Privacy policy

Last updated 6 October 2026

This explains what personal information 3D Thing collects when you visit our website, use the editor, publish a model, open a link somebody shared with you, or use our Blender, 3ds Max and SketchUp plugins. It says why we need it, how long we keep it, and what you can do about it.

Who we are

3D Thing is run by [Registered legal name of the company that runs 3D Thing], a company registered in [Country where the company is established] (company number [Company registration number (for example the CIN in India)]), at [Registered office address, in full]. In this policy "we" and "us" means that company.

For privacy questions, write to [Privacy email address for access, deletion and other data requests]. The person responsible for privacy is [Name or title of the person responsible for privacy] ([Privacy officer email address (can be the privacy address above)]). Other contacts, including our Grievance Officer for India and our representatives in the EU and the UK, are listed at the end.

Your data, and your clients' data

There are two different situations, and they are handled differently.

• When you use 3D Thing yourself (you visit the site, create an account, subscribe, contact us), we decide what happens to your information. In legal terms we are the controller (in India, the data fiduciary).
• When your client opens a link you published and leaves a note, saves a design or approves one, they are giving that information to you, through us. You decide who gets a link and what to do with what comes back, so you are the controller of it and we handle it on your behalf as your processor. Our data processing addendum sets out the rules we follow for that. If you are a client with a question about your note or approval, the designer who sent you the link is the first person to ask, and we will help them answer.

What we collect and why

For people in the EEA, the UK and other places whose laws ask for it, the "legal basis" column says which ground we rely on: contract (we need it to provide the service you signed up for), legitimate interests (a reasonable need of ours that does not override your rights, such as keeping the service secure), or legal obligation.

Your account

Your projects and published links

A model can itself contain personal information, such as a client's name in a file or the floor plan of somebody's home. We treat it as your private content: we do not look inside it except to process it automatically, to fix a problem you asked us to look at, or when the law or a report of illegal content requires it.

What your clients send through your links

When somebody opens a link you published, we collect only what they choose to send:

• Feedback notes: the note, the point on the model it is pinned to, the camera view and the design options showing at the time, up to four photos (we remove location and camera data from photos before storing them), and a name and email address if they type them.
• Saved and approved designs: the options chosen, any prices you set up and they were shown, a message, and for an approval, the full name they type, the email address if they give one, the sentence they agreed to and the time. Approvals are written to a tamper-evident record for the project so that you and your client can later show what was agreed.
• A random id stored in their browser, created only when they first leave a note or save a design, so they can see and delete their own notes later. It is not linked to an account and is not used to follow anyone anywhere.

We use this only to deliver it to you and to email the people involved when there is something for them to see.

Notifications and email

We keep a list of things that happened on your projects that you may want to know about: who left a note, approved a design or replied, on which project, with a short excerpt. We send these as emails, either straight away (client decisions, replies, and security events such as your account being closed) or as a daily summary, depending on your notification settings. Every email that is not essential to your account has a one-click unsubscribe link. We send only service emails. We do not send marketing email.

The first time you sign in to a new account we send one welcome email. If an email to you cannot be delivered, if you mark one as spam, or if you use the unsubscribe link in an email we sent you without an account, we put that email address on a do-not-email list so that we do not write to it again. The list holds the address and the reason and nothing else. Sign-in links you ask for still arrive unless the address cannot receive mail at all.

Plugins and the API

• API token names, the first few characters of each token, their permissions and when they were last used. The token itself is shown to you once and we keep only a hash.
• When a plugin sends a scene: the file, its size, the name and version of the app and plugin, the renderer, your operating system name, and a report of what was converted. This is how the conversion report on your project is written, and how monthly upload allowances are counted.
• The plugin stores its sign-in token in a file on your own computer. It sends no usage statistics.

Asking for the demo account

The demo account is shared by everyone who asks for it, and it keeps nothing on our servers: what you do in it stays in your browser and is cleared when you close the tab or sign out. We do not link what happens inside the demo account to the request you sent. The free viewer at /inspector needs no details at all.

Visits to our public pages (only if you agree)

This is off until you say yes, and it is never loaded for a browser that sends Global Privacy Control. It runs only on our public pages. It does not run when you are signed in to your account, in the editor or the viewer, on a link somebody published, or in the free viewer at /inspector. We turn off Google's advertising features, and we send it no name, email address, account or project information. Google acts for us in counting the visits; we use the result only to understand how the website is used.

Security and running the service

• Server logs. Like almost every website, our servers record each request: the time, the address requested, the response, the browser type and the IP address it came from. We use these to keep the service working and secure, and to investigate abuse. Legal basis: legitimate interests.
• Rate limits. To stop password guessing and spam, we count requests per IP address. These counts are kept in memory for a few minutes and never written down.
• Messages to us. If you email support, send a privacy request, report content or send a legal notice, we keep the message and what we did about it. Legal basis: legitimate interests, and legal obligation where a law requires us to respond.

