This Privacy Policy explains what personal data Web-AR.Studio Corp ("Web-AR.Studio", "we", "us") collects, why we collect it, who else we share it with, and what you can do about it.

It covers both our website at https://web-ar.studio and the Web-AR.Studio platform you sign in to in order to create, publish and host AR experiences.

The data controller is Web-AR.Studio Corp. For any question about this Policy or about your data, write to cto@web-ar.studio.

1. The two roles we act in

For data about you as our customer — your account, your billing details, your use of the service — we are the controller and decide how that data is handled. This Policy describes that handling.

For the content you upload and the personal data of your own end users that may be contained in it, you are the controller and we act as your processor: we process it only to run the service for you and only on your instructions. Where a separate data processing agreement is in place with you, that agreement prevails over this Policy.

Where you need one, a separate data processing agreement — including the Standard Contractual Clauses where they apply to international transfers — is available on request at cto@web-ar.studio.

2. What we collect

Depending on how you use Web-AR.Studio, we process the following categories of data:

• Account data — your name, email address, password in hashed form, the language and country you selected, and the plan you are on.

• Content you create — 3D models, images, video, audio, text, markers and the AR projects you build from them, together with their settings and publication status.

• AI inputs — the prompts you write and the files you submit when you use an AI-assisted generation feature.

• Billing data — your plan, payment dates and amounts, and the invoicing details you provide. Card details are entered directly with our payment provider and are never stored on our systems.

• Technical and usage data — IP address, browser and device type, pages and features used, timestamps, and diagnostic records such as error reports and performance measurements.

• Enquiries — what you send us through contact forms, chat or email, and our replies.

We do not ask for and do not intend to process special categories of data such as health, biometric identifiers, political opinions or religious beliefs. Please do not upload such data to the platform.

3. Why we process it, and on what legal basis

• To provide the service — creating and running your account, storing and publishing your projects, delivering AR experiences to their viewers, and providing support. Legal basis: performance of our contract with you.

• To take payment and meet accounting obligations. Legal basis: performance of our contract and compliance with a legal obligation.

• To keep the service secure and reliable — preventing abuse and fraud, investigating incidents, monitoring availability and fixing faults. Legal basis: our legitimate interest in operating a secure service.

• To understand and improve how the product is used, using analytics. Legal basis: your consent where the analytics rely on cookies or similar technologies, otherwise our legitimate interest in improving the product.

• To send you service messages, and — separately — news about features and offers. Legal basis: our contract for service messages, and your consent for marketing. You can unsubscribe from marketing at any time using the link in the message or by writing to cto@web-ar.studio.

We do not make decisions with legal or similarly significant effects about you by automated means alone.

4. AI-assisted features

Some parts of the platform can generate content — such as 3D assets, images or video — with the help of artificial intelligence. These features are optional: they run only when you actively choose to use them, and declining to use them does not restrict the rest of the service.

We do not develop or train our own AI models. When you use such a feature, your prompt and any files you submit are sent to a third-party AI provider for the sole purpose of returning the result you asked for.

We do not use your content, your prompts or your customers' data to train or improve any AI model, our own or anyone else's, and we do not allow our AI providers to do so under our agreements with them.

Your data is never pooled or combined with the data of other customers.

5. Who else processes your data

We do not sell your data and we do not share it for others to market to you. We do rely on a limited number of service providers who process data on our behalf, under contracts that oblige them to protect it and to use it only for the purpose we specify:

• Cloud hosting and storage — Amazon Web Services and DigitalOcean, which host the platform and store your account data and content.

• Network and content delivery — Cloudflare, which terminates encrypted connections, filters malicious traffic and delivers published AR experiences.

• Monitoring and error reporting — services that collect diagnostic and performance data so that we can detect and fix faults.

• Analytics — Google Analytics, Amplitude and Yandex Metrica, which help us understand how the website and the product are used.

• Payments — our payment provider, which processes card details directly and returns to us only the confirmation and the information needed for invoicing.

• AI providers — third-party model providers, which receive prompts and input files only when you use an AI-assisted feature, as described above.

