Privacy policy
To be reviewed by a lawyer. Working draft written from the rules of the service, to be reviewed by a lawyer before paid orders open. This English version is a translation provided for information only. The French version is the only legally binding one. Read the French version
This policy explains what data objekto processes, why, with whom and for how long, and how to exercise your rights (Regulation (EU) 2016/679, “GDPR”, and the French Data Protection Act). Data controller: objekto (a company being registered; its corporate name, legal form, share capital, trade register (RCS) number, registered office and EU VAT number will appear in the legal notice before paid orders open). Contact for your data: support@objekto.io.
Your data
1. Data processed and purposes
| Data | Why | Legal basis |
|---|---|---|
| Email, display name, profile, preferences | Create and manage your account, log you in | Contract |
| Descriptions, photos, sketches, videos, files, conversations | Design your objects, answer you | Contract |
| Designs, versions, generated files | Provide them to you, have them made, show them in the gallery when the project is public (the default, changeable at any time) | Contract |
| Orders, delivery address and phone number | Manufacture, ship, provide after-sales service | Contract |
| Payments, invoices | Collect payment, invoice, keep the accounts | Contract, legal obligation |
| Hashed fingerprints (email, network, device) | Grant the welcome bonus only once, prevent fraud | Legitimate interest |
| Technical logs, security | Run and secure the service | Legitimate interest |
| Messages to support, reviews | Answer you, improve the service | Legitimate interest |
| Product news emails | Keep you informed, only if you agreed | Consent |
| ChatGPT ads measurement: the ad click identifier, a random browser reference, hashed fingerprints of your email and account id, IP address and browser at a sign-up, an order or a subscription | Know which ChatGPT ads bring sign-ups and orders, only if you click “Accept” in the cookie banner | Consent |
We do not collect any bank card data (handled by Stripe) and we do not sell any data. Our AI providers do not use your content to train their models.
2. Public projects
A new project is public by default; you can make it private when you create it or at any time in the project (“Public / Private”). A public project only shows its title, description, renders, 3D model, parts and indicative price; never your conversation, photos, sketches, videos or files.
Your username and avatar only appear under your public designs if you make your profile public (Settings › Profile). Your public / private choice is kept with its date, an encrypted fingerprint of your network and your browser, as proof, for the lifetime of the project.
3. Photos and videos
Avoid attaching faces, identity documents or private places. Images are stripped of their metadata (EXIF); original videos are deleted after 90 days, and only the key frames needed for the design are kept with the project.
4. Recipients and subprocessors
Your data is processed by authorised objekto staff and by subprocessors bound by contract (data processing agreement):
| Subprocessor | Role | Location |
|---|---|---|
| Supabase | Database, authentication, file storage | European Union (Ireland) |
| Vercel | Hosting of the website and the API | European Union (Dublin) and United States |
| Railway | Background processing (generations, orders) | European Union |
| Modal | Isolated 3D computing (running CAD code, renders) | United States (standard contractual clauses) |
| Anthropic | AI models: understanding requests, images and video key frames | United States (Data Privacy Framework or standard clauses); 30-day retention for some models |
| OpenAI | Transcription of video audio, only if you turn on “Use sound” | United States (Data Privacy Framework or standard clauses) |
| Stripe | Payments, invoices, fraud prevention | European Union (Ireland) and United States |
| Resend | Sending emails | United States (standard contractual clauses) |
| Manufacturing workshop (Craftcloud, 3DAPI or other, named in the summary) | Manufacturing and shipping: 3D files, delivery name, address and phone number, with a relay email (never your own email) | European Union |
| Carrier | Delivering the parcel | Depending on the shipment |
| Sign-in with a Google account, if you choose it | United States (Data Privacy Framework) | |
| OpenAI (ChatGPT Ads) | Conversion measurement of ChatGPT ads (pixel and Conversions API), only if you accept: hashed fingerprints of your email and account id, click identifier, browser reference, IP address and browser | United States (Data Privacy Framework or standard clauses) |
When data is transferred outside the European Union, the transfer is covered by an adequacy decision (Data Privacy Framework) or by the European Commission's standard contractual clauses.
5. Retention periods
| Data | Period |
|---|---|
| Account, projects, conversations | Until the project or the account is deleted |
| Attachments | Until the project is deleted (original videos: 90 days) |
| Orders, payments, invoices | 10 years (accounting obligation), anonymised when the account is deleted |
| Rights declarations and acceptances of the Terms of Sale | 5 years after the last related order |
| Anti-abuse fingerprints for the welcome bonus | 3 years |
| Technical logs | 12 months at most |
| Moderation decisions | 1 year, unless proceedings are ongoing |
| Anonymous audience measurement | 400 days, without IP addresses |
| ChatGPT ads measurement (with your consent) | Cookie choice: 6 months; click identifier: 30 days; IP address and browser: 30 days; conversion events: 400 days at most, deleted with your account |
| In-app notifications | 90 days |
6. Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability, as well as the right to withdraw your consent and to set instructions for what happens to your data after your death.
- Export your data: Settings › Export my data.
- Correct your profile: Settings.
- Delete your account: Settings (accounting records are kept, anonymised).
- Unsubscribe from emails: link at the bottom of every email, or Settings.
- Any other request: support@objekto.io.
You can lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).
8. Security
Data is encrypted in transit and at rest, access is partitioned per user, and the code produced by the AI runs in an isolated environment with no network and no secrets. In the event of a data breach that poses a risk, we will inform you and notify the CNIL within the legal deadlines.
9. Minimum age
The service is reserved for people aged 15 and over. Purchases are reserved for adults or authorised minors.
10. Changes to this policy
Any significant change is announced in the service or by email before it takes effect.