Privacy Policy.

The controller of your personal data is Sebastian Licnerski, operating an unregistered business activity under the laws of the Republic of Poland (Art. 5 of the Act of 6 March 2018 – Entrepreneurs' Law), located in Mława (06-500), ul. Szewska, Poland. Contact email: [email protected].

We respect your privacy and process personal data in strict compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 ('GDPR') and applicable Polish data protection regulations.

Voluntary Nature of Data Provision: Providing your personal data is entirely voluntary, but necessary to enter into a contract, create and maintain an account, purchase credits, and utilize the BaseColor cloud generation service. Failure to provide required account details prevents access to authentication and cloud generation features.

Automated Decision-Making and Profiling: We do NOT use automated decision-making or profiling as defined under Article 22 of the GDPR that produces legal effects concerning you or similarly significantly affects you.

We process personal data only when an explicit legal basis under GDPR applies:

1. Account & Authentication Data (GDPR Art. 6(1)(b) – Performance of Contract): When signing in via Google or GitHub OAuth, we receive your email address, unique provider identifier, and display name. This data is processed to create your user profile, manage sessions, issue license keys, and track your credit balance.

2. Generation & Job Requests (GDPR Art. 6(1)(b) – Performance of Contract): When you submit a material synthesis job, our systems process your text prompts, optional reference images, target resolution, and request timestamps to execute the generation, debit credits, and permit credit restorations in case of technical failure.

3. Technical Infrastructure & Server Logs (GDPR Art. 6(1)(f) – Legitimate Interest): When visiting our website or connecting via the Blender add-on, server infrastructure automatically records technical access logs (including your IP address, browser user-agent, operating system, requested endpoints, and timestamps). This processing is strictly necessary to maintain system security, detect and prevent malicious abuse or DDoS attacks, and diagnose infrastructure faults.

4. Tax, Accounting & Statutory Records (GDPR Art. 6(1)(c) – Compliance with Legal Obligation): We process transaction metadata and sales summaries necessary to fulfill statutory bookkeeping and tax reporting obligations (including maintaining a simplified sales register under Polish tax regulations and Article 109 of the VAT Act).

5. Dispute Resolution & Defense of Claims (GDPR Art. 6(1)(f) – Legitimate Interest): We retain necessary transactional and account metadata to prevent fraudulent chargebacks, resolve commercial disputes, and defend against potential civil claims arising from service delivery.

6. Customer Support & Inquiries (GDPR Art. 6(1)(b) or Art. 6(1)(f)): If you contact us at [email protected], we process your email address and message contents to respond to and resolve your inquiry.

Zero AI Model Training Guarantee: We and our compute infrastructure partners (including fal.ai) do NOT use your submitted text prompts, uploaded reference images, or synthesized 3D PBR texture maps to train, retrain, or fine-tune public machine learning models or foundation AI systems. Your creative inputs and generated assets remain exclusively yours.

Local-First Storage & Zero Cloud Asset Warehousing: BaseColor does NOT store, host, or archive your generated texture maps, reference images, or 3D project files on our cloud servers. When generation completes, output files are downloaded and saved directly onto your local machine within your Blender workspace. Compute partners process generation requests strictly in transit to deliver the output and do not retain copies of your generated materials. Your intellectual property and files reside exclusively on your local computer.

We partner with trusted cloud infrastructure providers who act as data processors under binding Data Processing Agreements (DPAs):

• Supabase Inc.: Manages user authentication, database operations, and account session security.

• Lemon Squeezy, LLC: Acts as Merchant of Record and independent data controller for payment processing, billing addresses, and international sales tax/VAT compliance. BaseColor never collects, stores, or accesses your payment card details.

• fal.ai (fal, Inc.): Provides dedicated cloud GPU infrastructure to compute multi-channel PBR material synthesis and upscaling.

• Vercel Inc. and Cloudflare, Inc.: Provide global edge hosting, DNS routing, DDoS protection, and content delivery caching.

International Transfers: Where personal data is transferred to service providers located outside the European Economic Area (EEA), such as the United States, transfers are safeguarded under the EU-U.S. Data Privacy Framework (DPF) adequacy decision and/or Standard Contractual Clauses (SCCs) approved by the European Commission.

BaseColor values privacy by design. We do NOT use third-party advertising cookies, behavioral tracking scripts, cross-site trackers, or invasive analytics pixels (such as Meta Pixel or Google Ads).

We deploy only strictly necessary technical cookies and local storage tokens required for secure user authentication and session continuity with Supabase. In accordance with Directive 2002/58/EC (ePrivacy Directive), strictly necessary cookies do not require user consent banners.

We retain personal data strictly for as long as necessary to achieve the specific purposes outlined above:

• Account & Profile Data: Retained for the duration of your active account. Upon verified account deletion request, your account data is permanently erased or irreversibly anonymized within thirty (30) days.

• Tax & Accounting Records: Retained for a mandatory statutory period of 5 years, counted from the end of the calendar year in which the tax payment deadline expired, pursuant to Article 86 of the Polish Tax Ordinance (Ordynacja podatkowa).

• Defense of Legal Claims & Dispute Records: Retained for up to 3 years following the date of account closure or transaction, in accordance with the general statute of limitations for commercial claims under Article 118 of the Polish Civil Code (Kodeks cywilny).

• Server Access & Security Logs: Retained for a maximum period of 30 to 90 days for network security monitoring, diagnostics, and DDoS mitigation, after which they are automatically purged or aggregated.

Under Articles 15–22 of the GDPR, you have the following enforceable rights:

• Right of Access: Obtain confirmation as to whether your data is processed and receive a copy thereof.

• Right to Rectification: Correct inaccurate or incomplete personal data.

• Right to Erasure ('Right to be Forgotten'): Request deletion of your personal data when it is no longer necessary for the purposes collected, subject to statutory retention mandates.

• Right to Restriction of Processing: Restrict the processing of your data under specific statutory conditions.

• Right to Object: Object at any time to processing based on legitimate interests (Art. 6(1)(f) GDPR).

• Right to Data Portability: Receive your personal data in a structured, commonly used, machine-readable format.

To exercise any of your rights, contact us at [email protected]. You also have the right to lodge a formal complaint with the competent supervisory authority: Prezes Urzędu Ochrony Danych Osobowych (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland (https://uodo.gov.pl).

We may update this Privacy Policy from time to time to reflect technological, operational, or legal developments. Significant modifications will be communicated via email to registered users or posted prominently on our website prior to taking effect.