This summary is provided for informational purposes only and does not constitute, modify, or form part of the binding terms set forth in this Privacy Policy. In the event of any inconsistency between this summary and the substantive provisions below, the substantive provisions shall control.
This Privacy Policy (“Policy”) is published by Rhovium LLC, a limited liability company organized under the laws of the State of Wyoming, United States (“Rhovium,” the “Company,” “we,” “us,” or “our”), in respect of Sculpty. Unless otherwise defined herein, capitalized terms shall have the meanings ascribed to them in this Section.
“Service” means Sculpty, the Company’s AI-assisted 3D model generation platform available at https://sculpty.ai, together with all related products, services, applications, platforms, and websites owned, operated, or controlled by the Company in connection therewith.
“Personal Data” means any information that identifies, relates to, describes, or is reasonably capable of being associated with a particular individual or household.
“Prompts” means any text, description, instruction, image, file, or other input that you submit to the Service for the purpose of generating, transforming, or processing 3D content. “Generated Assets” means the 3D models, meshes, textures, materials, preview renders, and associated files produced by or through the Service in response to your Prompts. Prompts and Generated Assets are referred to collectively as “User-Generated Content.”
“AI Providers” means the third-party artificial intelligence service providers, platforms, model developers, APIs, and tools whose generation capabilities the Company aggregates, integrates, or otherwise makes accessible through the Service. As of the effective date of this Policy, AI Providers include, by way of example and without limitation, Meshy. The specific AI Providers integrated with the Service are subject to change at any time, at the Company’s sole discretion, as new engines are onboarded or existing engines are discontinued.
This Policy applies to all Personal Data and User-Generated Content collected, processed, or stored by the Company in connection with the Service. The Company recognizes the fundamental importance of protecting the privacy of individuals who access or use the Service and is committed to processing Personal Data in a manner consistent with applicable data protection laws, including, without limitation, the EU General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”), the UK GDPR, the Swiss Federal Act on Data Protection (“FADP”), and the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act (“CCPA”).
The Company may collect and process the following categories of information in connection with the provision of the Service:
Account registration and authentication are performed exclusively through Google Sign-In (OAuth 2.0). When you sign in, the Company receives from Google, with your authorization, your name, email address, profile photograph, and a unique account identifier. The Company does not receive or store your Google password. Your use of Google Sign-In is additionally governed by Google’s own privacy policy.
In the course of using the Service, you submit Prompts and the Service produces Generated Assets on your behalf. The Company stores your Prompts and Generated Assets (including preview renders and downloadable files in formats such as GLB, STL, and OBJ) on its infrastructure for the purpose of providing, operating, and improving the Service, including enabling you to revisit, preview, convert, and re-download your creations. Ownership of User-Generated Content is addressed in the Terms of Service; the storage of such content by the Company does not constitute a transfer of any ownership rights from you to the Company.
Please do not include Personal Data — your own or anyone else’s — in your Prompts. Prompts are transmitted to third-party AI Providers as described in Sections 4.5 and 8, and any Personal Data contained therein will be processed by those providers under their own policies.
When paid plans are available, payments are processed by a third-party payment processor (currently anticipated to be Stripe, Inc.). The Company does not collect or store full payment card numbers on its own systems. The Company receives and retains from the payment processor only limited transaction information, such as the plan or credit pack purchased, the amount charged, the transaction date, a truncated card identifier, and the transaction status, together with your credit balance and consumption history maintained by the Company.
Usage Analytics. The Company collects information about how you interact with the Service — such as the features you use, generations you initiate, pages you visit, and approximate timing of such events — using analytics tools including Google Analytics for Firebase. Analytics data is used in aggregate to understand usage patterns and improve the Service.
Cookies and Similar Technologies. When you access the Service, the Company may place one or more cookies — small text files containing a unique alphanumeric identifier — on your device. Cookies and similar technologies (including local storage) are deployed to store user preferences, maintain authenticated session state, and analyze aggregate usage patterns. You may configure your browser to reject all cookies or to alert you when a cookie is being transmitted; however, disabling cookies may impair the functionality of certain features of the Service, including sign-in.
