Privacy Policy
For a short version, see Your privacy in plain English.
This policy explains what personal data Shot3D collects, why, who we share it with and the rights you have. We've written it to be read, not skimmed past. If anything is unclear, email us at support@shot3d.co.uk.
The short version: your 3D models never leave your device. Shot3D renders everything in your browser, so we never receive, store or see your model files or the images and videos you export. We only hold what we need to run your account and subscription.
Who we are
Shot3D is operated by DANCI LTD, a company registered in England and Wales (company number 17228936), whose registered office is at Unit 8b Slutchers Lane, Bank Quay Trading Estate, Warrington, WA1 1PJ, United Kingdom. We are the controller of the personal data described in this policy, which means we decide how and why it is used.
You can contact us about anything in this policy at support@shot3d.co.uk.
Your 3D models stay on your device
When you import a model into the Shot3D studio, it is opened and rendered locally in your web browser. Thumbnails, batch exports and turntable videos are created on your device and saved directly to it.
- Model files, textures, renders and videos are not uploaded to our servers or to any third party.
- Studio preferences (lighting, camera, presets and export settings) are saved in your browser's local storage on your device, so they are there next time. They are not sent to us. If you add a logo in Reel Studio, a copy is kept in your browser with your reels so you don't have to add it again. It is never sent to us. You can clear them at any time by clearing your browser's site data.
- If you save a project, your browser stores a copy of its model files, textures and settings in its own database on your device, so you can reopen it later. Saved projects are not sent to us. You can delete them in the Projects dialog, or by clearing your browser's site data.
- If you download a .shot3d project file, it is made on your device and saved where you choose. It contains copies of your model files, so only share it with people you'd share the models with.
The personal data we collect
| What | Examples | Where it comes from |
|---|---|---|
| Account details | Name, email address, profile picture, and an identifier from Google if you sign in with Google | You, or Google if you sign in with it |
| Export counts | The number of images you've exported, on your account (never the images themselves) | Generated when you export on a free account or a trial |
| Signed-out export counts | A count of exports against a keyed hash of your IP address, which changes every day. Your IP address itself isn't stored in this count | Generated when you export without an account |
| Sign-in and security data | Sign-in times, IP address, browser and device type, verification codes, failed sign-in attempts, and technical signals used to detect automated (bot) sign-ups | Generated when you use your account |
| Subscription and billing details | Your plan, trial and subscription status, billing name and address, payment history, the last four digits and expiry of your card | You, via our payment processor Stripe |
| Messages you send us | Support emails and anything you include in them | You |
| Technical logs | IP address, browser type, pages and API requests, timestamps, error reports | Generated automatically when you visit the site |
| Website analytics | Pages viewed, the site that referred you, country, browser, operating system and device type, and which studio features are used (such as exports started and limits reached), counted in aggregate | Generated automatically when you visit the site, by Vercel Web Analytics |
We never see or store your full card number. Payments are handled by Stripe, which is certified to the highest level of the Payment Card Industry Data Security Standard (PCI DSS).
We don't collect special category data (such as health information), and we ask you not to send it to us.
How and why we use it
UK data protection law requires a lawful basis for each use of personal data. Ours are:
| Purpose | Lawful basis |
|---|---|
| Creating and running your account, signing you in | Contract: necessary to provide the service you asked for |
| Taking payments, running your trial and subscription, plan changes and refunds | Contract |
| Sending service emails, such as sign-in codes, receipts, trial reminders and important changes to the service or these terms | Contract, and legal obligation where the law requires a notice |
| Keeping accounts secure, detecting bots, preventing fraud and abuse, and enforcing plan limits | Legitimate interests: protecting you, us and other users |
| Enforcing export limits, including counting signed-out exports by a hash of your IP address | Legitimate interests: keeping the free service sustainable and preventing abuse of its limits |
| Fixing errors and improving the service using technical logs | Legitimate interests: running a reliable product |
| Understanding which pages are useful and how people find the site, using aggregate analytics | Legitimate interests: improving the website and its guides |
| Keeping financial and tax records | Legal obligation |
| Answering your messages | Legitimate interests, or contract when it concerns your account |
We do not sell your personal data, use it for advertising, or make decisions about you based solely on automated processing that have legal or similarly significant effects.
We will only send marketing emails if you have opted in, and every marketing email will include a way to unsubscribe.
