You own a virtual tour only to the extent that you can export it, move it and delete it without asking permission. Copyright in your photos is usually yours, but the tour files, the hosting account and the visitor data are governed by your provider's terms, your contracts with clients and, if you reach California residents, privacy law. This guide explains each layer, shows what to check before you sign up, and compares cloud-hosted and self-hosted setups for U.S. operators.
TL;DR
- Ownership of a virtual tour has three layers: the original images and video, the finished tour (project files, hotspots, layout) and the visitor data the tour generates. Each is governed by different rules.
- The person who takes a photograph is generally its copyright owner, unless a work-for-hire arrangement or a written agreement says otherwise.
- The CCPA can apply to tour operators who do business in California and meet its thresholds, because IP addresses, device IDs, geolocation and images can count as personal information.
- Before you commit to any platform, confirm in writing that you can export originals and the finished tour, and that your data can be deleted.
- Self-hosting gives you the most control but also makes you responsible for security and privacy notices.
Table of Contents
- The three layers of virtual tour data
- Who owns the photos and the tour content
- What platform terms can quietly take from you
- Visitor data and the CCPA
- Cloud-hosted vs. self-hosted: who controls what
- A pre-purchase checklist
- How we approach ownership at Simple Virtual Tour
- Our perspective
- FAQ
- Sources
The three layers of virtual tour data
People use "data ownership" to mean several different things, and mixing them up is how disputes start. It helps to separate them.
1. Source media. These are the equirectangular panoramas, photos, videos, audio and any 3D or floor plan files you captured or commissioned. Our guide to virtual tour file formats explains what each type is and why keeping originals matters.
2. The assembled tour. This is the work you build from that media: scene order, hotspots, custom branding, embedded forms, translations and settings. On many hosted platforms, this exists only inside the provider's system in a format you cannot open elsewhere.
3. Visitor and lead data. Everything the tour collects about people: analytics events, contact form entries, IP addresses, device information and, in live sessions, anything participants say or share.
A useful test for each layer is simple. Can you get a complete copy, can you move it to another system, and can you make it disappear when you choose? If the answer to any of these is "only through the vendor," you have a license to use the tour, not ownership of it.
Who owns the photos and the tour content
In the United States, the author and initial copyright owner of an original photograph is generally the person who takes it, and protection exists as soon as the work is fixed in a tangible form. That means a freelance photographer who shoots a property usually owns the panoramas by default, not the agent or homeowner who hired them.
There is a narrow exception. Under the limited works-made-for-hire rules, the employer or commissioning party becomes the author when the photographer creates the work within the scope of employment, or under an express written agreement for a purpose the statute identifies. A casual email saying "please shoot the listing" does not reliably create that arrangement.
What this means in practice:
- If you are a photographer or drone operator, put in your service agreement who owns the originals, what license the client receives (for example, to display the tour online and in marketing) and for how long.
- If you hire a photographer, get the license in writing and ask for the right to receive the raw panoramas, not only a link to a finished tour.
- If you are a business owner with staff shooting, employee work is typically treated differently from contractor work, so confirm with an attorney how your arrangement is classified.
Copyright in the photos also does not settle the platform question. You can own every image and still be unable to take the finished tour elsewhere because the platform stores it in a closed format. That second question is a contract and architecture issue.
What platform terms can quietly take from you
Most disputes about virtual tour ownership are not about copyright. They are about access, and they arrive at the worst moment: when a subscription lapses, a client changes agencies, or a provider changes its pricing or shuts down.
Read the terms of service and privacy policy for these points before you upload a single scene:
- License you grant the provider. Providers often need a license to host and display your content. Check that it is limited to operating your service and ends when you delete the content.
- Export rights. Can you download your original images, the finished tour and your settings, and in what format? Industry guidance recommends treating raw 360° images, floor plan exports and essential metadata as non-negotiable deliverables and asking for open formats instead of vendor-specific project files.
- What happens when you stop paying. Does the tour go offline immediately, stay for a grace period, or get deleted? For how long does the provider keep your files? If the terms are silent, ask support and keep the answer in writing.
- Deletion. Can you delete your content and account yourself, and does the provider also remove backups and analytics records?
- Use of your content. Check whether the provider may use your uploads to train models, create marketing samples or share data with third parties.