Server Log Data. The Company’s servers automatically record certain technical information transmitted by your browser each time you access the Service. Such log data may include your Internet Protocol (IP) address, browser type and version, device and operating system information, preferred language, referring and exit URLs, date and time stamps, and identifiers that may uniquely identify your browser session.
When you contact the Company via email (including contact@rhovium.com), in-app feedback mechanisms, or any other communication channel, the Company may retain such correspondence and any metadata associated therewith for the purposes of processing your inquiry, responding to your request, maintaining a record of the communication, and improving the Service.
This Policy applies exclusively to the Service. The Company does not exercise control over, and expressly disclaims responsibility for, the privacy practices, data collection methods, or content of any third-party websites, applications, or services that may be linked to, integrated with, or otherwise accessible from the Service. You are encouraged to review the privacy policies of any third-party service before providing Personal Data thereto.
The Company processes Personal Data and User-Generated Content solely for the purposes described in this Policy. Such purposes, together with the corresponding legal bases under the GDPR where applicable, include, without limitation:
The Company stores User-Generated Content on secure infrastructure for the duration of your active use of the Service and for a reasonable period thereafter, as described in this Section. The Company processes User-Generated Content solely for the purposes of operating, maintaining, and improving the Service and, where applicable, transmitting Prompts and associated inputs to AI Providers (as described in Section 4.5 and Section 8) to fulfill your specific generation requests.
Ownership of Prompts and Generated Assets is governed by the Terms of Service. Nothing in this Policy shall be construed as transferring any ownership rights in your User-Generated Content to the Company.
In accordance with Article 20 of the GDPR and analogous provisions under other applicable data protection legislation, you have the right to receive your User-Generated Content in a structured, commonly used, and machine-readable format. The Service provides in-app download functionality enabling you to export your Generated Assets at any time in standard 3D file formats (such as GLB, STL, and OBJ), without charge and without the need to submit a formal request. Where in-app export is not available for a particular content type, you may submit a data portability request to contact@rhovium.com, and the Company shall fulfil such request without undue delay and in any event within thirty (30) calendar days of receipt.
User-Generated Content is retained for the duration of your active account with the Service. Following account closure or deletion, the Company shall retain User-Generated Content for a maximum period of thirty (30) calendar days to facilitate account recovery, after which it shall be permanently and irrevocably deleted from all primary storage systems. Residual copies in encrypted backup systems shall be purged in accordance with the Company’s standard backup rotation schedule, which does not exceed ninety (90) calendar days. Limited transaction records (such as purchase and invoicing data) may be retained for longer periods where required for tax, accounting, or other legal compliance purposes.
You may delete individual Prompts and Generated Assets at any time through the Service’s interface. You may also request the deletion of your account and of all User-Generated Content associated with it by contacting the Company at contact@rhovium.com. All verified deletion requests shall be processed within twenty-four (24) hours of receipt. Upon deletion, the Company shall cease all processing of the affected content, except to the extent that retention is required by applicable law, regulation, or a valid and enforceable legal order.
The Service operates as an aggregation platform that enables you to access the text-to-3D and related generation capabilities of various AI Providers through a unified interface. When you initiate a generation task, your Prompt and any associated inputs are transmitted to, processed by, and may be temporarily or permanently stored on the infrastructure of the applicable AI Provider in accordance with that AI Provider’s own data processing practices. Generated Assets are likewise produced on, and may be retained by, the AI Provider’s infrastructure before being stored by the Company.
You expressly acknowledge and agree that any Prompt submitted to, and any content generated through, an AI Provider is subject to the privacy policy, terms of service, and data retention practices of that AI Provider, in addition to this Policy. Some AI Providers may use submitted inputs and generated outputs to improve their models, in accordance with their own terms. The Company acts solely as an intermediary and does not control, and shall not be held liable for, the data collection, retention, use, disclosure, or security practices of any AI Provider. It is your responsibility to review and understand the privacy policies of the AI Providers whose services you access through the Service prior to initiating any generation task.
The Company shall make commercially reasonable efforts to: (a) integrate only AI Providers that maintain privacy and security practices broadly consistent with applicable data protection laws; (b) identify the AI Provider or engine being utilized for a given generation task within the Service interface; and (c) provide you with direct hyperlinks to the applicable AI Provider’s current privacy policy within the Service. However, because the roster of AI Providers may change at any time and without advance notice to you, and because each AI Provider may independently amend its own privacy policy, you are encouraged to periodically review the current list of AI Providers and their respective policies as made available within the Service.
