Privacy Policy

1. Overview

This Privacy Policy governs how Vertex Core LLC ("we," "us," or "our"), operator of VotexArch, collects, uses, and protects your data across our platform.

2. Information We Collect

• Account Information: When you register for an account, we collect your name, email address, and billing/payment details.
• User Content & Inputs: We collect the prompts, project configurations, parameters, and design files (drawings, photographs, 3D models, and other uploads) you input or upload through the frontend interface.
• Technical & Usage Data: We automatically log information about your device, browser type, IP address, and how you interact with our platform for security and performance optimization.
• Location / IP Information: We use IP addresses to derive an approximate location (such as country or region) for fraud prevention, security, and understanding where our users are located. We do not use precise device GPS location.
• Guest (No-Account) Trial: If you try the platform without creating an account, we create an anonymous session for your browser so your trial renders and remaining trial credits can be tracked. To limit abuse of the free trial, we also record a salted one-way hash of your IP address rather than the address itself. If you later create an account from that session, your trial work is carried over to it.
• Plugin Downloads: When you download one of our CAD plugins, we ask for your email address and record it with the plugin you downloaded. Marketing consent is a separate, optional checkbox: we only send you product or marketing email if you tick it, and downloading a plugin is never treated as consent.
• Plugin Sign-In: If you connect a plugin to your account, we issue it an access token. The token is stored on your computer by the plugin and a matching record is kept on our side, together with when it was last used, so that the plugin can act on your account and so that access can be revoked.
• AI Assistant Connections: If you connect VotexArch to an AI assistant such as Claude or ChatGPT (see our AI connector guide at /ai-connector), you approve the connection on our site and we issue that assistant access tokens linked to your account. We keep a record of each connection: the name the assistant registered with, where it returns you after sign-in, and when it was last used, so that you can see and disconnect it from your dashboard. When the assistant uses VotexArch, we receive only what it sends to our tools: your render instructions, the images you provide (as a chat attachment, through a one-time upload link, or as a link to an image online), and the options chosen. We do not receive the rest of your conversation with the assistant. Images uploaded through a one-time upload link are stored in your account like any other upload.
• Bot Protection: Sign-in, sign-up, and guest-trial requests are protected by Cloudflare Turnstile, which evaluates signals from your browser and device to distinguish people from automated traffic. This processing is performed by Cloudflare.
• Authentication Providers: If you sign in using Google or another third-party authentication provider, we receive the basic profile information that provider shares with us (typically your name, email address, and profile picture) to create and secure your account.
• Marketing Emails: We only send newsletters, tips and new-model announcements to people who ticked the optional box when creating an account; it is unticked by default. When you do, we add your account email to our mailing list with Brevo. Every such email has an unsubscribe link, and unsubscribing takes effect immediately. Service emails about your account and subscription are sent whether or not you opt in.
• Referrals: If you sign up through another user’s referral link, we record that your account was referred by theirs, and both accounts receive the referral credits once the referral qualifies (after a short holding period, when the new account has used the service). We store the link between the two accounts and the credits granted; we do not share your details with the person who referred you, who sees only how many people joined through their link and the credits earned. Each account’s referral link contains a short code that identifies it, which appears in links you share and on render pages you choose to make public.
• Cookies and Analytics: Staying signed in does not rely on cookies: your session is kept in your browser’s local storage by our authentication provider, Supabase, and the site also keeps a few preferences there (such as your theme and your cookie choice). Some strictly necessary cookies are set by our providers rather than by us: Cloudflare may set security cookies to protect the site and run its bot check, and Stripe sets fraud-prevention cookies on the checkout page. These are needed for the site and payments to work and are not used for analytics or advertising. For audience measurement we use two services. Cloudflare Web Analytics counts page views without cookies, without fingerprinting, and without storing any identifier that could follow you across other sites. Google Analytics 4 sets cookies in your browser (named _ga and _ga_*) that distinguish returning visits and persist for up to two years, with the data processed by Google as a third party. Google Analytics is only loaded if you choose Accept in our cookie banner; if you choose Reject, or make no choice, it is not loaded and sets no cookies. The same choice covers referral links: if you arrive through someone’s VotexArch referral link and choose Accept, we keep that link’s code in your browser’s local storage for up to 30 days so the referral can be credited when you create an account; if you do not accept, it is not stored. You can change your choice at any time with “Cookie settings” in the site footer, and withdrawing consent removes the Google Analytics cookies from your browser. We do not use analytics for advertising or ad personalisation, and we do not sell or share the data with advertisers.

3. How We Use Your Information

• Providing the Service: To operate your account, process your subscriptions, save your projects in our database, and render your user interface.
• Executing AI Requests: To transmit your project inputs and prompts to third-party AI providers (currently fal.ai, Google, and Tripo3D) to generate and return your requested outputs.
• Platform Improvement: To analyze usage patterns, monitor system stability, and troubleshoot bugs across our frontend and database infrastructure.

4. Google User Data and Limited Use

When you choose "Continue with Google," we access only the basic profile information you authorize Google to share with us: your name, email address, and profile picture. We use this information solely to create and secure your VotexArch account, to authenticate you on return visits, and to contact you about your account and the service.

VotexArch's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not use Google user data for advertising, we do not sell it, we do not use it to train machine-learning models, and we do not share it with third parties other than the infrastructure providers strictly necessary to operate authentication and your account (described in "Data Sharing and Third-Party Processors" below).

You can revoke VotexArch's access to your Google Account at any time from your Google Account security settings, and you may request deletion of the data we hold about you at any time (see "Data Deletion").