- Subprocessors and data location. Know which companies handle your visitors' data and where it is stored.
- Change and termination clauses. Note whether the provider can change terms or pricing unilaterally and how much notice you get.
The pattern to avoid is the one many tour creators describe online: paying a monthly fee only to keep tours you built alive. That is a legitimate business model, but it should be a choice you make with open eyes, not a surprise.
Visitor data and the CCPA
A virtual tour feels like a picture, but technically it is a website. It can log visits, run analytics, load third-party scripts and collect form entries. That makes privacy law relevant even for a small operator.
When the CCPA applies
The California Consumer Privacy Act applies to for-profit businesses that do business in California and meet any one of three thresholds. The California Attorney General lists them: gross annual revenue over $25 million; buying, selling or sharing the personal information of 100,000 or more California residents or households; or earning 50% or more of annual revenue from selling California residents' personal information.
A solo photographer will often fall below these thresholds. But two things change the picture. First, your clients, such as brokerages, hotel groups and dealerships, may be covered, and they will push privacy obligations down to you through contracts. Second, the thresholds are about residents and households, so a popular tour embedded on a busy site can add up faster than you expect. If you are unsure whether you are covered, a California privacy attorney can tell you in one consultation.
What counts as personal information in a tour
The statute is broad. California's statute covers digital text, image, audio and video files, metadata, IP addresses, online identifiers, browsing or network activity, geolocation, visual information and inferences, when they are linked or reasonably linkable to a consumer or household. In a virtual tour, those categories can arise from:
- tour media that shows people, license plates or documents;
- analytics and heatmaps of where visitors look and how long they stay;
- contact, booking and lead forms;
- embedded third-party trackers and ad pixels;
- recordings or chat in live sessions.
If you want a plain-language primer on how IP addresses, device identifiers, geolocation and browsing activity add up to a trail about a person, this explainer on digital footprints for businesses is a good starting point.
Duties that follow
For covered businesses, the Attorney General's CCPA page explains that California consumers can ask to know, delete, correct, or opt out of the sale or sharing of their personal information, and can limit the use of sensitive personal information. Covered businesses must respond to those requests and give required notices.
The statute also asks for discipline about retention and vendors. Under Civil Code section 1798.100, a covered business must disclose how long it keeps each category of personal information, or the criteria it uses to decide, and may keep it only as long as reasonably necessary for the disclosed purpose. It must also use reasonable security and have written controls in place for service providers that handle the data.
That last point is where platform choice matters. Law firm guidance on CCPA vendor contracts describes typical required terms: limited and specified purposes for the data, a duty to give the same level of privacy protection the CCPA requires, and a duty to tell the business if the vendor can no longer meet its obligations. If your tour provider cannot sign a data processing agreement or explain its terms in these areas, that is a red flag.
For a hands-on action plan, see our guide to fixing virtual tour data privacy in 72 hours, and if you also serve European visitors, three steps to make virtual tours GDPR compliant. Analytics need particular care, which we cover in virtual tour analytics with GA4.
This article is general information, not legal advice. For whether the CCPA covers your business, or how to word a client contract, talk to a privacy or business attorney licensed in your state.
Cloud-hosted vs. self-hosted: who controls what
Where a tour lives decides who can touch it. Here is how the two models differ in practice.
| Question | Cloud-hosted | Self-hosted |
|---|---|---|
| Where are files and visitor data stored? | On the provider's infrastructure | On your own server or hosting account |
| Who can access the raw data? | You and the provider | You, and whoever you grant access to |
| Who handles security and updates? | Mostly the provider | You or your hosting company |
| Privacy role of the provider | Usually a service provider or processor you need a contract with | None for your data, though your hosting company still handles it |
| What happens if you stop paying? | Depends on the provider's terms | Software and tours stay on your server |
| Upfront effort | Lowest: sign up and start | Higher: install and maintain |
Neither model is automatically better. Cloud hosting is faster to start and removes maintenance. Self-hosting gives you the most control over data, and it can reduce ongoing costs, but it also moves responsibility to you: you need to secure the server, apply updates, back up files and publish your own privacy notice. A self-hosted tour does not exempt you from privacy law. It simply removes one third party from the chain.
If you resell tours to clients on separate accounts, add a third question: can one client ever see another's data? Our procurement checklist for multi-tenant virtual tours shows how to test that. For a wider view of how hosting models fit into platform selection, see our comparison of virtual tour software.
A pre-purchase checklist
Use this before you move any tours onto a platform, or when you review the one you already have.
- Keep your originals. Store source panoramas, photos and video in your own backup, never only inside a platform.
- Do a test export. On a trial account, try to export a tour. Note what you get: files, a package, or nothing usable.
- Ask about lapse and cancellation in writing. Get the answer on what happens to live tours and stored files, and how long they are kept.
- Request a data processing agreement if you handle consumer data for covered clients.
- Audit your embeds. List every script, pixel and form on the tour page and remove what you do not need.
- Reduce what you collect. Gather only the visitor data you can justify, and set retention periods you can state publicly.
- Write ownership into client contracts. Spell out who owns originals, who owns the assembled tour, and who keeps the leads.
- Plan for deletion requests. Know who on your team receives them and how you will find a person's records across forms, analytics and email.
If you share tour data for analytics or reporting, our piece on why anonymization fails at the seams explains why removing a name is rarely enough.
How we approach ownership at Simple Virtual Tour
We built Simple Virtual Tour around a simple idea: you should decide where your tours live. You can use our cloud-hosted plans, or run the software on your own server with the source code. The cloud plans are billed monthly: Free Forever, then XS (Starter) at €2.99 per month, S (Creator) at €5.99, M (Professional) at €9.99, L (Business) at €19.99 and XL (Enterprise) at €49.99. The self-hosted CORE software is a one-off $79 purchase, with optional paid plugins: the SaaS plugin at $269, the Google Street View plugin at $59 and the A.I. Tools plugin at $39, each one-off.
Whichever option you pick, the questions in the checklist above still apply, and we encourage you to test them on our free plan before you commit.
If you want to try it, start with Free Forever on our site or go straight to the plans and self-hosted options.
Our perspective
We have seen the same pattern many times: someone builds dozens of tours, then discovers that their work depends on a subscription they cannot leave. That is why we offer both deployment models, with self-hosting that includes full source code ownership, and why we think of ownership as a design decision, not a legal footnote.
For most small operators, we would start with this question: if this provider vanished tomorrow, what could I still publish? If the answer is "my originals and a working tour," you are in good shape. If it is "nothing," keep your own copies of every source file and keep asking for export options. Agencies and resellers, in particular, should weigh a self-hosted install, since client relationships last longer than any one vendor's pricing.
— Andrea
FAQ
Do I own the virtual tour I pay a photographer to create?
Not automatically. The photographer is generally the copyright owner of the images unless a work-made-for-hire arrangement or a written agreement transfers ownership or grants you a license. Ask for a written license that covers how you can use the tour and whether you receive the original panoramas.
Does the CCPA apply to my virtual tours?
It applies if you are a for-profit business doing business in California and you meet one of the statutory thresholds: over $25 million in annual revenue, handling the data of 100,000 or more California residents or households, or earning half your revenue from selling their data. Smaller operators may still need to follow it through client contracts. A California privacy attorney can confirm your status.
What visitor information can a virtual tour collect?
A tour can collect IP addresses, device and browser identifiers, location signals, browsing behavior, and anything typed into forms or shared in live sessions. Under California's statute, those can count as personal information when they can be linked to a person or household. Collect only what you need and state how long you keep it.
What should happen to my tour if I cancel my subscription?
That depends entirely on your provider's terms, so ask before you buy. You want to know whether the tour goes offline immediately, how long your files are kept, and whether you can export originals and the assembled tour first. Get the answer in writing.
Is self-hosting always safer for privacy?
No. Self-hosting gives you direct control of the files and visitor data and removes a vendor from the chain. But you become responsible for server security, updates, backups and your own privacy notices.
Sources
- What Photographers Should Know about Copyright, U.S. Copyright Office
- California Consumer Privacy Act of 2018, statute text
- California Consumer Privacy Act (CCPA), California Attorney General
- California Civil Code section 1798.100
- Data Ownership in Virtual Tours, Fotoestate
- Contractual Requirements for Vendor Contracts under the CCPA, Lathrop GPM