We may also disclose data where we are legally required to do so, or where it is necessary to establish, exercise or defend legal claims. If we ever receive such a request we will review it and, unless prohibited by law, tell the customer concerned.

We will keep this list current. Where we add or replace a provider that processes customer content, we will update this Policy before the change takes effect.

6. International transfers

Web-AR.Studio is delivered from cloud infrastructure that may be located outside your country, and several of the providers listed above operate internationally. Your data may therefore be transferred across borders.

Where data is transferred out of the European Economic Area or the United Kingdom, we rely on the safeguards available under applicable law — an adequacy decision where one exists, and otherwise the Standard Contractual Clauses agreed with the provider concerned. All transfers are encrypted in transit. Analytics cookies are set only after you consent, and where an analytics provider is located outside the European Economic Area the transfer of that analytics data takes place on the basis of that consent. Analytics runs on our website only and does not reach customer content or platform account data.

If you need your data to stay in a particular region, contact us at cto@web-ar.studio and we will tell you what we can offer.

7. How long we keep data

• Account data and content — for as long as your account is active. After you close your account, or after sixty months of a free account remaining inactive, we delete them within 30 days.

• Backups — encrypted backup copies are kept for up to 90 days and then expire automatically, after which deleted data can no longer be recovered.

• AI prompts and inputs — retained only for as long as needed to produce and deliver the result.

• Billing records — for as long as required by accounting and tax law, normally six years.

• Technical logs and diagnostic records — up to 12 months.

• Enquiries and support correspondence — up to 24 months after the conversation ends.

8. How we protect data

Data is encrypted in transit, and at rest by our hosting providers. Access to production systems is limited to the small number of people who need it, requires multi-factor authentication, follows the principle of least privilege and is logged. Production environments are isolated from development and test environments, and customer data is not used for testing.

Data is backed up on a recurring schedule to storage separate from the live systems. Infrastructure is monitored continuously, dependencies are updated during maintenance, and every change to the service is peer-reviewed before release.

No service can be guaranteed to be completely secure. Please use a strong, unique password and keep your credentials to yourself.

9. Security incidents

If a breach of security leads to the accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of or access to personal data, we will investigate it immediately and contain it.

Where the breach is likely to result in a risk to people's rights and freedoms, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it. Where the risk is high, we will also inform the individuals affected.

Where the incident affects content you hold on the platform, we will notify you as the controller without undue delay and give you the information you need to meet your own obligations. Our providers are contractually required to notify us on the same basis.

10. Your rights

Subject to the conditions in applicable data protection law, you have the right to:

• ask what data we hold about you and receive a copy of it;

• have inaccurate data corrected and incomplete data completed;

• have your data deleted;

• have processing restricted while a dispute about it is resolved;

• object to processing that we base on our legitimate interests, and to object at any time to direct marketing;

• receive the data you gave us in a portable format and have it sent to another provider;

• withdraw consent at any time, where processing is based on consent — this does not affect processing carried out before you withdrew it;

• lodge a complaint with your national data protection authority.

To exercise any of these rights, write to cto@web-ar.studio. We answer within one month and will tell you if we need longer because the request is complex. We do not charge for this, and we may ask you to confirm your identity before we act.

If your request concerns data held inside a customer's project, we will refer you to that customer, who is the controller of it, and assist them in responding.

11. Cookies and analytics

We use cookies and similar technologies that are strictly necessary to run the site and keep you signed in. These do not require consent.

We also use analytics cookies, through Google Analytics, Amplitude and Yandex Metrica, to see how the site and product are used. These are set only after you consent, and you can change or withdraw that consent at any time through the cookie banner or your browser settings.

Blocking analytics cookies does not affect your ability to use the service.

12. Children

Web-AR.Studio is a professional tool and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has provided us with personal data, write to cto@web-ar.studio and we will delete it.

13. Changes to this Policy

We update this Policy when our practices change. The date it was last revised is shown at the end. If a change materially affects how we handle your data, we will tell you by email or in the product at least 30 days before it takes effect, so that you have time to object or to close your account.

14. Contact

Web-AR.Studio Corp. Questions, requests and complaints about privacy: cto@web-ar.studio. We would like the chance to resolve any concern directly, but you always have the right to approach your national data protection authority.