Privacy Policy

Introduction

This Privacy Policy explains how Imaginy / Nyco3D Portfolio (“we”, “us”) collects, uses, and protects personal data when you use our website and applications. We comply with Brazil’s Lei Geral de Proteção de Dados (LGPD — Law 13.709/2018) and, where applicable, the EU General Data Protection Regulation (GDPR) and other international privacy standards.

Data controller

The data controller is Nyco3D / Imaginy. For privacy requests, contact us at the email address published on this site or through the in-app contact channels.

Data we collect

Depending on how you use the service, we may process:

• Account data (e.g. email, display name) when you sign in via Firebase Authentication.
• Usage and analytics data (page views, events, device/browser information) only if you consent to analytics cookies.
• Content you create or upload (scenes, projects, portfolio data) stored in Firebase services.
• Technical data such as IP address, timestamps, and logs needed for security and operation.

Cookies and similar technologies

Cookies are small files stored on your device. We classify them as follows:

• Strictly necessary — Authentication session, security tokens, language preference, and app version checks. These do not require consent under LGPD/GDPR because they are essential to provide the service you requested.
• Analytics (optional) — Firebase Analytics (Google Analytics 4) measures aggregated usage. We only enable this after you opt in via the cookie banner. We do not use advertising or personalization cookies.

You can change your cookie choices at any time using the “Cookie settings” control at the bottom of the screen.

Legal basis (LGPD / GDPR)

We process data based on: (1) your consent (analytics cookies, optional features); (2) performance of a contract or steps prior to entering a contract (providing the service you use); (3) legitimate interests (security, fraud prevention, service improvement where balanced against your rights); and (4) compliance with legal obligations.

Sharing and processors

We use Google Firebase (hosting, authentication, database, storage, and consented analytics), Stripe (billing), and Kiri Engine (3D scan processing) as processors or independent platforms. We do not sell personal data. International transfers use safeguards required by LGPD and GDPR.

Retention

A removed user account is recoverable for exactly 7 days and a trashed project for exactly 14 days, unless an authorized permanent purge is requested sooner. Confirmed purge removes Imaginy-controlled Firebase data and requests deletion of the Stripe customer. Stripe may retain transaction history required by its platform or law. Imaginy deletes its Kiri jobs, uploads, and references, but Kiri provides no upstream deletion API, so vendor-controlled retention copies cannot be independently confirmed by Imaginy.

Your rights

Under LGPD and GDPR (where applicable), you may have the right to:

• Confirm whether we process your data and access a copy.
• Correct incomplete, inaccurate, or outdated data.
• Request deletion of data processed on the basis of consent or when no longer necessary.
• Receive data you provided in a structured, commonly used format.
• Withdraw consent for analytics at any time (without affecting prior lawful processing).
• Object to processing based on legitimate interests, where applicable.

Brazilian data subjects may also petition the Autoridade Nacional de Proteção de Dados (ANPD) after contacting us.

To exercise your rights, contact us using the channels on this site. We will respond within applicable legal timeframes.

International users

If you are in the European Economic Area, United Kingdom, or other regions with privacy laws, you have the rights described above. California residents may have additional rights under the CCPA/CPRA regarding disclosure and deletion — contact us to exercise them.

Children

Our service is not directed at children under 13 (or 16 in the EEA without parental consent). We do not knowingly collect data from children.

Changes

We may update this policy. Material changes will be reflected by updating the “Last updated” date. Continued use after changes constitutes acknowledgment where permitted by law.