What we do not do

• We do not sell personal information, share it for advertising, or use it for targeted advertising or profiling.
• We do not use advertising cookies or tracking pixels. The one third-party analytics service we use is Google Analytics, only on our public pages, and only if you agree.
• We do not train AI models on your models, your clients' feedback or anything else you upload. The few AI features in the editor run on your own device, from files we host ourselves, and send nothing to an AI company.
• The free viewer at /inspector reads files inside your browser. They are never uploaded.
• We do not make decisions about you that are based only on automated processing and have legal or similarly significant effects.

Who else sees it

• Companies that run parts of the service for us (hosting, storage, email, payments). They may use the information only to provide their service to us. The current list, with what each one does and where, is on the sub-processors page.
• Payment providers. Razorpay or Stripe take your payment details directly. We never see your card number. They also keep records as the law requires of them.
• Google, if you choose to sign in with Google, and if you agree to analytics on our public pages.
• The people you choose. Your team sees the projects you share with it. Anyone with a published link can open that version, and with a password link, anyone who also has the password. Your clients see your name and logo on your links.
• Places you connect. If you set up a webhook, single sign-on for your team, or an integration, we send what you configured to the address you gave.
• Authorities, when the law requires it, for example a court order, or to protect somebody from serious harm. Where we are allowed to, we will tell you first.
• A buyer, if the company or the service is sold or merged. The buyer would have to keep to this policy or tell you before changing it.

Some features make your browser, or your client's browser, load files from another company (for example a YouTube video placed in a scene, or a picture the owner linked from their own site). Those companies then see the IP address. The list is on the cookies and storage page.

Where it is kept

Our API server and database are in Singapore. The website and the editor are delivered from Vercel's network around the world, with the website's server code running in Singapore. Model files and images are kept in Cloudflare's storage in the Asia-Pacific region, which serves them from data centres around the world so they load quickly wherever the viewer is. Email is sent through Resend, a United States company, from its Tokyo region in Japan, and payments go through Razorpay in India or Stripe in the United States and Ireland.

When information about people in the EEA, the UK or Switzerland goes to a country those places have not recognised as adequate, it is protected by the European Commission's Standard Contractual Clauses (with the UK addendum and the Swiss amendments), or by the provider's certification under the EU-US Data Privacy Framework. You can ask us for a copy of the relevant safeguards. Information about people in India may be processed outside India except in any country the Government of India restricts.

How long we keep it

Your choices and rights

You can do most of this yourself, straight away:

• See and download your data: the account page has a download that gives you everything your account holds in one file, with links to download each model.
• Correct it: change your name and logo on the account page; ask us to change anything else.
• Delete it: delete projects and links at any time, or close your account.
• Emails: change your notification settings, or use the unsubscribe link in any notification email.

Depending on where you live you may also have the right to object to or restrict some uses, to withdraw consent, to take your data to another service, to appeal a decision we make about your request, and to complain to a regulator. The region sections below list them. To use any right that is not a button in your account, email [Privacy email address for access, deletion and other data requests]. We will check it is really you (usually by replying to the address on the account), and answer within a month, or sooner where the law in your country sets a shorter time. It is free. Somebody else can make a request for you if you authorise them in writing.

If you were a client who left feedback or approved a design on a designer's link, ask that designer first: it is their project. If you cannot reach them, write to us and we will help.

Security

Everything travels over HTTPS. Passwords, API tokens and link passwords are stored only as hashes. Sessions use a cookie that page scripts cannot read. Uploaded files are checked for type and size, photos attached to feedback are re-encoded, and protected links deliver the model in encrypted pieces. Access to production systems is limited to the people who run them. No system is perfectly secure; if a breach puts your information at risk we will tell you and the regulators the law requires us to tell, as quickly as the law requires.

Children

3D Thing is a professional tool. You must be 18 or older to create an account. We do not knowingly collect information from children, and the service is not directed at them. If you believe a child has given us information, tell us at [Privacy email address for access, deletion and other data requests] and we will delete it.

Region by region

European Economic Area, the United Kingdom and Switzerland

You have the right to access, correct, erase and download (port) your personal data, to restrict or object to processing based on legitimate interests, and to withdraw any consent at any time. Our EU representative is [EU representative (GDPR Art. 27 and DSA Art. 13): name, address, email] and our UK representative is [UK representative (UK GDPR Art. 27): name, address, email]. You can complain to us first at [Privacy email address for access, deletion and other data requests]; we acknowledge complaints within 30 days. You can also complain to your local data protection authority, in the UK to the Information Commissioner's Office (ico.org.uk), and in Switzerland to the Federal Data Protection and Information Commissioner. The countries your data may go to are the one named in Where it is kept, the United States, Ireland, and the countries where Cloudflare and Vercel have data centres.

