Privacy

Privacy Policy

Last updated: April 26, 2026

This Privacy Policy describes how 3Dview.art ("we", "us", "3Dview.art") collects, uses, and protects your information when you use 3Dview.art application at 3dview.art (the "Service"). It is written to satisfy GDPR (EU/EEA/UK) and CCPA (California) requirements and is intentionally short on legalese.

1. Who is the data controller?

3Dview.art, based in Brooklyn, NY, United States, governed by the laws of the State of New York, is the data controller for the purposes of GDPR. You can reach us at [email protected].

2. What we collect

Account information

  • Your name and email, supplied via Clerk authentication.
  • The Clerk user ID and (when applicable) organization ID.
  • Profile picture, if you set one in Clerk.
  • Workspace role you hold (admin / editor / viewer).

Workspace content

  • 3D model files you upload to your workspace.
  • Project, folder, and version metadata.
  • Comments, @mentions, and annotations attached to those files.
  • Color overrides and viewer preferences saved against a model.

Audit & operational data

  • A timestamped record of significant actions in your workspace (uploads, comments, status changes, etc.).
  • Server logs containing IP address, user-agent, and request paths, retained for up to 30 days for abuse detection.
  • Error reports, sampled by Sentry, with PII scrubbed (no email, no request bodies, no headers like Authorization or Cookie).

What we do NOT collect

  • We do not run advertising trackers, ad cookies, third-party analytics, or fingerprinting scripts.
  • We do not sell your data — to anyone, ever.

3. Why we use it

  • To run the Service: serve files, deliver comments, send mention emails, etc.
  • To enforce account limits (storage, members, projects) and detect abuse.
  • To investigate security incidents and respond to support requests.
  • To comply with legal obligations (tax, anti-fraud, lawful requests).

4. Lawful basis (GDPR Art. 6)

We rely on (a) contract for everything required to provide the Service; (b) legitimate interest for security monitoring and product improvement; and (c) consent for non-essential cookies (e.g. Sentry session replay).

5. Subprocessors

We rely on a small set of well-known cloud providers to operate. See the live subprocessors list for the current set and what each one does. We do not transfer your data to any non-listed third party.

6. Data retention

  • Content (files, comments, annotations) is kept until you delete the workspace.
  • Audit logs are kept for 365 days, then truncated by an automated job.
  • Server access logs are kept for 30 days.
  • When you delete your account, your personal data (name, email, avatar) is anonymised within 30 days. Workspace content contributed by you stays with the workspace under "Deleted user" attribution unless your admin also deletes the workspace.

7. Your rights

Under GDPR and CCPA you have the right to: access, correct, delete, export, restrict, or object to our processing of your personal data. You can exercise most of these directly from your Settings page:

  • Access / export: request a copy of your data from Account → Export my data.
  • Delete: remove your account from Account → Delete account. Workspace admins can delete a whole workspace from Workspace → Delete workspace.
  • Correct: profile fields are editable directly in Clerk.
  • Anything else: email [email protected] and we will respond within 30 days.

EU/EEA/UK residents may also lodge a complaint with their local supervisory authority. Californian residents may exercise their CCPA rights without discrimination.

8. International transfers

Service infrastructure is hosted in the United States. When data leaves the EU/EEA/UK we rely on the European Commission's Standard Contractual Clauses with our subprocessors.

9. Security

We follow industry-standard practices including encryption in transit (TLS), encryption at rest, role-based access in the product, signed authenticated download URLs, and Postgres Row-Level Security so one tenant cannot see another's data. See our security overview for more.

10. Children

The Service is not intended for individuals under 16. We do not knowingly collect personal data from children.

11. Changes to this policy

We'll update the "Last updated" date at the top of this page when this policy changes. For material changes, we will notify you by email.

12. Contact

Questions, deletion requests, or concerns: [email protected].