5. Uploaded Content Processing

Architectural drawings, photographs, project files, prompts, and generated outputs you upload or create are transmitted to our third-party AI providers solely to fulfill the specific generation, conversion, or analysis request you initiate. Those providers process the content on their own infrastructure and handle it under their own terms and retention policies, which we do not control. Within VotexArch, your content is used to power your project history and is not shown to other users, unless you create a public share link for a render, in which case anyone with that link can view it until you remove the link.

6. Data Sharing and Third-Party Processors

We do not sell your personal data. However, to deliver our service, your data is shared with specific third-party service providers, listed below and, with what each one receives, on our Subprocessors page (votexarch.com/subprocessors):

• Inference & AI Providers: User prompts, uploads, and generation parameters are sent to third-party AI providers strictly for the purpose of executing your requested tasks. These are currently fal.ai (image and video models), Google (Gemini models, including location-grounded review features), and Tripo3D (3D model generation and 3D-print preparation). We may add or change providers over time and will update this list when we do.
• Cloud & Database Infrastructure: The platform is hosted on Cloudflare, which also stores uploaded and generated files and some platform records, and provides bot protection (Turnstile) and cookieless analytics. Account records, authentication, and project history are handled by Supabase.
• Payment Processor: Financial transactions are handled securely by our payment processor, Stripe; we do not store full credit card details on our own servers.
• Email Delivery: Account emails such as sign-up confirmations, password resets and subscription confirmations are delivered through Brevo, our email delivery provider.
• Analytics: Google Analytics 4 receives usage data about how the site is used, as described under "Cookies and Analytics" above.
• AI Assistants You Connect: If you connect an AI assistant to your account, the results our tools return to it — such as rendered images and links to them, your credit balance, and your recent renders with their prompts — are received and processed by that assistant’s provider (for example Anthropic or OpenAI) under its own terms and privacy policy, which we do not control. The assistant cannot buy credits, change your plan, or access your payment details.

7. Data Security & Retention

We implement industry-standard security protocols to protect data in transit between your browser, our frontend, and our cloud database. No method of transmission or storage is completely secure, and while we work to protect your data, we cannot guarantee absolute security.

Uploaded and generated files are deleted from our storage automatically 7 days after they are created, so download anything you want to keep. We retain your account data and project history records for as long as your account remains active or as needed to provide you services, comply with legal obligations, resolve disputes, and enforce our agreements. Database backups are kept for a limited period (currently about 7 days) before they are overwritten. Technical and usage logs are generally retained for a limited period (typically up to 12 months) for security and troubleshooting purposes before being deleted or aggregated. Copies of content already sent to a third-party AI provider are retained, if at all, under that provider’s own policy.

For AI assistant connections: sign-in codes expire after 5 minutes, access tokens after 1 hour, and a connection that is not used for 7 days expires; expired codes and tokens are deleted automatically. One-time upload links accept an image for 30 minutes and their records are deleted after 24 hours, while the uploaded image itself follows the 7-day file deletion above. You can end a connection immediately from Connected assistants in your dashboard.

8. Data Deletion

You may request deletion of your account and associated data at any time by contacting us at support@votexarch.com or through your account settings, where available. Upon a verified deletion request, we delete or anonymize your personal data and project content from our active systems within a reasonable period, except where retention is required for legal, tax, security, or dispute-resolution purposes, or in backups until they naturally expire.

9. International Data Transfers

VotexArch and the third-party infrastructure and AI providers we use may process and store data in countries other than your own, including the United States. Where required by applicable law, we rely on appropriate safeguards (such as standard contractual clauses or equivalent mechanisms) for these international transfers.

10. Children and Minors

The platform is not directed to, and is not intended for use by, anyone under 18 years of age. We do not knowingly collect personal information from children. If you believe a minor has provided us with personal information, contact us at support@votexarch.com and we will take steps to delete it.

11. Business Transfers

If VotexArch is involved in a merger, acquisition, financing, restructuring, or sale of all or part of its business or assets, your information may be disclosed to, and transferred as part of that transaction to, the parties involved, subject to standard confidentiality arrangements. We will notify you of any such change in ownership or control of your personal data as required by law.

12. Legal Bases for Processing (EEA and UK)

If you are located in the European Economic Area or the United Kingdom, we process your personal data on the following legal bases: performance of a contract, to provide the account and services you request; our legitimate interests, to secure, maintain, and improve the platform and to prevent fraud and abuse; your consent, where we specifically ask for it (for example, for Google Analytics cookies, which are only set after you accept them); and compliance with legal obligations, such as tax, accounting, and record-keeping requirements. Where we rely on legitimate interests, we weigh them against your rights and freedoms and will not use them where those interests are overridden.

13. Your California Privacy Rights

If you are a California resident, you may have the right to know what categories of personal information we collect and how we use and disclose them, to request access to or deletion of your personal information, to correct inaccurate information, and to not be discriminated against for exercising these rights. We do not sell or "share" your personal information for cross-context behavioral advertising as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA). To exercise any of these rights, contact us at support@votexarch.com; we may need to verify your identity before responding.

14. Your Data Rights

Depending on your jurisdiction, you may have the right to access, correct, export, or delete your personal information and stored project data by contacting us at support@votexarch.com or managing your account settings. You also have the right to withdraw consent where processing is based on consent, and to lodge a complaint with your local data protection authority.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or the third-party providers we rely on. When we make material changes, we will update the "Last updated" date at the top of this page and, where required by law, provide additional notice. Your continued use of VotexArch after an update takes effect constitutes acceptance of the revised policy.

16. How to Contact Us

If you have questions about this Privacy Policy or how we handle your data, or if you wish to exercise any of your privacy rights, contact Vertex Core LLC, operator of VotexArch, at support@votexarch.com. We will respond within a reasonable timeframe and in accordance with applicable law.