Privacy Policy

1. Introduction

Plinth B.V. ("we," "us," or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and share information when you use Plinth's applications for iOS, macOS and Android (the "App") and web portal (together, the "Service").

This policy applies to all users of the Service and covers both personal data and usage information. Available features and sign-in methods vary by platform and release.

2. Data Controller

Plinth B.V. is the data controller responsible for your personal data. We are registered in the Netherlands and comply with applicable data protection laws, including the General Data Protection Regulation (GDPR).

3. Information We Collect

3.1 Account Information

When you create or use an account, we collect the following information, depending on your sign-in method:

• Email address: For account authentication and communication
• Password hash: A one-way hash for accounts using email and password. We do not store the password in readable form.
• Name or display name: The name entered during email signup and profile updates, or a username generated for your sign-in method
• Company name: Optional business information
• Apple sign-in information: Your Apple account identifier, email and any name Apple provides, plus encrypted authorization credentials used to manage the connection
• Google sign-in information: Your unique Google account identifier, email address and verification information from Google's signed sign-in proof, where this method is offered
• Policy acceptance: Your Terms and Privacy acceptance choices and dates, and the document versions recorded for Google signup
• Session information: Plinth session credentials and device-session identifiers used to keep you signed in and manage account access

For Google signup, we retain the verified Google account identifier and email and create a Plinth username from the email address. We use Google's email-verification information and, where present, Workspace domain to determine whether additional Plinth email verification is required; the domain does not assign you to a Plinth workspace.

Where offered, email/password, Apple and Google sign-in use independent Plinth accounts, including when the same email address is used with different methods. A matching email does not connect, merge or convert accounts, or move their projects, workspace membership or credits. Passkeys authenticate an existing account; they do not merge accounts. A legacy provider identity already associated with another account remains reserved until a separately reviewed migration resolves it.

Google sign-in requests basic identity information only. We do not receive your Google password or request access to Gmail messages, Google Drive files, Google Photos or contacts through this sign-in flow. The Google ID token is used to verify sign-in and is not stored in your Plinth account record. Any proof temporarily held while you complete signup is discarded on cancellation or expiry.

3.2 Content and Media

Through your use of the App, we process:

• Photographs and images: Content you capture or upload for 3D reconstruction
• Project metadata: Information about your capture sessions and projects
• Camera parameters: Technical data about camera settings used during capture
• Generated 3D models: Processed results from your uploaded content
• Location information: Approximate or precise coordinates saved with a capture, and GPS metadata already present in imported photos or archives, where provided

On Android versions with the online/local-only feature choice, when online features are enabled, Save Capture Location is optional and uses the location permission you grant while capturing. Selected photo imports can request optional access to original GPS metadata. Denying these permissions does not prevent ordinary capture or import, but imported files can still contain location metadata supplied by their file provider.

Photos and their embedded metadata leave the device when you choose cloud processing. An archive uploaded without changes can also contain GPS metadata. Turning off Save Capture Location stops new capture geotagging; it does not remove existing GPS metadata from imported files or archives.

When you open a project with a saved location, Android's geocoding service can receive its coordinates to obtain a place name, including before you open a map. Where configured, Google Maps processes the location to display its pin. Choosing Open in Maps sends the location to your selected map app. These providers apply their own privacy terms.

3.3 Technical Information

Depending on the enabled features and access controls below, we automatically receive certain technical data:

• Device information: Device model, operating system version, unique device identifiers
• App usage data: Features used, session duration, performance metrics
• Log data: Error logs, crash reports, and debugging information
• Network information: IP address, connection type (for service delivery)
• App and device verification: App identity, version and signing certificate, app licensing status, device-integrity results and a hashed request-verification value when protected actions use Google Play Integrity. Apple platforms may use Apple App Attest verification information.
• Android notifications: Firebase installation and messaging identifiers, app/device information and an account-associated push registration used to deliver project and service notifications

On Android versions with the online/local-only feature choice, configured release builds start automatic Sentry crash, application-not-responding and native-crash diagnostics only after online features are enabled. These diagnostics include stack traces, app version, device model, operating system and runtime context. A guest with online features enabled can trigger this collection without signing in; there is no separate diagnostics switch while online features remain enabled. Switching to local-only mode closes Sentry and filters later events. Debug builds do not send these events. The Android event filter removes account/user and request fields, arbitrary messages, breadcrumbs and extras; screenshots, session replay and raw crash/ANR dumps are disabled. Providers still process network information needed to receive events, including IP addresses, and may derive approximate location before storage filtering. Redaction does not make every diagnostic anonymous or prevent provider-side processing.

