Privacy Policy

This Privacy Policy explains how Spatiorama (“Spatiorama,” “we,” “us,” “our”) collects, uses, shares, and protects information when you use the Spatiorama iOS and Android apps and spatiorama.com (together, the “Service”). It’s written to comply with the EU/UK General Data Protection Regulation (“GDPR”) and applicable U.S. state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”).

By using the Service, you acknowledge this Privacy Policy. If you don’t agree with it, please don’t use the Service.

1. Who We Share Data With, Up Front

Because this matters most to most people, here it is first: we do not use advertising services (no ad networks, no ad pixels), and we do not sell or share your personal information for advertising. We use one product analytics service, PostHog, to understand how the Service is used and to show creators how their shared Spatioramas are viewed (see Sections 2.8 and 2.9). We share data with a small number of service providers needed to run the Service:

2. Information We Collect

2.1 Account information. You sign in with Sign in with Apple or Sign in with Google. We don’t collect a separate password.

• Sign in with Apple: depending on your Apple Account settings, we receive an anonymized or real email address (Apple may provide a private “Hide My Email” relay address instead of your real one), a unique identifier for your account, and, if you choose to share it, your name.
• Sign in with Google: we receive a unique identifier for your Google Account, the email address associated with it, and your name.

2.2 Your Content. When you use the Service to create a Spatiorama, we collect the Inputs you upload — photos, image sets, panoramas, videos, or text prompts — and the resulting generated outputs (3D models, exports, and their shareable links).

2.3 Purchase information. When you buy credits or subscribe, the store of the app you buy in — Apple on iPhone and iPad, Google Play on Android — processes the transaction and shares limited purchase data with us (e.g., product purchased, transaction or order ID, amount, subscription status, refunds) so we can credit your account. To connect a purchase to your account, the app passes the store a random identifier we assign to your account, which contains no personal details. This also applies to promotional codes you redeem through Google Play. We never see or store your card number or other payment credentials — the store handles that.

2.4 Communications. If you contact support or use the “Get in Touch” form on our website, we collect what you send us (e.g., name, email address, and message).

2.5 Newsletter. If you subscribe to our newsletter, we collect the email address you provide for that purpose.

2.6 Technical data collected automatically. Because our website and backend are hosted on Cloudflare, Cloudflare automatically processes standard connection/request data as part of delivering our site and protecting it from abuse — such as IP address, general device/browser type, and request timestamps. We don’t use this data to build advertising or behavioral profiles about you.

2.7 Cookies. Our website may use strictly necessary cookies required for basic site functionality (e.g., remembering that you submitted the newsletter form). We do not use tracking or advertising cookies, and the view statistics described in Section 2.9 use no cookies or other storage on your device.

2.8 Product analytics in the app. The iOS app uses PostHog to record how the app is used, so we can fix problems, improve it, and test changes (for example, which of two versions of an offer works better). This includes events such as finishing sign-in or onboarding, starting a creation, choosing a model or preset, opening and sharing a Spatiorama, being shown a plan or offer, starting or completing a purchase, whether notifications are turned on, and your answers to the app’s notification and news-and-offers questions, plus when the app is opened, backgrounded, installed or updated. Our server also records events such as a creation being charged or finishing, and purchases being verified. With these events, PostHog receives technical information such as your device model, operating system and app version, language, and IP address, which PostHog uses to estimate your approximate location (country and city). Once you’re signed in, events are linked to your Spatiorama account ID, never to your name or email address. We don’t record your screen (no session replay), what you type, or the content of your uploads in PostHog. The Android app does not use PostHog.

2.9 View statistics for shared Spatioramas. When someone opens a Spatiorama’s share link in a web browser, the viewer reports to our server that the Spatiorama was viewed, and, when the page is closed or hidden, how long it was visible and whether (and how far) the viewer moved around. With it we record the website the visitor came from (its domain only), whether they used a phone or a computer, and whether the Spatiorama was embedded in another page. Our server forwards this to PostHog under a random identifier calculated from the visitor’s IP address and browser with a secret that changes every day and is then discarded, so a visitor is counted once per day without being identified and can’t be recognized on another day. The visitor’s IP address itself is not sent to PostHog or stored by us, and no cookies are used. Views from the Spatiorama apps and from automated tools such as link previews are not counted. Owners on plans that include statistics see the totals in the app (views, unique viewers per day, typical time spent, and the sites views came from); they never see who the viewers are. The share viewer also reports, in the same anonymous way, when a visitor uses its links (Spatiorama, Create a Spatiorama, Terms) or its keyboard shortcuts, when a Spatiorama is reported (the reason chosen, not what was written), and when another website tries to embed a Spatiorama that can’t be shown there (with that website’s domain). We use these to improve Spatiorama; owners don’t see them.

2.10 Push notifications, and news and offers. If you allow notifications in the iOS app, we store your device’s push token, linked to your account, and send notifications through the Apple Push Notification service: for example, when a Spatiorama or an export is ready. We only send news and offers if you’ve opted in to them in the app, separately for notifications and for email (sent to your account’s email address), and we keep a record of when and where you gave or withdrew each consent. You can turn notifications off anytime in your device settings, and opt out of news and offers by either channel in the app’s Profile.