For the avoidance of doubt, the Company’s obligations under this Policy with respect to deletion, export, and data portability (as set forth in Sections 4.2 through 4.4 above) apply exclusively to copies of User-Generated Content stored on the Company’s own infrastructure. To the extent that any AI Provider independently retains copies of Prompts or content generated through its platform, the deletion, export, or portability of such copies is governed solely by that AI Provider’s own policies and procedures, and any requests in that regard must be directed to the AI Provider concerned.
Personal Data and User-Generated Content stored by the Company are maintained on secure cloud infrastructure provided by Google Cloud Platform and Firebase, with industry-standard security controls. Authentication tokens are encrypted at rest using AES-256 encryption or its cryptographic equivalent. All data transmissions between your device and the Company’s servers occur over connections protected by Transport Layer Security (TLS) 1.2 or higher.
The Company maintains commercially reasonable administrative, technical, and physical safeguards designed to protect data against unauthorized access, alteration, disclosure, loss, or destruction. The Company processes data on servers located in the United States of America and such other jurisdictions as may be necessary for the provision of the Service (including the jurisdictions in which AI Providers operate). If you access the Service from outside the United States, you acknowledge that your Personal Data will be transferred to and processed in the United States and other jurisdictions. In all cases where Personal Data originating from the European Economic Area, the United Kingdom, or Switzerland is transferred to a jurisdiction that has not been deemed to provide an adequate level of data protection, the Company ensures that appropriate safeguards are in place, including, where applicable, Standard Contractual Clauses (SCCs) or equivalent transfer mechanisms approved under the GDPR, the UK GDPR, or the FADP, as the case may be.
Subject to applicable law, you have the following rights with respect to your Personal Data and User-Generated Content held by the Company:
California residents — no sale or sharing of Personal Data. The Company does not sell Personal Data, and does not share Personal Data for cross-context behavioral advertising, as those terms are defined in the CCPA, and has not done so in the preceding twelve (12) months. Accordingly, the Company does not offer an opt-out mechanism, as there is no sale or sharing from which to opt out. California residents may designate an authorized agent to submit requests on their behalf, subject to reasonable verification.
To exercise any of the foregoing rights, please contact the Company at contact@rhovium.com. The Company may take reasonable steps to verify your identity before acting on a request. The Company shall respond to all verified requests without undue delay and in any event within the time periods prescribed by applicable law (thirty (30) days under the GDPR; forty-five (45) days under the CCPA, extendable as permitted). If you believe that the Company has not adequately addressed your request, you have the right to lodge a complaint with the competent supervisory authority in your jurisdiction.
You may also decline to provide Personal Data at any time; however, please be advised that doing so may limit or entirely preclude your ability to access or use certain features of the Service.
Please note that the foregoing rights apply to Personal Data and User-Generated Content held on the Company’s own infrastructure. To the extent that an AI Provider or other third party independently holds or processes your data, the exercise of data subject rights with respect to such data must be directed to that party in accordance with its own policies and procedures.
The Company does not sell, rent, lease, or otherwise transfer Personal Data or User-Generated Content to any third party for commercial, advertising, or marketing purposes. The Company shall not disclose Personal Data or User-Generated Content to any third party except in the following narrowly defined circumstances:
The Service functions as an aggregation platform, providing you with unified access to the capabilities of multiple AI Providers. The Company may onboard new AI Providers or discontinue existing AI Providers at any time, at its sole discretion, without prior notice to you. The Company shall, however, use commercially reasonable efforts to ensure that the current roster of AI Providers and links to their respective privacy policies are accessible to you within the Service.
The Company engages only those AI Providers and third-party providers that, to the Company’s reasonable knowledge, maintain privacy and data security practices consistent with applicable law. However, the Company does not warrant, guarantee, or assume responsibility for the privacy practices of any AI Provider. Each AI Provider operates as an independent data controller (or, where applicable, as a joint controller or processor) with respect to the data it receives, and its processing activities are governed by its own privacy policy and terms of service.
