Scope and responsibility
This policy explains how NovaGen3D handles personal information through its website, accounts, creative tools, and support channels. The operator identified at the end of this page is responsible for the processing described here. External services may also process information under their own policies.
This policy describes our practices; it is not a blanket consent to every type of processing. Where consent is required, it must be obtained separately. Paid-service information below applies only when purchasing is available.
Information we process
The information involved depends on the features you use and the services enabled for the deployment.
- Account information: your name, email address, profile image, account identifiers, sign-in records, and authentication information. Google sign-in supplies the profile information authorized for that login; it does not give us your Google password.
- Creative content: prompts, reference images, uploaded 3D files, file URLs, task settings, generated reference images, outputs, and related task or asset identifiers. This material may contain personal information if you include it.
- Saved asset records: the model and operation used, provider task identifier, file name, format, size, creation time, and storage location linked to your account.
- Technical information: IP address, browser or device information, request times, errors, and security or diagnostic logs. Enabled analytics services may collect page views, interaction events, referral information, or session activity.
- Billing information, when purchasing is available: plan, credit balance, order and subscription identifiers, transaction status, and receipts. Payment details are handled by the payment provider; do not send full card numbers or security codes to our support team.
- Communications: the details you send through an available support channel, including the issue, relevant task or order identifiers, and any attachments you choose to provide.
How creative content is processed
Selecting a local file is different from submitting it for processing. When you submit a task or upload, relevant files, URLs, prompts, and settings can be sent to our servers and external providers. Text-to-3D may first send your prompt to an image-generation service to prepare a reference image, then send that image to a 3D-generation service.
Successful results may be copied to cloud storage and associated with your account in My Assets. Your browser may also cache model files and preview images. Refreshing or closing the page does not necessarily delete uploaded files, provider task records, or archived results.
Some upload and output links are accessible to anyone who has their URL. Account-only listing and authenticated preview access do not guarantee that every underlying file URL is private. Avoid including confidential material or sensitive personal information in prompts, files, file names, or publicly accessible links.
Purposes and legal bases
We process information to authenticate accounts, run requested tasks, store and deliver assets, maintain credit and billing records where applicable, provide support, investigate failures, prevent abuse, and comply with legal obligations.
Where the GDPR or similar rules apply, processing necessary to deliver the service you request is based on performance of a contract; proportionate security, fraud prevention, and service diagnostics may be based on legitimate interests; required records or disclosures are based on legal obligations. Optional tracking or marketing that requires consent is based on consent, which you can withdraw. We assess the appropriate basis for the particular activity rather than treating use of the site as consent to all processing.
Service providers and disclosures
We share the information needed for a provider to perform the relevant service. The current application integrates Google for sign-in, Lux3D / Manycore services for 3D processing and uploads, AIHubMix for the text-to-3D reference-image step, and Cloudflare R2 for configured asset storage. A provider receives relevant content and technical data, not automatically all of your account information.
Hosting, database, email, error monitoring, analytics, chat, and payment providers may also receive information when those services are enabled. The actual services in use depend on deployment configuration. A service's inclusion in the application does not mean that it is enabled for every visitor.
We may disclose information when lawfully required, to investigate fraud or a serious security issue, or to protect rights and safety. If the business is transferred, relevant records may transfer with it, subject to applicable privacy obligations and any required notice. We do not sell your creative files to third parties for their independent marketing.
Model training and publication
Submitting a task is permission to carry out the requested processing, not general permission for us to publish your content or train our own models on it. An optional public showcase or training program would need a separate, clearly described choice.
External model services may retain requests or outputs under their own policies and contracts. We have not established a universal zero-retention or no-training guarantee across all providers. A confidential-processing or enterprise no-training commitment applies only if it is expressly agreed and supported by the providers used for your work.
Retention and deletion
Account records and saved assets are kept while needed to provide your account and requested storage. Uploaded inputs and provider records can have different retention periods from saved outputs. There is no general promise that every file is deleted after a fixed number of hours.
You can delete an asset from My Assets or request account and personal-information deletion through the published contact channel. Removing an account or listing does not necessarily remove copies already downloaded, provider-held records, browser caches, backups, or files retained for a legal obligation. We review deletion requests and applicable exceptions rather than promising immediate deletion everywhere.
We retain billing and tax records, security logs, and dispute evidence only for the periods needed for their purpose or required by law. Backup copies may remain until their normal replacement cycle. When information is no longer needed, we seek to delete it or de-identify it. Provider-side deletion depends on the applicable provider's arrangements and legal duties.
Security and international processing
We use authentication, access checks, and other technical controls to protect information, but no internet service can guarantee absolute security. Public file links, unsafe account sharing, or sensitive content in an input can create risks these controls do not remove.
Information may be processed outside your country by our hosting and service providers. Privacy laws may differ between those locations. Where applicable law requires a transfer mechanism or other safeguard, that requirement applies to the relevant transfer. Contact us for information about a particular provider or transfer; this policy does not assert that every deployment has the same storage location or transfer arrangement.
Your rights and choices
Depending on your location, you may have rights to access, correct, delete, or obtain a portable copy of personal information, restrict or object to processing, withdraw consent, or complain to a privacy regulator. Where applicable, you may also have rights concerning sale or sharing for targeted advertising and significant decisions made solely by automated processing.
Send a request to the contact address below and describe the information or account involved. We may need proportionate verification of your identity or authority. Do not send a password or unnecessary identity documents. We respond within the period required by applicable law and explain any lawful limitation on a request. Withdrawing consent does not affect processing that was lawful before withdrawal.
You can update available profile settings, delete saved assets, and use browser controls for local storage. Marketing emails, if sent, should provide an unsubscribe option. We do not penalize you for exercising a privacy right.
Children and policy changes
NovaGen3D accounts are intended for adults aged 18 or older. If you believe a child has provided personal information through an account, contact us so we can investigate and take appropriate action.
We update this policy when practices or legal requirements change and revise the date above. Material changes receive any notice or fresh consent required by law. A change to this page alone does not authorize a new use of information that requires separate consent.
Contact
NovaGen3D is the public name of the service at https://novagen3d.com.
For account, privacy, billing, or policy questions, email support@novagen3d.com. The on-site contact form is a preview and does not deliver messages; use this mailbox instead.