Privacy Policy

1. Data controller

The controller of your personal data processed through the 3dview.ai website and the 3DView.ai Service is:

We have not appointed a Data Protection Officer (DPO). For any question or request about your data write to us at [email protected].

2. Data we process

• Account data: email address, username (generated automatically), password (stored only as an irreversible bcrypt hash), email confirmation date; with Google sign-in: the email address, name and profile picture received from Google.
• Credits and purchases: credit balance and history, packs purchased, amounts, currency, Stripe payment session ID, payment status, date and version of the Terms accepted at payment. For the Test pack offer we keep the card "fingerprint" provided by Stripe (an identifier from which the card number cannot be reconstructed), so the offer is used only once per card.
• Billing data: name or company name, address, country, tax ID (for companies) and email, entered on the Stripe payment page or in the billing section of your account (including, if you enter them, trade register number, bank and IBAN), invoice series and number. We never receive or store card details.
• Content: uploaded images and texts (prompts), generated 3D models, previews, hosting/AR settings and links, models activated from the shop.
• Support: messages in support tickets and in emails you send us.
• API: your API key and its usage.
• Technical data: IP address, browser and device type, pages requested, date and time of requests, error logs – used to run and secure the Service (e.g. rate limiting).
• Model statistics (anonymous): how many times each hosted model was viewed (website code, link, AR) and opened in AR, only as daily totals shown to the model's owner. To count a visitor once per day we use a one-way hash of the IP address and browser with a key that changes daily; the hash is deleted after at most 2 days and we do not keep the IP, browser or any other visitor data. No cookies are used for this.
• Analytics data (only with your consent): visitor and session identifiers, pages visited, traffic source, screen resolution – through Google Analytics 4; page interactions (clicks, scrolling), with typed content masked – through Microsoft Clarity. See the Cookie Policy (/cookies).
• Marketing data (only with your consent to marketing cookies): the browser’s cookie identifier, pages visited and, when a payment is completed, the order value and identifier – through the TikTok Pixel, to measure ad performance and for retargeting. Also only with this consent, once a payment is confirmed our server sends TikTok (TikTok Events API) the value, currency, order identifier and package, your email, phone and account identifier (only as SHA-256 hashes), IP address, browser and the TikTok identifiers _ttp / ttclid. Likewise, only with this consent, the Meta Pixel (Facebook / Instagram) receives the pages visited, views of prices and models, the start and completion of a payment (order value and identifier), account creation and requests sent through the contact form, and our server sends Meta (Meta Conversions API) the same events with your email, phone and account identifier (only as SHA-256 hashes), IP address, browser and the Meta identifiers _fbp / _fbc; without consent nothing is sent.

We do not ask for, and please do not upload, sensitive data (e.g. health data) or images of other people without their consent.

3. Purposes and legal bases

• Creating and managing your account, providing the Service (generation, hosting, shop, API), transactional emails (account confirmation, password reset, payment confirmation, the warning before the models of an account without payments are deleted, refunds) and support: performance of the contract – Art. 6(1)(b) GDPR.
• Emails about your account's welcome offer (welcome, reminder before the offer ends, second chance) and how-to emails (scanning tips, the Shopify guide, your first model, model ready, monthly model stats, low credits) – at most one per day: our legitimate interest – Art. 6(1)(f) GDPR and art. 12(2) of Romanian Law 506/2004; every email has a one-click unsubscribe link.
• Checking that the Test pack offer is used once per account and per card (card fingerprint): our legitimate interest – Art. 6(1)(f) GDPR – in preventing abuse of the offer.
• Processing payments, issuing invoices, reporting them to RO e-Factura, accounting records and keeping proof of the consent given at purchase: performance of the contract and compliance with legal obligations – Art. 6(1)(b) and (c) GDPR (Romanian Accounting Law 82/1991, Fiscal Code, e-Factura legislation, GEO 34/2014).
• Security, fraud and abuse prevention, content moderation, handling notices and defending our legal claims: our legitimate interest – Art. 6(1)(f) GDPR – in protecting the Service, users and third parties.
• Traffic statistics and attributing sales to traffic sources (Google Analytics): your consent – Art. 6(1)(a) GDPR, which you can withdraw at any time via “Cookie settings”.
• Measuring ad performance and retargeting (TikTok Pixel, Meta Pixel, marketing cookies): your consent – Art. 6(1)(a) GDPR; marketing cookies are used only with your consent, which you can withdraw at any time via “Cookie settings”.

Apart from the emails about your account's offer (which you can unsubscribe from at any time), we do not send marketing communications without your consent and we do not sell your data.

