Privacy Policy

This Privacy Policy explains how Spatiorama (“Spatiorama,” “we,” “us,” “our”) collects, uses, shares, and protects information when you use the Spatiorama iOS app and spatiorama.com (together, the “Service”). It’s written to comply with the EU/UK General Data Protection Regulation (“GDPR”) and applicable U.S. state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”).

By using the Service, you acknowledge this Privacy Policy. If you don’t agree with it, please don’t use the Service.

1. Who We Share Data With, Up Front

Because this matters most to most people, here it is first: we do not use analytics or advertising services (no Google Analytics, no PostHog, no ad networks), and we do not sell or share your personal information for advertising. We do share data with a small number of service providers needed to run the app:

2. Information We Collect

2.1 Account information. We use Sign in with Apple. Depending on your Apple ID settings, we receive an anonymized or real email address (Apple may provide a private “Hide My Email” relay address instead of your real one) and a unique identifier for your account. We don’t collect a separate password.

2.2 Your Content. When you use the Service to create a Spatiorama, we collect the Inputs you upload — photos, image sets, panoramas, videos, or text prompts — and the resulting generated outputs (3D models, exports, and their shareable links).

2.3 Purchase information. When you buy credits or subscribe, Apple processes the transaction and shares limited purchase data with us (e.g., product purchased, transaction ID, amount) so we can credit your account. We never see or store your card number or other payment credentials — Apple handles that.

2.4 Communications. If you contact support or use the “Get in Touch” form on our website, we collect what you send us (e.g., name, email address, and message).

2.5 Newsletter. If you subscribe to our newsletter, we collect the email address you provide for that purpose.

2.6 Technical data collected automatically. Because our website and backend are hosted on Cloudflare, Cloudflare automatically processes standard connection/request data as part of delivering our site and protecting it from abuse — such as IP address, general device/browser type, and request timestamps. We do not operate any separate analytics, advertising, or behavioral-tracking service (e.g., Google Analytics, PostHog, ad pixels), and we don’t use this data to build advertising or behavioral profiles about you.

2.7 Cookies. Our website may use strictly necessary cookies required for basic site functionality (e.g., remembering that you submitted the newsletter form). We do not use tracking or advertising cookies.

3. How We Use Your Information

We use the information above to:

• create and maintain your account and authenticate you;
• generate, store, and let you export and share your Spatioramas;
• process purchases and manage your credit balance;
• respond to support requests and communications;
• send you newsletter content, if you’ve subscribed (you can unsubscribe anytime);
• maintain the security, integrity, and reliability of the Service; and
• comply with legal obligations.

We do not use your information to serve you targeted advertising, and we do not build advertising profiles about you.

4. Legal Bases for Processing (EEA/UK Users)

If you’re in the EEA, UK, or another jurisdiction requiring a legal basis for processing, we rely on:

• Contractual necessity — to provide the Service you’ve signed up for (account creation, generating Spatioramas, processing purchases).
• Legitimate interests — to secure and maintain the Service, prevent abuse, and respond to your communications, where these interests aren’t outweighed by your rights.
• Consent — for optional communications like our newsletter, which you can withdraw at any time.
• Legal obligation — where we must retain or disclose information to comply with law.

5. World Labs: How Your Content Is Processed for 3D Generation

This is the most important data-sharing relationship in this Policy, so we’re explaining it in detail.

To turn your Inputs into a Spatioramas, we send them to World Labs Technologies, Inc., via its API, which generates the 3D assets and returns them to us. As a result:

• World Labs receives and processes your photos, images, videos, panoramas, and text prompts on its own servers.
• World Labs processes this data under its own Privacy Policy and Terms of Service, independent of this Policy. We don’t control, and aren’t responsible for, how World Labs secures, stores, or further processes data once it’s on their systems, beyond what’s required of us as their customer under applicable law.
• World Labs may use your content to improve its AI models. World Labs’ policies permit it to use content submitted via its API for AI model training, benchmarking, and related development, unless the account transmitting that content — ours — opts out. As of this Policy’s last-updated date, we have not opted our account out of this, so content you upload to Spatiorama may be used by World Labs to train or improve its own models, in addition to being used to generate your Spatiorama. We’ll update this Policy if that changes.
• World Labs’ own Privacy Policy also states it may retain content used for AI training longer than its standard retention period, and that opting out of training stops future use but doesn’t undo training already completed on previously submitted content.

If you’re not comfortable with this, please don’t upload content to Spatiorama, since this transmission is required to generate any Spatiorama.

