Privacy Policy

1. Data we process

• Images you upload and the 3D models created from them.
• Account data: email, password (we only store a hash, never the password itself) or an identifier from Google/Facebook, and the time the account was created.
• Sessions and cookies (see section 4).
• Activity: your runs, their status, the image file name (used as the model name), points used and the history of point changes.
• Payments: the amount, top-up code, transaction id and transfer note reported by the bank or payment partner. We do not receive or store your card number or bank password.
• IP address: used to prevent abuse of free runs. In the database we store only a salted hash, not the raw IP; the server's technical logs may record IPs for a short time for security.

2. Why we use it

• To provide the service: create, display and let you download models, and manage accounts and points.
• Security and fraud prevention: limiting free runs, detecting abuse, protecting the payment system.
• Operations: support, reconciling transactions, aggregate statistics, and internal operational notifications to administrators (for example when a top-up happens).
• We do not sell your data and we do not use your images for advertising.

3. Third parties that receive data

• The AI provider (currently Fal.ai): receives the image you upload to build the model. The data is handled under their policy.
• Banks and the payment partner (currently SePay): process your bank transfer and notify us of the transaction.
• Google or Facebook, if you choose to sign in with them: we receive an identifier and email according to the permissions you grant.
• Telegram: internal operational notifications to administrators may contain an account email and a top-up amount.
• Google AdSense: shows ads on the Vietnamese content pages and may use advertising cookies.
• The hosting provider that stores the service's data.
• We otherwise share data only when the law requires it.

4. Cookies

• session: keeps you signed in (up to 30 days, httpOnly).
• owner: an anonymous identifier so guests can see their own history and so free runs can be counted.
• lang: remembers the language you are viewing.
• oauth_state: a short-lived cookie (a few minutes) used when signing in with Google/Facebook, to prevent forged requests.
• Pages in Vietnamese show Google AdSense ads. Google and its advertising partners may use cookies or device identifiers to serve and measure ads (including interest-based ads); you can manage this in Google's ad settings (adssettings.google.com). The 3D viewer library is also loaded from Google's servers, so Google may receive your IP address.

5. How long we keep data

• Images and models are deleted automatically after about 30 days, or immediately when you delete them from your history.
• Account information is kept until the account is deleted. The points ledger and top-up records are kept for reconciliation and to meet accounting obligations.
• Expired sessions are cleaned up automatically.

6. Your rights and security

• You can delete your images and models in the interface at any time. To access, correct or delete your account and related data, contact us (section 8).
• We take reasonable measures to protect data: hashed passwords, HTTPS, per-item access checks and abuse limits. No system is perfectly secure.

7. Changes to this policy

We may update this policy; the date is shown at the top of the page.

8. Contact

For questions, data deletion requests or transaction complaints, contact: contact details will be published on this page.