Privacy Policy

1. About this policy

This policy explains what personal information 3D Nova ("3D Nova", "we", "us") collects, why, who we share it with, how long we keep it, and the choices and rights you have. It covers the website at 3dnova.app, the dashboard, the tour builder, published tours, business cards and galleries (the "Service").

• For your account and our website, we decide how your information is used (we are the "controller").
• For information that our customers collect from the people who view their tours or cards, such as lead forms, the customer decides and we process it on their behalf (we are a "processor"). Sections 3 and 12 explain this.

Questions or requests: hello@3dnova.app.

2. Information we collect from customers

• Account details: your email address, password (stored only in scrambled, hashed form by our sign-in provider), name and company if you give them, and your settings. If you sign in with Google, we receive your name, email address and profile picture from Google.
• Your content: the 360° photos, images, floor plans, logos, audio, 3D scans, text and links you add to tours, and the details you put on your business card (for example your photo, job title, phone number, email address and social links). Content you publish is visible to anyone with the link.
• Team information: the email addresses of people you invite to your team, and their roles.
• Billing information: your plan, its dates and status, and an identifier from our payment provider. Your card details go directly to the payment provider; we never receive them.
• Messages: what you send us through our contact form or by email.
• Content reports: if you report a tour or card, the reason and details you give, your name and email (unless you report anonymously where that is allowed), and the page the report is about. We use them only to handle the report and to keep a record of what we decided.
• Technical information: your IP address, browser and device type, and pages used, which our hosting, database and security providers record in their logs; and error reports (what went wrong, on which page, your browser and IP address) so we can fix problems.

2A. Google user data (Sign in with Google)

You can create an account or sign in with your Google account. This is the only way 3D Nova uses Google user data, and we ask Google only for the basic sign-in details (the openid, email and profile permissions). We do not ask for, and cannot see, your Gmail, Google Drive, Google Calendar, Contacts or any other Google data.

• What we receive: your name, your email address and your Google profile picture.
• Why we use it: only to create your 3D Nova account, sign you in, show your name and picture in the dashboard, and send you account emails (for example confirming your email address or alerting you to a lead). We do not use it for anything else.
• Where it is stored: with our database and sign-in provider, Supabase, together with the rest of your account details (see section 5).
• Who it is shared with: no one, except the service providers listed in section 5 that run 3D Nova for us, and only so they can provide their service. We do not sell it, we do not use it for advertising, and we do not use it to train artificial intelligence or machine learning models.
• Who can see it: our staff can look at it only when you ask us for support, when needed for security or to fix a fault, or when the law requires it.
• How long we keep it, and deleting it: until you delete your account (see section 7). You can delete your account in the dashboard, or email hello@3dnova.app and we will delete it. You can also stop 3D Nova from using your Google sign-in at any time at myaccount.google.com/permissions.

3D Nova's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3. People who view tours and business cards

You can view a published tour or business card without an account. When you do:

• Viewing statistics: we record the approximate country you are in, your type of device, how long you looked and which scenes and hotspots you opened, and give these statistics to the tour's owner. The country is worked out by our hosting provider (Cloudflare) from your connection, the same way it already handles every visit; your IP address is not sent to any other company for this, and we store only the country, not your IP address. Statistics are not linked to your name.
• Lead forms: if you fill in a form in a tour, the details you type (such as your name, email, phone number and what you are interested in) are stored and sent to the owner of that tour so they can contact you. That owner decides how they use your details. Please read their privacy notice, and contact them with any questions or requests; we will help where we can.
• Embedded content: if a tour includes a YouTube or Vimeo video or a Google map, that company may collect information about you under its own privacy policy when it loads.
• Technical logs: like any website, our hosting, database and security providers log your IP address and browser for a short time to keep the Service secure, and error reports may include them.

3A. Nova+ (agencies and agents)

Nova+ lets an agency share tours with its agents, each with a personal link and business card.

• Agents: when an agency invites you, we store your email address, the name, job title, phone, WhatsApp, public email, photo and short description you add to your card, your role, and the tours the agency lets you share. We use this to run your account and your link.
• What is public: your business card details are shown to anyone who opens your link (for example plus.3dnova.app/company/agent). Only add details you are happy to make public. You can change or remove them in your dashboard at any time.
• What the agency can see: the agency's admins can see your card, your link, your activity statistics and any visitor details sent to your link, and can pause, remove or restore you. The agency decides how these are used; ask your agency for its own privacy notice.
• Roles: for the agency's account, the agency is the customer and decides the purposes (controller) and 3D Nova processes the data for it, under section 12. For your own sign-in details, we are the controller.
• If you are removed: your link stops working straight away. Your page and details are kept for 30 days so the agency can restore you, then deleted permanently. You can ask us or the agency to delete your details earlier.
• Visitors to an agent link are covered by section 3: viewing statistics, and lead details sent to the agent and agency where a form is switched on.