6. How We Share Information

Beyond World Labs (Section 5), we share information with:

• Apple, to operate Sign in with Apple and process in-app purchases, under Apple’s own privacy terms;
• Cloudflare, our infrastructure and hosting provider, which processes data on our behalf to deliver and secure the Service;
• law enforcement or regulators, if required by law, legal process, or to protect the rights, safety, or property of Spatiorama, our users, or others; and
• a successor entity, if we’re involved in a merger, acquisition, or sale of assets — we’ll notify you if your information becomes subject to a different privacy policy as a result.

We do not sell your personal information, and we do not share it with third parties for cross-context behavioral advertising, as those terms are defined under the CCPA.

7. International Data Transfers

We’re a small, early-stage service without a permanent establishment yet, but our infrastructure (Cloudflare) and our AI processing partner (World Labs) are based in — or transfer data to — the United States. If you’re located in the EEA, UK, or elsewhere outside the U.S., your information will be transferred to and processed in the U.S. and potentially other countries whose data protection laws may differ from your own.

Where required, we rely on appropriate safeguards for these transfers, such as Standard Contractual Clauses with our service providers. By using the Service, you understand that your information may be processed outside your country of residence.

We are not currently established in the EU and do not yet have a designated EU/UK representative under Article 27 GDPR / UK GDPR. If you are an EEA/UK user with questions about exercising your rights, please contact us directly at the email below and we will respond.

8. Data Retention

• Your Content (uploads and generated Spatioramas): we retain your Inputs and generated outputs for 90 days, or as long as required by applicable law, whichever is longer, after which we delete them from our own systems unless you’ve saved/exported them or they remain part of an active Spatiorama link you haven’t deleted. Note this governs retention on our systems only — see Section 5 regarding World Labs’ separate retention of content it has processed, which may be longer where used for AI training.
• Account information: retained for as long as your account is active, and deleted (or anonymized) within a reasonable period after you request account deletion, subject to what we must legally retain (e.g., for tax, fraud-prevention, or dispute-resolution purposes).
• Purchase records: retained as long as required by tax and accounting law.
• Newsletter/contact-form data: retained until you unsubscribe or request deletion.

9. Your Privacy Rights

9.1 If you’re in the EEA, UK, or a similar jurisdiction, you have the right to:

• access the personal data we hold about you;
• request correction of inaccurate data;
• request erasure (“right to be forgotten”);
• restrict or object to certain processing;
• request data portability; and
• lodge a complaint with your local data protection authority.

9.2 If you’re a California resident, you have the right to:

• know what personal information we’ve collected, used, and disclosed about you;
• delete personal information we hold about you;
• correct inaccurate personal information;
• opt out of the sale or sharing of personal information (we don’t sell or share personal information, so there is nothing to opt out of); and
• not be discriminated against for exercising these rights.

California “Shine the Light”: we don’t share personal information with third parties for their own direct marketing purposes.

9.3 Other U.S. states. If you reside in a state with its own comprehensive privacy law (e.g., Virginia, Colorado, Connecticut, Utah, or others), you may have similar rights to access, correct, delete, or obtain a copy of your personal information, and to opt out of certain processing. We’ll honor valid requests under applicable state law.

9.4 How to exercise your rights. Contact us at support@spatiorama.app. We may need to verify your identity before fulfilling a request. You can also delete your account and most associated content directly, or by asking us to do it for you.

10. Children’s Privacy

The Service is not intended for anyone under 18, and we do not knowingly collect personal information from anyone under 18 — largely because our AI-processing partner, World Labs, also prohibits use by minors. If we learn we’ve collected information from someone under 18, we will delete it promptly. If you believe a minor has provided us information, contact support@spatiorama.app.

11. Security

We use commercially reasonable technical and organizational measures — including relying on Cloudflare’s infrastructure protections — to protect your information. No method of transmission or storage is completely secure, and we can’t guarantee absolute security.

12. Do Not Track

Our Service does not currently respond differently to browser “Do Not Track” signals, since we don’t operate cross-site tracking or advertising technologies to begin with.

13. Links to Other Services

The Service links to or integrates with third-party services — including the App Store, World Labs, and Apple’s Sign-in and payment systems — that have their own privacy policies. We encourage you to review those policies; we’re not responsible for their practices.

14. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we’ll revise the “Last Updated” date and, where appropriate, provide additional notice. Continued use of the Service after an update means you accept the revised Policy.

15. Contact Us

Questions, requests, or concerns about this Privacy Policy or your data? Contact us at support@spatiorama.app.

This Policy describes our own data practices. Section 5 also describes World Labs’ handling of your content under its own, independently maintained policies — please review those directly for full details.