Who we share it with
We use trusted providers (processors) to run Shot3D. They may only use your data to provide their service to us, under contracts that require them to protect it.
| Provider | What they do for us | Where data may be processed |
|---|---|---|
| Clerk | Accounts, sign-in, security and bot detection | United States |
| Stripe | Payments, subscriptions, invoices and fraud prevention | United States, European Union |
| Vercel | Website and server hosting, and cookie-free website analytics | United States, European Union |
| Cloudflare | Domain name services and forwarding of emails sent to our addresses | Global network |
| Resend | Sending service emails such as trial reminders | United States |
| Upstash | Storing signed-out export counts | United Kingdom (London) |
If you choose to sign in with Google, Google shares your basic profile (name, email address and profile picture) with us. Google's own privacy policy applies to how it handles your data.
We may also disclose personal data if the law requires it, to protect the rights and safety of our users or others, or to a buyer or successor if our business is sold or reorganised. In that case we would require them to protect your data as described here.
International transfers
Some of our providers process data outside the UK, mainly in the United States. Where they do, we rely on safeguards recognised under UK law, such as the UK Extension to the EU–US Data Privacy Framework, the UK International Data Transfer Agreement or Addendum, or UK adequacy regulations.
How long we keep it
| Data | How long |
|---|---|
| Account details | While your account is open. When you delete your account, we delete it, normally within 30 days |
| Subscription, payment and invoice records | 6 years after the end of the financial year they relate to, as required by UK tax law |
| Support emails | Up to 2 years after the conversation ends |
| Signed-out export counts | Deleted automatically within 2 days |
| Export counts on your account | While your account is open. Daily counts are replaced each day |
| Technical and security logs | For a limited period, normally no longer than 90 days, unless needed to investigate a security incident |
Cookies and local storage
Shot3D uses only strictly necessary cookies and storage. We do not use advertising or analytics cookies, so we don't show a cookie banner.
- Sign-in cookies (set by Clerk) keep you securely signed in.
- Payment pages hosted by Stripe use their own essential cookies for security and fraud prevention.
- Local storage on your device keeps your studio preferences, your export count and the result of the age check on this device.
- Browser database storage (IndexedDB) on your device keeps the projects you choose to save, and nothing else. It is only used when you click Save project.
Our website analytics (Vercel Web Analytics) don't use cookies or store anything on your device, and don't follow you across other websites. Visits are counted in aggregate, and Vercel doesn't give us your IP address or a profile of you.
If we ever add optional cookies, we will ask for your consent first.
Your rights
Under UK data protection law you have the right to:
- Access the personal data we hold about you and receive a copy of it
- Rectify data that is inaccurate or incomplete
- Erase your data ("the right to be forgotten")
- Restrict how we use your data
- Object to uses based on our legitimate interests
- Data portability: receive the data you gave us in a common, machine-readable format
- Withdraw consent at any time, where we rely on it
You can update your name, email address and sign-in methods yourself in your account settings. To use any of these rights, email support@shot3d.co.uk. We may need to confirm your identity, and we will respond within one month. There's normally no charge.
Some data we must keep even if you ask us to delete it, such as invoices we are legally required to retain.
Complaints
If you're unhappy with how we handle your data, please email us your complaint so we can try to put it right. We'll acknowledge it within 30 days, look into it without undue delay, keep you updated and tell you the outcome. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk or by phoning 0303 123 1113.
Security
We protect your data with encryption in transit (HTTPS), verified sign-ins, checks against breached passwords, protection against repeated sign-in attempts, signed and verified payment notifications, and access to production systems limited to people who need it. No online service can be perfectly secure, but we work to keep your data safe and will tell you and the ICO about a personal data breach where the law requires it.
Children
Shot3D is not intended for children under 13, and we do not knowingly collect their data. Some of our users may be aged 13 to 17, and we've designed Shot3D with the ICO's Children's Code in mind.
Before creating an account, we ask for your month and year of birth. This is checked on your device and isn't saved or sent to us: your browser only remembers whether you passed. You must be 18 or over, or have the permission of a parent or guardian, to buy a subscription.
If you believe a child under 13 has given us personal data, contact us and we will delete it. If someone under 18 bought a subscription without permission, see our plain-English guide.
Changes to this policy
We'll update this policy when our practices change. The date at the top shows when it last changed. If we make significant changes, we will tell account holders by email or in the studio before they take effect.