Privacy Policy

1. Scope and Definitions

1. User: A natural person who accesses or uses the Platform, including unregistered visitors (“Visitors”) and registered users (designers/authors and buyers/customers).
2. Personal Data: Data that identifies or can be used to identify an individual on its own or in combination with other data (e.g., email address, payment identifiers, IP address, device identifiers).
3. 3D Asset Data: Non-personal technical information related to 3D models (e.g., topology, texture size, render settings, compression/packaging method, preview thumbnails). These are generally not personal data, but may be deemed personal when combined with personal information.

2. Information We Collect

We collect information only to the extent necessary to achieve explicit purposes.

2.1 Information You Provide

1. Account profile: Email address, username, password (stored in encrypted form); optional items such as avatar, bio, social/portfolio links, invoice details.
2. Transaction data: Shipping/payout details (e.g., PayPal identifier), order details, invoices, and after-sales records.
3. Creation & operations: Models you upload, previews, demo videos, source and license information for materials, and materials required for dispute resolution.
4. Support & compliance: Evidence and explanations you submit in tickets/customer support/rights notices.

2.2 Information Collected Automatically

1. Device & logs: IP address, browser and device type, operating system, request timestamps and URLs, referrers, session and dwell time, crash and error logs, baseline performance metrics.
2. Cookies/local storage & similar technologies: Used for session continuity, preference storage, anti-fraud, anti-hotlinking, conversion analytics, and product optimization (see the Cookie Policy).

Most 3D asset marketplaces use cookies and logs for site improvement, IT security, and experience optimization; we follow similar practices and obtain consent where required.

2.3 Information from Third Parties

1. Payment/settlement partners (e.g., PayPal) return necessary payment status and reconciliation identifiers to us. We do not store your full card number. Like comparable platforms, financial data are processed and stored by licensed payment institutions.

3. How We Use Information (Purposes & Legal Bases)

1. Contract performance / service delivery: Registration and login, licensing and downloads, updates and re-delivery, after-sales support, creator revenue share and withdrawals.
2. Legal compliance: Tax issuance and retention, AML/sanctions screening (where applicable), rights notice and handling.
3. Legitimate interests: Platform security (risk control, anti-hotlinking and anti-scraping), abuse and fraud prevention, product and operations optimization, statistics and analysis, and spot checks on model quality and compliance.
4. Consent: Optional electronic marketing, cookies/analytics and A/B testing, and public display of your profile or brand exposure (consent may be withdrawn).

These legal bases (contract, legal obligation, legitimate interests, and consent) are consistent with international practice; leading industry platforms describe their processing on a similar basis.

4. 3D-Platform-Specific Disclosures

1. Source & license compliance: When you declare model/texture sources, license scope, or reference objects, such metadata is stored with the product for verification in disputes or audits.
2. Anti-hotlinking & abnormal redistribution: To combat hotlinking and malicious redistribution, we may enable signed URLs, time-limited tokens, referrer checks, and rate controls for preview/download links, and embed non-perceptible digital fingerprints into download archives without altering the work’s expression (as permitted by applicable law).
3. Showcase & recommendations: With your consent or where reasonably expected, we may use previews or low-resolution excerpts on and off the Platform for listing, search, recommendation, and non-commercial promotion (without changing the license relationship between you and customers).

5. Cookies and Analytics

1. We use strictly necessary cookies to maintain session and security; with consent, we use statistics/performance cookies to evaluate features and content effectiveness.
2. Analytics data are typically deleted or de-identified after a reasonable period (generally not longer than 12 months), in line with the principle of no longer than necessary.

6. Protection of Minors

Our services are intended for individuals 18 years or older. By creating an account, you represent that you are at least 18 years old.

7. How We Share Information

We share on a minimum necessary basis only in the following scenarios:

1. Service providers/processors: Payment and settlement, cloud storage/CDN, anti-cheat and risk control, analytics, ticketing, email delivery, etc., all under data protection terms and acting solely on our instructions.
2. Counterparties to a transaction: To complete transactions, provide after-sales service, and verify license terms, we may display to buyers the public information related to your product (e.g., author name, brand/store info, ratings and public reviews) within necessary scope.
3. Legal & compliance: Disclosures required by law or necessary to protect legitimate rights (e.g., rights notices, dispute evidence, audits).
4. Corporate changes: In mergers, acquisitions, or asset transfers, data may be transferred under lawful and confidential conditions, and you will be informed of your choices where applicable.

8. Data Retention

1. Account & logs: For security and compliance purposes, your personal data are typically deleted within 24 months after your last activity (unless a longer statutory retention period applies).
2. Orders & invoices: Retained for a reasonable period under tax and accounting laws for legal and audit purposes (as determined by applicable law).
3. Analytics & cookies: Retained under necessity and minimization (generally no longer than 12 months), then deleted or aggregated.

9. Your Rights

Subject to applicable laws (with China’s PIPL as the baseline, and GDPR requirements where extraterritorial conditions are triggered), you may have the following rights: access, rectification, erasure, restriction of processing, data portability, objection to processing, withdrawal of consent, and the right to lodge a complaint with a competent supervisory authority. We will respond to your request within a reasonable timeframe (normally within 30 days). If an extension is needed due to complexity, we will inform you of the reasons and the expected timeframe. Before acting on your request, we may need to verify your identity to protect account and data security.

Under GDPR, the rights to access, rectification, erasure, restriction, portability, objection, and withdrawal of consent are standard. Under PIPL, you also have rights to query/access, obtain copies, rectify/supplement, delete, withdraw consent, and request an explanation of our handling rules. Where we must retain data due to legal obligations, dispute resolution, anti-fraud, or security needs, or where a request cannot be fully satisfied, we will explain the reasons.

10. Security

We implement technical and organizational measures commensurate with risk to protect data, including transport and storage security, access control, logging and audit, backups, and exercises. However, transmission over the Internet or electronic storage cannot be guaranteed to be 100% secure. We will continuously improve our safeguards but do not provide an absolute security guarantee.

11. Payments and Financial Data

Payments are processed and stored by compliant third-party payment institutions (e.g., PayPal, Stripe). The Platform does not access or store your complete card information, and receives only status callbacks and reconciliation identifiers necessary for the transaction.

12. Marketing Communications

With your consent or where permitted by law, we may send you product updates, events, and feature tips. You can opt out via the unsubscribe link in emails or through account settings (transactional or security notifications are unaffected).

13. Third-Party Links

The Platform may contain links to third-party websites/services. Their privacy practices are not governed by this Policy; please review their privacy statements.

14. Updates to This Policy

We may revise this Policy due to business, technical, or legal changes. Material changes will be notified via in-site messages or email, and the latest version and effective date will be posted on the page. Your continued use of the services constitutes acknowledgment and acceptance of the updates.

15. Contact and Complaints

If you have questions about this Policy or our data handling, or wish to exercise your rights, please contact us at service@3dokao.com.