Art. 21);
- withdraw consent at any time where consent is the legal basis.
To exercise any right, email hello@youin360.com from the address we have on file. We respond within 30 days as required by GDPR.
7. Complaints to the Irish DPC
If you believe we have not handled your data lawfully, you are entitled to lodge a complaint with the Data Protection Commission (the Irish supervisory authority): visit dataprotection.ie or write to 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland.
8. Security
We host on Google Cloud infrastructure with TLS in transit and Google-managed encryption at rest. Production credentials and signing secrets are stored in environment variables — never in source control. Access to client deliveries is enforced server-side by Firestore security rules: signed-in clients see only the projects assigned to their email address.
9. Children
YouIn360 services are aimed at businesses. We do not knowingly collect personal data from anyone under 16. If you believe a child has submitted data, contact us and we will delete it.
10. Changes to this Policy
We may update this Policy when we add a new processor, change our retention periods, or for legal reasons. The effective date at the top of this page tracks the most recent revision. Material changes are also announced on our home page banner for 30 days.