3. How We Use Your Information

We use the information above to:

• create and maintain your account and authenticate you;
• generate, store, and let you export and share your Spatioramas;
• show you how your shared Spatioramas are viewed, if your plan includes it;
• process purchases and manage your credit balance;
• send you notifications you’ve allowed, such as when a Spatiorama is ready;
• understand how the Service is used, fix problems, and improve it, including testing different versions of features and offers;
• respond to support requests and communications;
• send you newsletter content, or news and offers by email or notification, if you’ve opted in (you can opt out anytime);
• maintain the security, integrity, and reliability of the Service; and
• comply with legal obligations.

We do not use your information to serve you targeted advertising, and we do not build advertising profiles about you.

4. Legal Bases for Processing (EEA/UK Users)

If you’re in the EEA, UK, or another jurisdiction requiring a legal basis for processing, we rely on:

• Contractual necessity — to provide the Service you’ve signed up for (account creation, generating Spatioramas, processing purchases).
• Legitimate interests — to secure and maintain the Service, prevent abuse, respond to your communications, understand and improve how the Service is used (product analytics, Section 2.8), and give creators anonymous view statistics (Section 2.9), where these interests aren’t outweighed by your rights. You can object to this processing by contacting us.
• Consent — for push notifications and for optional communications like our newsletter and news and offers by email or notification, which you can withdraw at any time.
• Legal obligation — where we must retain or disclose information to comply with law.

5. World Labs: How Your Content Is Processed for 3D Generation

This is the most important data-sharing relationship in this Policy, so we’re explaining it in detail.

To turn your Inputs into a Spatioramas, we send them to World Labs Technologies, Inc., via its API, which generates the 3D assets and returns them to us. As a result:

• World Labs receives and processes your photos, images, videos, panoramas, and text prompts on its own servers.
• World Labs processes this data under its own Privacy Policy and Terms of Service, independent of this Policy. We don’t control, and aren’t responsible for, how World Labs secures, stores, or further processes data once it’s on their systems, beyond what’s required of us as their customer under applicable law.
• World Labs may use your content to improve its AI models. World Labs’ policies permit it to use content submitted via its API for AI model training, benchmarking, and related development, unless the account transmitting that content — ours — opts out. As of this Policy’s last-updated date, we have not opted our account out of this, so content you upload to Spatiorama may be used by World Labs to train or improve its own models, in addition to being used to generate your Spatiorama. We’ll update this Policy if that changes.
• World Labs’ own Privacy Policy also states it may retain content used for AI training longer than its standard retention period, and that opting out of training stops future use but doesn’t undo training already completed on previously submitted content.

If you’re not comfortable with this, please don’t upload content to Spatiorama, since this transmission is required to generate any Spatiorama.

6. How We Share Information

Beyond World Labs (Section 5), we share information with:

• Apple, to operate Sign in with Apple and process in-app purchases on iPhone and iPad, under Apple’s own privacy terms;
• Google, to operate Sign in with Google and process in-app purchases on Android through Google Play, under Google’s own privacy terms;
• Cloudflare, our infrastructure and hosting provider, which processes data on our behalf to deliver and secure the Service;
• PostHog, our product analytics provider, which processes the usage events and view statistics described in Sections 2.8 and 2.9 on our behalf, in its EU data region;
• Apple, to deliver push notifications you’ve allowed through the Apple Push Notification service;
• law enforcement or regulators, if required by law, legal process, or to protect the rights, safety, or property of Spatiorama, our users, or others; and
• a successor entity, if we’re involved in a merger, acquisition, or sale of assets — we’ll notify you if your information becomes subject to a different privacy policy as a result.

We do not sell your personal information, and we do not share it with third parties for cross-context behavioral advertising, as those terms are defined under the CCPA.

7. International Data Transfers

We’re a small, early-stage service without a permanent establishment yet, but our infrastructure (Cloudflare) and our AI processing partner (World Labs) are based in — or transfer data to — the United States. Analytics data is stored in PostHog’s EU data region, though PostHog, Inc. is a U.S. company. If you’re located in the EEA, UK, or elsewhere outside the U.S., your information will be transferred to and processed in the U.S. and potentially other countries whose data protection laws may differ from your own.

Where required, we rely on appropriate safeguards for these transfers, such as Standard Contractual Clauses with our service providers. By using the Service, you understand that your information may be processed outside your country of residence.

We are not currently established in the EU and do not yet have a designated EU/UK representative under Article 27 GDPR / UK GDPR. If you are an EEA/UK user with questions about exercising your rights, please contact us directly at the email below and we will respond.

8. Data Retention

• Your Content (uploads and generated Spatioramas): we retain your Inputs and generated outputs for 90 days, or as long as required by applicable law, whichever is longer, after which we delete them from our own systems unless you’ve saved/exported them or they remain part of an active Spatiorama link you haven’t deleted. Note this governs retention on our systems only — see Section 5 regarding World Labs’ separate retention of content it has processed, which may be longer where used for AI training.
• Account information: retained for as long as your account is active, and deleted (or anonymized) within a reasonable period after you request account deletion, subject to what we must legally retain (e.g., for tax, fraud-prevention, or dispute-resolution purposes).
• Purchase records: retained as long as required by tax and accounting law.
• