1. Introduction

PolyMedium ("we," "our," or "us") operates an AI-powered platform that converts 2D images into 3D assets. This Privacy Policy explains what information we collect, how we use and share it, how long we keep it, and the rights you have under laws including the California Consumer Privacy Act / California Privacy Rights Act ("CCPA/CPRA") and the EU/UK General Data Protection Regulation ("GDPR/UK GDPR").

For the purposes of GDPR/UK GDPR, PolyMedium is the data controller for personal data processed through the service. For CCPA/CPRA, PolyMedium is the "business" with respect to your personal information.

2. Categories of Information We Collect

2.1 Account & identifiers

Email address, username, password hash
Mobile phone number (legacy accounts only; signup no longer collects one)
User ID and authentication tokens

2.2 Commercial information

Wallet balance, the wallet ledger of top-ups, charges and refunds, invoices, and a legacy subscription plan where one still exists
Payment card details are collected and stored by Stripe; we receive only a customer ID and truncated card metadata

2.3 Content you provide

Images you upload as references for generation or adjustment
Generated 3D assets (GLB) and version history
Prompts, project names, descriptions, and gallery submissions
Feedback, contact, and support messages

2.4 Internet / device / usage data

IP address, browser type, device type, operating system
First-party analytics events (landing page views, CTA clicks, signup events, feature usage) stored in our own database. We do not currently load Google Analytics, Meta Pixel, or other third-party advertising trackers
Essential cookies / local storage used to keep you signed in and remember preferences

3. How We Use Your Information & Legal Bases (GDPR)

Provide the service (account, generation, storage, export): performance of a contract.
Process payments & subscriptions: performance of a contract and legal obligation (tax / accounting).
Send service emails (welcome, password reset, receipts, important account notices): performance of a contract / legitimate interests.
Improve, secure, and debug the service, prevent fraud and abuse: legitimate interests.
Comply with law and respond to lawful requests: legal obligation.
AI processing of your uploads to generate or adjust 3D assets: performance of a contract.

We do not use your account data, uploaded images, or generated assets for behavioral advertising and we do not sell your personal information for money.

4. Sub-processors & Sharing

We share the minimum personal data required with the following sub-processors:

Lovable Cloud / Supabase: managed database, authentication, storage, and edge functions hosting.
Stripe, Inc.: payment processing, invoicing, and the customer portal used for subscription management and cancellation.
Twilio Inc.: SMS delivery for the retired phone verification flow (no longer used for new signups).
Resend: transactional email delivery (welcome, contact, feedback acknowledgements).
Google (Gemini API): AI processing of uploaded images and prompts. We use Gemini to prepare a reconstruction reference from your image (isolating and re-rendering the subject) and to synthesise additional viewpoints.
fal.ai: the AI inference platform that performs background removal (BiRefNet) and 3D reconstruction (TRELLIS). Every image you submit for generation is transmitted to, and temporarily stored by, fal.ai. Files they store are held at unlisted URLs on their infrastructure for the duration of processing.
Meshy (accessed via fal.ai): automatic rigging for the legacy Animate add-on and retexturing for the legacy Remaster add-on (neither is offered for new generations). Receives the generated 3D model, not your original image.
Lovable (AI Gateway): routes uploads to a moderation model that screens content before generation.
Aspose: on-demand 3D file format conversion (GLB → FBX).
Browserless: server-side thumbnail rendering of generated 3D assets.

Each provider processes your data under its own terms and privacy policy. We do not sell your data, and we do not submit your images to any provider for the purpose of training their models; however, a provider's own retention and model-improvement practices are governed by their terms, not ours.

We also disclose information to comply with law, enforce our Terms, or protect rights, property and safety.

5. Publicly Accessible Content

Uploaded reference images, generated 3D assets, and adjustment references are stored in publicly readable storage buckets so the asset viewer, exporter, and public Gallery can fetch them. Anyone with a direct URL to a file can access it. If you submit an asset to the public Gallery, the asset, its title and description, and your display name and avatar will be publicly visible and downloadable by other users under the license described in our Terms of Service.

6. International Data Transfers

Our service and sub-processors are primarily located in the United States. If you access the service from the EEA, the UK, or other regions with data-protection laws, your information will be transferred to and processed in the United States. Where required, we rely on the European Commission's Standard Contractual Clauses (SCCs) and equivalent UK addenda offered by our sub-processors as the transfer mechanism.