Firebase and ML Kit initialization is also gated by the online-feature choice and retained restrictions described below. Firebase Cloud Messaging registration additionally requires a signed-in eligible session. Android's notification permission controls visible alerts; denying it does not itself stop messaging-token registration and background project updates for that session. Switching to local-only mode stops local messaging work and disables its components; it does not erase an existing provider registration or information already received. ARCore, location-provider and geocoder entry points require online features to be enabled in these Android versions. When permitted AR features or ARCore availability checks run, Google Play Services for AR can process account or device identifiers, performance diagnostics and API usage under Google's policies. Local AR capture does not by itself upload your reconstruction photos to Plinth; cloud processing remains a separate action.

3.4 Purchase Information

Depending on the purchase channel, we process transaction information from Apple's App Store, Google Play on Android, or Stripe on the web portal:

• Purchase history: Credit purchases and transaction IDs
• Payment verification: App Store receipts and transaction information, Google Play purchase tokens, order/product identifiers and subscription status, or Stripe payment and subscription identifiers, used to validate purchases and manage billing

For Google Play subscriptions, we send an obfuscated Plinth account identifier to Google to bind a purchase to the correct account. Plinth verifies purchase tokens with Google and reconciles renewals, pending payments, cancellations, expiry and refunds. Verification can run after sign-in, when the app returns to the foreground, after checkout, when you restore purchases and through server notifications or scheduled reconciliation. This restores existing entitlements; it does not start another purchase. Google processes the payment, and Play Billing does not provide your payment-card details to Plinth.

Google sign-in and Play Integrity verification do not themselves make a payment or create a paid subscription.

3.5 Android Online Features and Local-Only Mode

Plinth is a general-purpose tool for creators, including teens. Android versions with the online/local-only feature choice do not ask users to declare they are 18 or collect a new age band, birth date, identity document or guardian-verification record. Online accounts are not offered to children under 13. Additional permission or consent requirements can apply by country and processing purpose; see Section 11.

You can enable online features or choose local-only capture/import. The app saves that feature choice and restriction state in encrypted Android storage excluded from backup. Firebase, ML Kit, Sentry and online feature entry points remain disabled until online features are enabled. This feature choice is not verified age, parental permission, or blanket consent to personal-data processing. Existing age choices from earlier Android releases may remain in the same local record. Earlier under-18, unknown-age restrictions and withdrawals are not automatically cleared; contact [email protected] for review.

When switching to local-only mode clears an active signed-in session, the app also saves the current Plinth account ID, workspace ID when present, and backend environment in that same encrypted, backup-excluded record. These fields identify which local drafts belong to that account and workspace in the same environment. Where this owner record is available, it keeps those drafts accessible after restart, including when account-wide withdrawal was not confirmed. This local draft-access record contains no password or access/refresh tokens and is not uploaded by this flow. It grants no sign-in or cloud access.

Earlier Android releases used an 18+ declaration to enable online features, including configured diagnostics and SDK initialization. Under-18 and unknown choices stayed local-only. Those installed versions keep their behavior until updated; the newer feature choice does not reclassify an existing restriction.

New sign-in checks the server's supported access policy without declaring an adult age or writing a new age classification. A confirmed signed-in withdrawal still stores an account restriction. Earlier releases may have stored adult declarations on the account and a requirement in signed tokens. Those historical values are retained under the limits described in Section 7; this update does not erase them or convert them into guardian consent. New and older clients continue to encounter known account restrictions, including a known under-13 account.

Local-only mode disables sign-in, cloud uploads/downloads, purchases and credit spending, sharing/exports, AR/Quick Scan, and location-provider/geocoder features. Local capture/import and manual height entry remain available. Withdrawal keeps its existing confirmation, retained-draft and support limits; it is not account deletion or subscription cancellation.

4. How We Use Your Information

5. Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Contract performance: To provide our 3D reconstruction services
• Legitimate interest: To improve our services and ensure security
• Consent: For optional features like email notifications
• Legal obligation: To comply with applicable laws and regulations

6. Data Sharing and Disclosure

6.1 Third-Party Service Providers

We share data with trusted service providers who help us operate our services:

• Cloud infrastructure providers: For data storage and processing
• Authentication services: Apple for Sign in with Apple and Google for Sign in with Google, where offered
• App and device security services: Apple App Attest and Google Play Integrity for verification of protected actions
• Payment providers: Apple for App Store purchases, Google for Google Play purchases, and Stripe for web portal purchases
• Diagnostics providers: Sentry for crash and app performance monitoring; technical data can include device/runtime and network information
• Android platform and location services: Google Maps for configured map displays, Android's geocoding provider for place names, Google Play Services for AR for AR features, and Firebase Cloud Messaging for notifications
• Customer support tools: For handling user inquiries

When Google sign-in or Play Integrity is used, Google processes information under its Privacy Policy. Play Integrity handles app metadata, request-verification information, app licensing status and device-attestation information to check app and device integrity. Plinth uses these checks for security and fraud prevention.

Google Play, Google Maps, Google Play Services for AR and Firebase also process information under Google's applicable terms and Privacy Policy. Maps can collect device/SDK metadata, crash metrics, IP addresses, a Maps-specific identifier and map interactions. ARCore can collect account or device identifiers, diagnostics and API usage. These SDK flows are separate from your optional upload of reconstruction photos. Sentry's handling is described in its Privacy Policy.

6.2 Legal Requirements

We may disclose your information when required by law or to:

• Comply with legal processes or government requests
• Protect our rights, property, or safety
• Prevent fraud or security threats
• Enforce our Terms of Service

6.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, user information may be transferred as part of the transaction, with appropriate notice to users.

7. Data Retention

We retain your data only for the periods needed to run the service, comply with law, and honor the lifecycle safeguards described in our Data Retention Policy:

• Account data: Stored while your account remains open. Eligible inactive free accounts may be removed after 3 years of inactivity under our Data Retention Policy.
• Free-tier projects: Unpurchased projects are limited to three at a time and each preview lasts 14 days. We send in-app/email warnings on Day 7 and push notifications on Day 12 before deletion.
• Subscriber previews: Active subscribers receive a 30-day preview window for unpurchased projects with reminders on Day 23 and Day 28 so you can upgrade or buy before deletion.
• Cancelled subscriptions: If you cancel, all projects remain accessible for 3 months. We notify you at Day 75 (email), Day 83 (email + push), and Day 89 (push) before permanent removal. Reactivating within that window preserves your content.
• Purchased projects: Available indefinitely while your account is active. After 12 months of inactivity we may archive them to cold storage for cost efficiency, but they remain restorable within hours upon request.
• Purchase records: Retained for 7 years to satisfy tax and legal obligations.
• Technical logs: Kept for up to 90 days for diagnostics and security monitoring.

These automated retention rules run alongside the manual deletion tools available in the app, giving you control while ensuring predictable cleanup.

Account-data retention also covers the Apple or Google identifier belonging to the corresponding Plinth account and its policy-acceptance records. Uploaded photo GPS metadata follows the retention of its photo or project. Purchase records include the Google Play verification and entitlement records needed for billing, refunds and reconciliation. Provider-side SDK data is also subject to the relevant provider's retention practices. We may retain records required for security, fraud prevention or legal obligations after account deletion, including the purchase records described above.

The expiration of an email-verification link does not automatically delete a pending signup. You may contact [email protected] to request deletion of a pending signup.

The Android online-feature choice and retained restrictions persist across app restarts, sign-out and account changes. Switching to local-only mode stores a restriction and clears any legacy local age band; it keeps local drafts and any saved owner record described in Section 3.5. That owner record has no automatic expiry or separate in-app removal control. Deleting local drafts does not clear it. Clearing this app's data in Android settings removes its local records and drafts and starts again with online features disabled until a new feature choice. It does not remove a server restriction or delete the Plinth account.

Server-held restrictions and historical eligibility state remain part of the account record; no separate automatic expiry is implemented. Withdrawal does not delete that record. Completed account deletion removes the eligibility field with the live account row; project-file cleanup is asynchronous. This does not promise immediate erasure of backups, logs or provider-held information. These records are used to enforce access restrictions and prevent them from being bypassed; they are not used for advertising or profiling. Contact [email protected] to request review, correction or deletion, including for an inactive or restricted account. Any retention after a deletion request must have a specific legal or security justification. The purchase-record and technical-log periods above are not separate retention periods for this account field.

