Privacy Policy

1. Data we handle

• Projects: the content of projects you save online (shapes, text, imported meshes, colors), saved versions, and a thumbnail image for the "My projects" list.
• Account: email and password (the password is only stored in a scrambled form that cannot be read back), sign-up and last sign-in dates and, for a few minutes, the code (PIN) sent by email, also scrambled.
• Gallery: what you publish (title, description, optional author name, image, project and 3MF file) and a code derived from your IP address (not the IP itself), used only to limit abuse.
• Technical data: IP address, browser and pages visited, in server logs and to limit the number of attempts (abuse protection).
• In your browser (local storage): unsaved drafts, preferences, the recent projects list and the codes for removing models from the gallery. This data stays on your computer.
• Images used in "Image to 3D" are processed in your browser and are not sent to the server.

2. Why we use it and on what legal basis

• Running the service (saving and opening projects, accounts, the gallery, confirmation and password emails): performance of the service you asked for (LGPD art. 7, V; GDPR art. 6(1)(b)).
• Security and preventing abuse and fraud (attempt limits, gallery moderation, troubleshooting): legitimate interest (LGPD art. 7, IX; GDPR art. 6(1)(f)).
• Complying with legal obligations, such as keeping access logs as required by Brazilian law (LGPD art. 7, II; GDPR art. 6(1)(c)).
• We do not send marketing emails and we do not sell your data.

3. Who has access

• Anyone with a project link can open that project. Models published in the gallery are public.
• The Lok3D team may open projects and accounts when needed for support, moderation, security or legal compliance. This access is restricted to administrators.
• Providers that help us run the service, only for that purpose: cloud hosting (servers), Cloudflare (network, protection and cookie-free visit statistics) and Brevo (sending the code emails).
• AI assistant (when it is enabled and you use it): the text of your request and the list of objects in the scene are sent to Google (Gemini) to generate the answer.
• Authorities, when required by law or court order.
• Some of these providers are located outside Brazil and the European Union. In those cases, transfers follow LGPD (art. 33) and GDPR rules, with contractual safeguards.

4. Cookies

We only use necessary cookies: the session cookie (to keep you signed in), one that protects against forged form submissions, and one for your chosen language. We do not use advertising cookies. Visit statistics (Cloudflare Web Analytics) do not use cookies.

5. How long we keep data

• Projects without an account: 48 hours after creation; then they are deleted.
• Account projects: while the account is active; projects with no access for 365 days may be removed. Each project keeps up to 30 versions.
• Closed accounts: the account, its projects and gallery models are deactivated and no longer shown. The data is kept in deactivated form for security, fraud prevention and legal obligations. You can request permanent deletion by writing to [email protected].
• Email code (PIN): valid for 15 minutes and deleted after use.
• Access logs (IP, date and time): for the period required by law (6 months under the Brazilian Internet Civil Framework).

6. Your rights

Under the LGPD (art. 18) and the GDPR, you can ask for: confirmation that we process your data, access, correction, anonymization, restriction or deletion, portability, information about who we share it with, and objection to processing based on legitimate interest. You can also complain to the Brazilian data protection authority (ANPD) or to your local supervisory authority in the EU.

Many things you can do yourself: download your projects (File → Download project), change your password and close your account (My account), remove models from the gallery. For anything else, write to [email protected]; we reply within 15 days.

7. Security

The website uses an encrypted connection (HTTPS), passwords are stored scrambled, project links are long random codes, sign-in and code sending are rate-limited, and the admin panel is only available to administrators. No system is 100% secure: if an incident puts you at risk, we will notify you and the authorities as required by law.

8. Children and teenagers

Accounts are for people aged 13 or older. Users under 18 must have permission from a parent or guardian. If you believe a child signed up without permission, write to [email protected].

9. Changes to this policy

We may update this policy. The date of the last update is shown at the top of the page. Important changes will be announced on the website or by email to account holders.

10. Contact and data protection officer

Controller: Lok3D. Data protection officer (DPO) and contact for any privacy matter: [email protected].