7. Data Retention

Account data: kept while your account is active.
Uploaded images and generated assets: kept until you delete them or delete your account.
Billing records and invoices: retained for up to 7 years to comply with tax and accounting law.
Analytics events: aggregated or deleted within 24 months.
Phone verification records: short-lived OTP records are deleted shortly after expiration.
Support communications: kept for up to 24 months.

8. Your GDPR / UK GDPR Rights

If you are in the EEA, the UK, or Switzerland, you have the right to: access your personal data; have it corrected or erased; restrict or object to processing; data portability; and withdraw consent at any time where processing is based on consent. You also have the right to lodge a complaint with your local supervisory authority. To exercise these rights, email polymediumcontacts@gmail.com. We do not currently maintain an EU representative under Art. 27 GDPR; if this changes we will publish the representative's contact details here.

9. Your California (CCPA/CPRA) Rights

California residents have the right to (1) know the categories and specific pieces of personal information we collect, use, and disclose; (2) request deletion; (3) request correction; (4) opt out of "sale" or "sharing" of personal information; (5) limit the use of sensitive personal information; and (6) be free from discrimination for exercising these rights.

Do Not Sell or Share My Personal Information

PolyMedium does not sell personal information for money and does not "share" personal information for cross-context behavioral advertising as those terms are defined under the CCPA/CPRA. We do not use third-party advertising trackers (Meta Pixel, Google Ads, TikTok Pixel, etc.) on the service. If this ever changes we will provide a clear opt-out link here. To submit any other CCPA request, email polymediumcontacts@gmail.com from the address on your account; we will verify your identity before processing.

10. Cookies & Tracking

We use essential cookies and browser storage to keep you signed in, remember UI preferences (e.g. theme), and protect against abuse. We also use the Google tag (gtag.js) for two measurements: whether our Google advertising leads to sign-ups and purchases, and aggregate site usage via Google Analytics (pages visited, traffic sources). For visitors in the EEA, the United Kingdom and Switzerland, advertising and analytics storage is set to denied by default via Google Consent Mode: no advertising cookies are stored and Google receives only cookieless, aggregate pings. Elsewhere, the tag operates normally for conversion and usage measurement; we do not use it for remarketing or ad personalization. You can learn how Google uses this data at policies.google.com/technologies/ads. If we ever expand tracking beyond this measurement (for example remarketing), users in regulated regions will see a consent banner offering granular choices before any such trackers load.

11. Children's Privacy

The service is not directed to children under 13 (or under 16 in the EEA/UK). By creating an account you confirm that you meet this minimum age. If we learn that we have collected personal information from a child below this age without verifiable parental consent, we will delete it.

12. AI Processing & AI-Generated Output

Images and prompts you submit are transmitted to the AI providers listed in section 4 to produce a 3D asset. Outputs are generated automatically and may contain errors, omissions or unexpected results: the pipeline re-renders your subject rather than copying it pixel-for-pixel, so details can change. We do not use your uploads or prompts to train our own models; third-party providers' use of submitted data is governed by their own terms.

Images of people

If you upload a photograph of a person, that image (including facial detail) is processed by the providers in section 4 in order to reconstruct a 3D likeness. We do not use facial recognition, we do not attempt to identify anyone, and we do not build or retain face templates or other biometric identifiers for matching purposes. The uploaded image and any model produced from it are stored in your account and are deleted when you delete the asset or your account.

You must have the right to upload any photograph of a person, and the depicted person's permission to create a 3D likeness of them. Be aware that publishing such a model to the public gallery licenses it to other users (see our Terms). Do not upload photographs of other people without their consent, and do not upload photographs of children who are not in your care.

13. Security

We use TLS in transit, encrypted storage at rest with our cloud provider, row-level security policies, and least-privilege access controls. No system is perfectly secure; we cannot guarantee absolute security.

14. Account Deletion

You can delete your account at any time from Profile → Delete Account. This removes your profile, projects, assets, and uploaded references. Some records may be retained as required by law (e.g. billing) or in anonymized form for analytics integrity.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date, and where appropriate by email.

16. Contact

Questions or privacy requests: polymediumcontacts@gmail.com.