Privacy Policy
Last Updated: November 1, 2026 • Version 2.0 (Zero-Data Retention Architecture)
Our Privacy Guarantee: Zero Visual Data Retention
We believe creator data belongs to creators. We do not store, catalog, train on, or monetize your uploaded images or resulting 3D models. All visual assets exist temporarily on server storage only during active generation and are permanently purged immediately upon download, session reset, or after 1 hour.
1. Introduction & Data Controller
OBJify (“we”, “us”, “our”) is committed to protecting the privacy, security, and fundamental rights of our users under the General Data Protection Regulation (GDPR - Regulation (EU) 2016/679), the California Consumer Privacy Act (CCPA/CPRA), and related global privacy standards.
This Privacy Policy details how we collect, process, and protect your personal information when using the OBJify web application and AI image-to-3D mesh studio. For GDPR purposes, OBJify acts as the Data Controller of your account and transactional data.
2. Ephemeral Processing & Zero-Retention Policy
Unlike traditional SaaS platforms that archive user files indefinitely, OBJify is built around an ephemeral, privacy-first processing pipeline:
| Data Category | Purpose | Retention Period |
|---|---|---|
| Uploaded Photos (Raw Inputs) | Subject isolation & background removal | Purged immediately on download or reset (max 1 hr) |
| Intermediate Cutouts (Studio White/Slate) | User verification & 3D mesh synthesis | Purged immediately on download or reset (max 1 hr) |
| Generated 3D Meshes (.OBJ, .MTL, .GLB, .STL) | Interactive WebGL viewer & file delivery | Purged immediately on download or reset (max 1 hr) |
| Account Email Address | Passwordless magic link login & credit ledger | Until account deletion requested by user |
| Stripe Billing Records | Tax, fiscal accounting & payment dispute defense (proof of delivered digital consumables) | Statutory financial retention (5–7 years) |
No AI Training: We certify under strict contractual obligation that your uploaded photographs and generated 3D models are never used to train, retrain, or fine-tune neural network weights, foundation models, or third-party AI systems.
3. What Personal Data We Collect
- Account Information: Your email address, collected when you request a passwordless magic login link. We do not require or store passwords.
- Financial & Transaction Data: When purchasing credit packs (consumable digital items), payment processing is performed directly and securely by Stripe, Inc. We receive only transaction timestamps, credit quantities, currency, and Stripe customer/payment identifiers. OBJify never handles, views, or stores full payment card numbers or CVVs. All credit purchases are strictly non-refundable as detailed in our Terms of Service.
- Technical & Log Data: Standard internet communication telemetry including your IP address, browser type, operating system, HTTP referrer, and request timestamps, utilized for rate-limiting, DDoS prevention, and application security.
- First-Party Visit Analytics: The referring website, the campaign tags in the link you followed (
utm_source,utm_medium,utm_campaign,utm_term,utm_content), your landing page, and which steps you took (upload, preview, download, purchase). We use this only to understand which channels bring visitors and customers to OBJify. It stays on our own servers and is never shared with advertising networks.
4. Legal Bases for Processing (GDPR Article 6)
We process your personal data under the following recognized legal grounds:
- Contractual Necessity (Art. 6(1)(b)): To authenticate your session via magic links, maintain your active credit balance, and deliver 3D mesh files upon request.
- Legitimate Interests (Art. 6(1)(f)): To secure our servers from automated botting and abusive GPU resource exhaustion, prevent fraud, and maintain operational stability; and to measure, in aggregate and with first-party data only, which marketing channels and campaigns lead to visits and purchases.
- Legal Obligation (Art. 6(1)(c)): To maintain accurate fiscal and accounting books relating to digital commercial transactions.
5. Third-Party Subprocessors
We share minimal required data with vetted third-party service providers bound by strict Data Processing Agreements (DPAs):
- Stripe, Inc.: Payment processing, fraud detection, and tax computation. (United States / EU).
- Transactional Email Delivery (SMTP / Resend): Secure delivery of one-time magic link tokens to your email inbox.
- Cloud Hosting & Reverse Proxy: Encrypted edge network delivery and TLS certificate enforcement.
We do not sell, rent, lease, or monetize your personal data to advertisers, data brokers, or commercial marketing networks.
6. Cookie & Local Storage Policy
OBJify does not use intrusive third-party tracking pixels (such as Meta Pixel or Google Analytics advertising tags). We use only the following first-party technologies:
- Session Cookie (
PHPSESSID): Temporary session identifier required to maintain authentication state. Automatically cleared when closing the browser. - Visit Analytics Cookie (
visitor_sid): A pseudonymous first-party identifier, kept for 90 days, that links your visits so we can attribute sign-ups and purchases to the channel that brought you (see Section 3). It is not readable by scripts or shared with third parties. You can delete it at any time in your browser settings. - Local Browser Memory (Blob URLs): Used to deliver the downloaded 3D mesh directly to your machine while allowing instantaneous Three.js WebGL inspection after server files are purged.
7. Your Rights under GDPR & CCPA/CPRA
You have full legal control over your personal data under European and California privacy laws:
Right of Access & Portability
Request a copy of the personal data we hold about your account in a structured JSON format.
Right to Erasure ("To Be Forgotten")
Permanently delete your account, session logs, and personal email. Note: Account erasure forfeits any unconsumed digital credits and does not trigger or entitle you to a monetary refund for previously purchased consumables.
Right to Rectification
Correct or update any inaccurate personal details associated with your profile.
Non-Discrimination
We will never discriminate against you or deny service for exercising your statutory privacy rights.
To exercise any of these rights, please submit a request using the in-app “Contact Support” function. We fulfill all verified requests within 30 calendar days at zero charge.
8. Security Measures
We implement defense-in-depth security standards including TLS 1.3 transport encryption, parameter-bound SQL queries with SQLite WAL transaction guarantees, cryptographic random token generation for magic links, and strictly isolated, containerized neural compute environments.
9. Contacting the Privacy Officer
For any inquiries, data subject requests, or supervisory authority escalations, please contact us directly through the platform: