Privacy Policy

1. Before you have an account

You can run a limited number of generations from the public site without signing in, and we process data about you when you do. Specifically we store a one-way hash of your IP address, an id for the generation, and the image you uploaded together with the model it produced. The hash is what enforces the free-use rate limit; we cannot recover your IP address from it, but it is still information about you, so we treat it as personal data.

• Why. To run the generation you asked for, and to stop one visitor consuming the free tier indefinitely — our legitimate interest in keeping a free tier available.
• How long. These records carry an expiry date and are removed after it. If you sign in and claim a result, the files move into your account and the rest of this section stops applying to them.
• Your rights still apply. If you used SupaVoxel without an account and want the upload and result deleted, email [email protected] with the link or page you were given. You do not need an account to ask.

2. What we collect once you sign in

• Account data. When you sign in with Google we receive your email address, name and profile picture. We never receive or store a password.
• Content you create. Images you upload, the 3D models generated from them, and the projects that hold them.
• Billing data. Your subscription plan and status, the billing name, country and postcode attached to your payment method, and our record of each charge. Card numbers go directly to Stripe; we never receive or store them.
• Usage data. Pages viewed, features used, generation jobs started and completed, and technical details such as browser, operating system, screen size, language and approximate location derived from your IP address (city level).
• Support correspondence. Emails you send us and our replies.

3. Why we use it

To create and secure your account; to run generation jobs and deliver the results; to take payment and manage your subscription; to send service email such as receipts and job notifications; to understand which parts of the product are used so we can improve them; to detect fraud and abuse; and to comply with our legal and tax obligations.

Where the GDPR applies, our legal bases are performance of a contract (running the service and billing you), legitimate interests (security, fraud prevention, product analytics) and legal obligation (accounting records).

4. We do not train on your content

We do not use your uploaded images or your generated models to train AI models, and we do not share them with anyone for that purpose. Your content is processed to produce your result and then stored in your account for you.

5. We never sell your data

We do not sell personal data and we do not share it with advertisers or data brokers.

6. Who processes data on our behalf

We use a small number of service providers, each bound to process data only on our instructions:

• Google — sign-in (we receive your profile; Google does not receive your activity on SupaVoxel).
• Stripe — payment processing, subscriptions and fraud checks.
• Cloudflare — content delivery, storage of your uploads and generated models, and protection against attacks.
• GPU inference providers — your uploaded image is sent to the model host that performs the 3D reconstruction, solely to produce your result.
• Our email provider — delivery of receipts and service notifications.
• Our own analytics — usage analytics runs on infrastructure we operate ourselves rather than a third-party advertising network.

7. Cookies

We use cookies that are necessary for the service: keeping you signed in, remembering your language and interface preferences, and completing checkout. We do not use advertising or cross-site tracking cookies.

8. How long we keep it

• Anonymous generations — the rate-limit record and the files are held only until the expiry stamped on them, unless you sign in and claim the result, at which point it becomes account content.
• Account and content — for as long as your account exists, so that your projects remain available to you.
• Billing records — for as long as tax and accounting law requires, typically seven years, even after an account is deleted.
• Usage analytics — retained in aggregate for product analysis.

9. Your rights

Depending on where you live you may have the right to access, correct, export, delete or restrict the processing of your personal data, and to object to processing based on legitimate interests. To exercise any of these, email [email protected] — from the address on your account if you have one, or, if you used SupaVoxel without signing in, with the link or page you were given so we can find the record. You do not need an account to make a request. We respond within 30 days and we do not charge for it. If you are in the EEA or the UK you may also complain to your local data protection authority.

10. International transfers

Our providers operate globally, so your data may be processed outside your own country, including in the United States. Where data leaves the EEA or the UK we rely on the safeguards our providers offer, such as Standard Contractual Clauses.

11. Children

SupaVoxel is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has created an account, tell us and we will delete it.

12. Security

Traffic is encrypted in transit. Accounts have no passwords to steal — access requires signing in to your identity provider. We limit internal access to production data to what is needed to operate and support the service. No system is perfectly secure; if a breach affects you we will tell you promptly.

13. Changes

If we make a material change to this policy we will update the "Effective" date above and, where the change significantly affects you, notify you by email.

14. Contact

Privacy questions and requests: [email protected].