4. How we use information, and our legal reasons

• To provide the Service you signed up for (performing our contract with you): creating your account, hosting and showing your tours and cards, sending lead notifications, processing your plan, and support.
• To keep the Service secure and working (our legitimate interests): preventing fraud, spam and abuse, fixing errors, measuring how the Service is used in aggregate, and improving it.
• With your consent: Google Analytics on our homepage, only if you accept cookies. You can withdraw consent at any time.
• To meet legal obligations: for example keeping records our payment provider and the law require, and answering lawful requests from authorities.
• Emails: we send emails about your account and the Service (such as confirming your email, password resets, lead alerts and important changes). We will only send marketing emails if you agree, and every marketing email will have an unsubscribe link.

We do not sell your personal information, we do not share it for targeted advertising, and we do not use your content to advertise.

5. Who we share information with

We use these service providers to run 3D Nova. They may only use the information to provide their service to us:

• Supabase: database, sign-in and file storage;
• Cloudflare: website hosting, content delivery, media storage, security checks (Turnstile) and traffic logs;
• Polar: payments, taxes and invoices (Polar is the merchant of record for paid plans);
• Resend: sending emails such as lead notifications;
• Sentry: error reports, stored in the European Union;
• Google: Google sign-in (if you choose it), Google Analytics on our homepage (only with your consent), and maps shown in tours. Our fonts are served from our own website, not by Google;
• Formspree: the contact form on our website;
• OpenStreetMap (Nominatim): the address you search for when setting a tour's location;
• QR Server: making QR codes of your tour and card links;
• jsDelivr and cdnjs: delivering code libraries the pages use.

We also share information when you ask us to (for example, your tour's leads go to you and your team), when the law requires it, to protect people's safety or our rights, or as part of a merger, sale or reorganisation of our business, in which case this policy continues to protect it.

6. International transfers

Our service providers may process information in countries other than yours, including the United States. Where the law requires it, we rely on safeguards such as the European Commission's Standard Contractual Clauses (and the UK equivalent) offered by those providers.

7. How long we keep information

• Account and content: while your account is open. Tours in Trash are deleted permanently after 30 days (or straight away if you empty the Trash), and their photos and files are removed from storage within a further 14 days.
• Guest tours that are never saved to an account: about 24 hours.
• Viewing statistics and leads: while the tour owner's account is open, or until the owner deletes them.
• Nova+ agents: while they are part of the agency. After an agency removes an agent, their page and details are kept for 30 days and then deleted.
• After you delete your account: your profile, tours, team access, projects, cards and all related records are deleted straight away, and the stored photos and files within 30 days. Copies in backups and logs are overwritten within a further 30 days.
• Content reports are kept for up to two years after we decide them, so we can show how reports were handled.
• Billing records are kept by our payment provider for as long as tax and accounting laws require.
• Error reports are kept for up to 90 days.

8. Security

Information is sent over encrypted connections (HTTPS) and stored with providers that encrypt it at rest. Access is limited by account and by role, and passwords are never stored in readable form. No system is perfectly secure; if a breach affects your personal information, we will tell you and the authorities as the law requires.

9. Your rights

Depending on where you live (for example in the EU, UK or California), you can ask us to:

• tell you what personal information we hold about you and give you a copy;
• correct it, or delete it;
• give it to you in a portable format;
• stop or limit using it, or object to how we use it;
• withdraw a consent you gave.

You can delete your account and all its data yourself in Account Settings → Delete Account. For anything else, email hello@3dnova.app. We may need to confirm it is you, and we answer within one month (45 days in California). We will not treat you differently for using your rights. You can also complain to the data protection authority where you live.

10. Children

3D Nova is for people aged 18 and over. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

11. Cookies and similar technology

• Essential: your browser's local storage keeps you signed in and remembers settings such as your last open tab and your cookie choice. The Service does not work without these.
• Security: Cloudflare Turnstile checks that visitors are not automated, for example when someone starts building a tour without an account.
• Analytics: Google Analytics runs on our homepage only after you accept cookies, with IP addresses anonymised.
• Embedded content: YouTube, Vimeo and Google Maps may set their own cookies when a tour includes them.

12. Customer data terms (when we process data for you)

When you, as a customer, use 3D Nova to collect information about other people (lead forms and viewing statistics), these terms form part of our agreement with you:

• we process that information only to provide the Service to you and on your documented instructions (the way you set up and use the Service), unless the law requires otherwise;
• everyone at 3D Nova who can access it is bound by confidentiality;
• we protect it with the security measures in section 8;
• we use the service providers listed in section 5 as sub-processors, under written terms that protect the information, and we will update this list before adding new ones;
• we will help you answer requests from the people concerned, and with security and data protection assessments, where needed;
• we will tell you without undue delay if we become aware of a breach affecting that information;
• when you delete it, or your account, we delete it as described in section 7;
• we will give you the information you need to show that these terms are followed.

These terms are also available as a separate Data Processing Agreement you can download, print and keep with your records.

13. Changes to this policy

We may update this policy. If a change is important, we will tell you by email or in the app before it takes effect. The date at the top shows when it last changed.

14. Contact

For privacy questions or requests, email hello@3dnova.app.