8. Data Security

We implement robust security measures to protect your data:

• Encryption: Data encrypted in transit and at rest
• Access controls: Role-based access to personal data
• Regular audits: Security assessments and vulnerability testing
• Infrastructure security: Secure cloud hosting with enterprise-grade protection
• Employee training: Staff trained on data protection and security practices

9. Your Rights

Under GDPR and other applicable laws, you have the following rights:

9.1 Access and Portability

• Request a copy of your personal data
• Export your projects and content

9.2 Correction and Updating

• Update your account information through the App
• Request correction of inaccurate data

9.3 Deletion

• Delete your account and associated data
• Request deletion of specific content

You can request account deletion through the App settings or by contacting [email protected]. We may require recent authentication or other identity verification. Deleting your Plinth account does not delete your Apple or Google account or cancel a subscription with your payment provider; manage subscriptions through the provider or the web portal's billing controls.

On Android versions with the online/local-only feature choice, a user with online features enabled can confirm Switch to local-only mode in the Library. The app restricts online access first, clears its session credentials, cancels normal app requests, stops local messaging work and closes crash reporting. If signed in, it then attempts one account-withdrawal request using the captured session. It does not refresh credentials or automatically retry. If the request fails or its result is uncertain, the device stays restricted and the app says account-wide withdrawal was not confirmed. A guest switch changes only the local state. A confirmed server withdrawal persists an account restriction that a new feature choice or legacy adult declaration cannot undo.

Where the saved owner record is available, you can continue to use and delete that account/workspace's local drafts. Cloud uploads/downloads, sharing and exports remain unavailable. Deleting a local draft while restricted removes its local copy without requesting deletion of a corresponding cloud project; it does not clear the saved owner record.

Switching to local-only mode does not delete your account, uploads or local drafts, cancel a subscription, reverse a payment, invalidate previously issued storage links, or recall information or requests already received by a provider. It can prevent account sign-in and in-app account-deletion controls. To request account/data deletion, correction, or help with an unconfirmed withdrawal while access is restricted, contact [email protected] independently of the app. Subscription cancellation remains a separate action with the payment provider.

If an account belongs to a shared workspace, deletion may require coordination with support to protect other members' access to shared data.

9.4 Restriction and Objection

• Object to processing based on legitimate interest
• Restrict processing in certain circumstances

9.5 Exercising Your Rights

To exercise your rights, contact us at [email protected]. We will respond within 30 days and may require verification of your identity.

10. International Data Transfers

Your data may be processed in countries outside the European Economic Area. We ensure adequate protection through:

• Adequacy decisions by the European Commission
• Standard Contractual Clauses with service providers
• Certification schemes and codes of conduct

11. Children's Privacy and Teen Creators

Plinth is general-purpose creator software, including for teens, and is not designed for children under 13. We do not offer online accounts to children under 13 or knowingly collect personal information from them as account users. If we learn that an account belongs to a child under 13, we restrict online access and address the information and any deletion request under applicable law and our retention obligations. Contact [email protected] to report an underage account or exercise applicable rights.

Teen users may need permission from a parent or guardian to enter a contract or use particular processing features under local law. Where processing relies on consent and parental authorization is required, a Terms checkbox, an online-feature choice or a Google account does not supply that authorization. General-purpose positioning does not remove child-data protections. Requirements vary by country and processing purpose. Where parental authorization is required and has not been obtained, the affected processing must not be used; contact [email protected] for assistance.

We do not offer a guardian-managed child service or automated guardian verification. Prior Android age choices and withdrawals retain their restrictions as described in Section 3.5; they are not automatically reset by this audience revision.

12. Cookies and Tracking

Our native applications use session credentials and local storage for account access and app functionality. Our website and web portal may use cookies and browser storage for secure sessions, language preferences and service functionality. We may use:

• Device identifiers: For analytics and crash reporting
• Session tokens: For authentication and security
• Local storage: For app preferences and cached data

Native apps store Plinth session credentials in encrypted platform storage. Captured images, drafts and downloaded models may remain in app storage on your device, including after upload or sign-out, until you delete them or clear the app's data.

13. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or applicable laws. We will:

• Notify users of material changes through the App
• Post the updated policy on our website
• Send email notifications for significant changes

Acknowledging this policy or continuing to use the App does not replace separate processing consent where the law requires it.

14. Contact Information

15. Supervisory Authority

If you believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with your local data protection authority or the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

© 2026 Plinth B.V. All rights reserved.