4. Recipients

Data is accessed only by the operator’s authorised staff and by the following providers (processors or independent controllers), strictly as needed:

• Hetzner Online GmbH (Germany): hosting of the application and database on servers in the EU (Germany/Finland).
• Replicate, Inc. (USA): running the AI models that generate images and 3D models; receives your images and prompts.
• Cloudflare, Inc. (R2 service): storage of hosted model files and serving AR links.
• Stripe Payments Europe, Ltd. (Ireland) and Stripe, Inc. (USA): card payment processing, fraud prevention, collection of billing details. Stripe also acts as an independent controller for its own legal obligations.
• Oblio Software S.R.L. (Romania): issuing and archiving invoices.
• Romanian National Agency for Fiscal Administration (ANAF): invoices reported through RO e-Factura, as required by law.
• Resend (Plus Five Five, Inc., USA): sending transactional emails.
• OpenAI, L.L.C. (USA): the chat assistant on the site: the messages you type in the chat (and, if you are signed in, your credit balance and offer deadline) are processed by OpenAI to generate the answer; we do not keep the conversations.
• Google Ireland Ltd. / Google LLC: “Continue with Google” sign-in (if you choose it) and Google Analytics 4 (only with your consent).
• Microsoft Corporation (USA): Microsoft Clarity – click heatmaps and session recordings with typed content masked (only with your consent to analytics cookies).
• TikTok Technology Limited (Ireland): TikTok Pixel and TikTok Events API – ad performance measurement and retargeting (only with your consent to marketing cookies).
• Meta Platforms Ireland Limited (Ireland): Meta Pixel and Meta Conversions API (Facebook / Instagram) – ad performance measurement and retargeting (only with your consent to marketing cookies).
• Public authorities and courts: only where the law requires or to defend a legal claim.

Searching and importing shop models uses the Sketchfab API without sending any personal data about you.

5. Transfers outside the European Economic Area

Some providers (Replicate, Cloudflare, Stripe, Resend, OpenAI, Google, Microsoft) are US companies or may process data in the USA; TikTok Technology Limited may transfer data outside the EU (including to the USA and Singapore), and Meta Platforms Ireland Limited may transfer data to Meta Platforms, Inc. (USA). Transfers rely on the European Commission’s adequacy decision for the EU-US Data Privacy Framework, for certified providers, and/or on the Standard Contractual Clauses adopted by the European Commission, together with supplementary security measures. You can request a copy of the relevant safeguards at the email address above.

6. Retention

• Account and content: while the account is active. After the account is closed we delete account data and content within 30 days, except as set out below.
• Images uploaded for generation: deleted automatically from our servers after about one hour. The AI provider keeps inputs and outputs only temporarily, under its own policy (usually no more than one hour for API requests).
• Model files: for accounts with at least one payment, as long as you use them: a model is deleted only if you have not logged in and the model has not been shown from our servers for 12 months (warning email 30 days before); for accounts without any payment, 30 days after the model was created (email 5 days before). Then they are permanently deleted.
• Invoices, accounting documents and proof of payments/consent at purchase: 10 years from the end of the financial year, under Romanian Law 82/1991.
• Support tickets: while the account is active.
• Technical and security logs: only as long as needed, usually no more than 90 days.
• Analytics data: Google Analytics – up to 14 months; your cookie preference – 6 months; TikTok cookies – about 13 months; Meta cookies (_fbp, _fbc) – about 3 months.

7. Your rights

Under the GDPR (Art. 15–22) you have the right:

• to access your data and obtain a copy;
• to have inaccurate or incomplete data rectified;
• to erasure (“right to be forgotten”), as provided by law;
• to restriction of processing;
• to data portability for data you provided, in a structured, commonly used format;
• to object to processing based on legitimate interest;
• to withdraw your consent at any time, without affecting the lawfulness of earlier processing (for cookies, via “Cookie settings” in the site footer);
• not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

To exercise your rights write to [email protected] from your account email address. We reply within one month of receipt (extendable by two months for complex requests, in which case we will let you know).

You have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest – https://www.dataprotection.ro – or with the supervisory authority of your EU country of residence.

8. Is providing data mandatory?

An email address and password (or a Google account) are needed to create an account; without them we cannot provide the Service. Billing data is needed to make a purchase, as required by tax and accounting law. Analytics data is optional and collected only with your consent.

9. Automated decisions and artificial intelligence

We do not take decisions based solely on automated processing that produce legal effects concerning you. AI systems process your images and texts only to generate the result you request; we do not use them to build profiles or to train our own AI models. The AI providers’ automated safety filters may refuse certain generations; you can ask for a human review by writing to us.

10. Security

We apply appropriate technical and organisational measures: encrypted connections (HTTPS), passwords stored only as hashes, restricted access to data, HttpOnly authentication cookies, rate limiting. No system is completely secure; in the event of a personal data breach likely to result in a high risk to you, we will inform you as required by law.

11. Children

The Service is not directed at children under 16 and we do not knowingly collect their data. If you learn that a child under 16 has given us data without parental consent, write to [email protected] and we will delete it.

12. Changes

We may update this policy; the version and effective date are shown at the top of the document. We will inform you of material changes by email or in the Service.