The Company does not transmit Personal Data identifiers — including, without limitation, your name, email address, or internal account identifiers — to any AI Provider unless such transmission is strictly required for the requested operation. Only the minimum quantum of data necessary to execute the specific generation task you have initiated is transmitted: principally, the text of your Prompt, any images or files you have explicitly attached to the generation request, and the generation parameters you have selected (such as output format, quality, or style options).
Each AI Provider reserves the right to amend its own privacy policy independently and without notice to the Company. The Company shall use commercially reasonable efforts to monitor material changes to the privacy policies of its AI Providers and to update the links provided within the Service accordingly. Notwithstanding the foregoing, the Company does not guarantee that such links will reflect the most current version of an AI Provider’s privacy policy at all times. You are encouraged to independently verify the applicable AI Provider’s current privacy policy before initiating any generation task.
The Company implements and maintains commercially reasonable administrative, technical, and physical security measures designed to protect Personal Data and User-Generated Content against unauthorized access, use, alteration, disclosure, loss, or destruction. Such measures include, without limitation, periodic internal reviews of the Company’s data collection, storage, and processing practices; role-based access controls; encryption of data at rest and in transit; and reliance on the physical and infrastructure security safeguards of Google Cloud Platform, on which the Service is hosted.
Access to Personal Data and User-Generated Content is restricted to those employees, contractors, and authorized agents of the Company who have a demonstrable need to access such information in order to operate, develop, maintain, or improve the Service. All such personnel are bound by confidentiality obligations and are subject to disciplinary action — up to and including termination of engagement and referral for civil or criminal legal proceedings — in the event of any breach of such obligations. No method of transmission over the Internet or method of electronic storage is completely secure, and the Company cannot guarantee absolute security; in the event of a data breach affecting your Personal Data, the Company will notify you and the competent authorities as required by applicable law.
The Company processes Personal Data and User-Generated Content only for the specific purposes for which such data was collected and in strict accordance with this Policy. The Company conducts periodic reviews of its data collection, storage, and processing practices to verify that it collects, retains, and processes only such data as is necessary and proportionate to the provision and improvement of the Service. While the Company takes commercially reasonable steps to ensure that the Personal Data in its possession is accurate, complete, and current, the Company relies upon you to update or correct your Personal Data as and when necessary.
The Service is not directed to children under the age of thirteen (13), and the Company does not knowingly collect Personal Data from children under thirteen (13). If you are under thirteen (13) years of age, you must not use the Service or submit any Personal Data to the Company. If the Company becomes aware that it has collected Personal Data from a child under thirteen (13) without verifiable parental consent, the Company will delete such data as promptly as practicable. If you believe that a child under thirteen (13) has provided Personal Data to the Company, please contact contact@rhovium.com. Users between thirteen (13) and the age of majority in their jurisdiction may use the Service only as set forth in the Terms of Service, including any applicable requirement of parental consent.
The Company conducts periodic internal reviews to verify its ongoing compliance with this Policy. Should you have any question, concern, or complaint regarding this Policy or the Company’s treatment of your Personal Data, you may contact the Company at the address specified in Section 14 below.
Upon receipt of a formal written complaint, the Company shall promptly contact the complainant to acknowledge receipt and to address the substance of the concerns raised. In the event that a dispute cannot be resolved directly between the Company and the affected individual through good-faith negotiation, the Company shall cooperate with the competent regulatory authorities, including applicable local data protection supervisory authorities, to achieve a resolution.
The Company reserves the right to amend, modify, or supplement this Policy at any time, at its sole discretion. The Company shall not, however, materially diminish your rights under this Policy without first obtaining your explicit and informed consent. All amendments shall be published on this page, identified by an updated effective date. In the case of material amendments, the Company shall provide prominent advance notice by means it deems reasonably calculated to inform affected users, which may include, without limitation, email notification, in-app notification, or banner display within the Service. Archived versions of prior iterations of this Policy shall be maintained and made available upon written request.
For any questions, concerns, data subject access requests, or other inquiries relating to this Policy or the Company’s data processing practices, please contact:
Privacy Matters
Rhovium LLC
212 N. 2nd Street, Suite 100
Cheyenne, Wyoming 82001
United States of America
Email: contact@rhovium.com