Privacy and Cookie Notice
This notice explains how XO3D Ltd handles personal data when you use XO3D Labs.
1. Who is responsible
XO3D Ltd is the controller for Labs accounts, subscriptions, site operation, security, support and optional analytics. XO3D Ltd is registered in England and Wales under company number 11876020. Our registered office is 1 Beauchamp Court, 10 Victors Way, Barnet, Hertfordshire, EN5 5TZ, United Kingdom. Contact [email protected].
For a hosted review board, the business that creates the board usually decides why reviewer information and project content are used. That business may therefore be the controller and XO3D may act as its processor for the hosted service. Reviewers should contact the board owner first about the content of that board.
2. Browser-local tools and network actions
Most free tools process inputs in your browser. Files are not sent to XO3D merely because you open or use a local tool. Data is sent when you choose an action identified as hosted, such as creating a review board, saving a cloud scene, creating a share link, registering an Embed domain, signing in, subscribing or contacting us.
The live Synthetic texture mode and Renderer assistant are deterministic, rule-based browser features. They do not currently call a generative AI model or upload the prompt, model or texture input.
3. Data we use and why
| Activity | Data | Purpose and basis |
|---|---|---|
| Account and sign-in | Email address, account identifiers, sign-in method and security records. | Provide and secure the account, perform the contract and prevent abuse. |
| Subscription and billing | Plan, customer and subscription references, billing status and transaction metadata. Stripe handles payment-card entry. | Form and administer the contract, keep accounting records and prevent fraud. |
| Boards and hosted reviews | Uploaded images and versions, marks, comments, reviewer display names, owner email, capability links and activity needed to operate the board. | Provide the hosted service under the customer contract and protect the service. |
| Shares, cloud scenes and Embed | Shared content and settings, scene JSON, account references, registered domains and technical request data. | Perform the requested hosted action and enforce service limits and security. |
| Support and bug reports | Your message, email if supplied, page and browser diagnostics, and attachments you choose to send. | Respond to the request and improve or secure the service. |
| Optional analytics | Pseudonymous usage events and device, page and interaction information collected by Google Analytics 4 and Microsoft Clarity only after analytics consent. | Your consent. You can withdraw it through Cookie settings. |
| Service security | IP address, request logs, timestamps, device or browser signals and abuse indicators. | Legitimate interests in availability, fraud prevention, incident investigation and network security. |
4. Hosted content and reviewers
The customer is responsible for having a lawful basis and the permissions needed to upload content, invite reviewers and use their comments. Capability links give access at the level shown by the tool, so treat an owner, reviewer or viewer link like a password. Do not upload personal data or confidential material that is not needed or that you are not authorised to share.
5. Providers and international transfers
The following services receive data only for the stated purpose. The location column describes the current service region or the transfer context we expect from the provider, not a promise that every support or sub-processor operation stays in one country.
| Provider or service | Role | Current region or transfer context |
|---|---|---|
| SiteGround and the configured hosting mail service | Labs web, PHP, hosted-data storage and transactional email infrastructure. | The hosting region selected for the XO3D account, with provider support and sub-processors governed by its current terms. |
| Stripe | Checkout, recurring billing, invoices, refunds, disputes, tax collection and the Customer Portal. | United Kingdom, EEA, United States and other locations used by Stripe's global payment network. |
| Google Identity | Optional sign-in after you choose the Google option. | United Kingdom, EEA, United States and Google's global infrastructure. |
| Google Analytics 4 | Optional consented site analytics. | United Kingdom, EEA, United States and Google's global infrastructure. |
| Microsoft Clarity | Optional consented interaction analytics. | United Kingdom, EEA, United States and Microsoft's global infrastructure. |
| HubSpot EU portal | Lead and result-capture forms where the page clearly offers that submission. Bug reports are not sent to HubSpot. | Primary EU hosting region, with support and sub-processors under HubSpot's current terms. |
Where UK data protection law requires a safeguard for a restricted transfer, we use an applicable adequacy regulation, the UK International Data Transfer Agreement or Addendum, approved contractual clauses, or another lawful mechanism. Contact us for the current safeguard relevant to your data.
6. Retention
We keep data only for as long as it is needed for the purpose described, the active customer relationship, security and dispute handling, or legal and accounting duties. The implemented service criteria are:
- Hosted share links expire after 7 days.
- Hosted Boards remain until the owner deletes them or, where the owner selects a retention window, until the service next accesses the expired Board and removes it.
- Cloud scenes remain until the account deletes them or completes authenticated account erasure.
- Embed domain and capability records remain until capability revocation, licence-record deletion or authenticated account erasure.
- Labs login sessions expire after 24 hours or earlier revocation. One-time sign-in links expire after 15 minutes.
- Checkout consent, transaction, tax and dispute evidence is retained where needed for the contract, accounting, security or legal claims.
- Bug, support and security records remain while needed to investigate the issue, protect the service, handle a dispute or meet a legal duty.
Backup copies age out under the applicable backup cycle rather than remaining as live customer records. These criteria can produce different periods for different records.
7. Cookies and browser storage
Labs uses necessary browser storage for functions such as sign-in, security, tool settings and remembering your consent choice. Optional analytics is not required to use Labs.
- Google Analytics 4: its script and analytics storage load only after you choose Accept analytics.
- Microsoft Clarity: its script and analytics storage load only after you choose Accept analytics.
- Withdrawal: choose Cookie settings and decline analytics. Labs then records the new choice, stops future optional analytics loading and clears known Labs analytics cookies where practical.
8. Your choices and rights
Depending on the law that applies, you may ask for access, correction, deletion, restriction, portability or objection, and you may withdraw consent. Signed-in customers can use the account controls to download hosted account data, revoke all sessions or delete hosted Boards, shares, cloud scenes and Embed records. You can also email [email protected]. We may need to confirm identity and may keep billing, tax, security, dispute or other records where the law requires or permits it.
You can complain to the UK Information Commissioner's Office. Please contact us first if you would like us to investigate.
9. Children and automated decisions
Labs is a professional tool suite and is not directed at children. We do not use Labs personal data to make solely automated decisions that produce legal or similarly significant effects.
10. Changes
We may update this notice when the service, providers or law changes. The effective date and version above identify the current notice.
Also read the Terms of Use and Paid Terms and Accessibility Statement.
© XO3D Ltd. All rights reserved.