Website analytics with Google Analytics is the one use that rests on your consent. We ask before we set any analytics cookie, saying no is as easy as saying yes, you can change your answer at any time on the cookies and storage page, and nothing about the service changes if you say no.

United States

This section is for residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia and other states with similar laws. In the last 12 months we have collected these categories of personal information, from you, from your use of the service and from the people you work with, for the purposes described above:

• Identifiers: name, email address, account id, IP address.
• Commercial information: plan and subscription history.
• Internet activity: server logs, and view counts for your links (which contain no personal information).
• Professional information: the teams you belong to and your role.
• Content you give us: models, notes, messages and approvals.
• Sensitive personal information: only your sign-in details (email and password), which we use only to sign you in.

We disclose these only to the service providers and the other recipients listed in Who else sees it, for business purposes. We do not sell or share personal information, and have not in the last 12 months. Google Analytics runs only if you agree, with Google's advertising features turned off, so it is not a sale or sharing, and it never loads when your browser sends Global Privacy Control. We do not use it for targeted advertising or for profiling that produces legal or similarly significant effects, and we do not use sensitive personal information for anything that would give you a right to limit it. We do not knowingly sell or share information of anybody under 16.

You have the right to know what we collect and how we use it, to get a copy, to correct it, to delete it, to opt out of sale, sharing and targeted advertising, and not to be treated differently for using these rights. We honour the Global Privacy Control signal as an opt-out. To make a request, email [Privacy email address for access, deletion and other data requests] or use the buttons on your account page. If we turn down your request you can appeal by replying to our answer with the word "appeal"; we will answer the appeal within the time your state allows (usually 45 or 60 days), and if you disagree you can contact your state attorney general.

India

We process your personal data for the purposes described in this policy, which you accept when you create an account. You can withdraw your consent at any time by closing your account or writing to us; withdrawing is as easy as giving it, and it does not affect what was done before. You have the right to a summary of the personal data we process and who we have shared it with, to correct, complete, update and erase it, to have a grievance answered, and to nominate somebody to act for you if you die or cannot act.

Our Grievance Officer is [Name of the Grievance Officer (India)], [Job title of the Grievance Officer], reachable at [Grievance Officer email address] or [Postal address for grievances (can be the registered office)]. We acknowledge a grievance within 24 hours and resolve it within the time the Information Technology Rules and the Digital Personal Data Protection Rules require. If you are not satisfied you may appeal to the Grievance Appellate Committee, or complain to the Data Protection Board of India once you have used our process.

Canada

You can ask to see and correct your information and withdraw consent. The person in charge of protecting personal information is [Name or title of the person responsible for privacy] ([Privacy officer email address (can be the privacy address above)]). You can also ask us for your data in a structured, commonly used format. If you are not satisfied you can complain to the Office of the Privacy Commissioner of Canada, or in Quebec to the Commission d'accès à l'information.

Brazil

Under the LGPD you can confirm whether we process your data, access, correct, anonymise, block or delete it, port it, learn who we share it with, and withdraw consent. Our contact for data protection (encarregado) is [Name or title of the person responsible for privacy] ([Privacy officer email address (can be the privacy address above)]). You can also complain to the ANPD.

Other countries

If you live in Australia, Japan, Singapore, South Korea, South Africa, the United Arab Emirates, Saudi Arabia or another country with a data protection law, you have the rights that law gives you, which usually include access, correction and deletion, and you can use them in the same way by writing to [Privacy email address for access, deletion and other data requests]. Where a law asks for it: our data protection contact is [Name or title of the person responsible for privacy]; your information may be processed in the countries named in Where it is kept, under the safeguards described there; and you can complain to your national regulator (for example the OAIC in Australia, the PPC in Japan, the PDPC in Singapore, the PIPC in South Korea, or the Information Regulator in South Africa). For Japan: the company is represented by [Name of the company director who represents it], and our security measures are summarised under Security. We do not offer the service in mainland China.

Changes

When we change this policy we update the date at the top. If a change matters, for example a new use of your data, we will email account holders before it takes effect and, where the law requires, ask for your agreement again.

Contact

• Privacy requests and questions: [Privacy email address for access, deletion and other data requests]
• Person responsible for privacy: [Name or title of the person responsible for privacy], [Privacy officer email address (can be the privacy address above)]
• Grievance Officer (India): [Name of the Grievance Officer (India)], [Grievance Officer email address]
• EU representative: [EU representative (GDPR Art. 27 and DSA Art. 13): name, address, email]
• UK representative: [UK representative (UK GDPR Art. 27): name, address, email]
• Post: [Registered legal name of the company that runs 3D Thing], [Registered office address, in full]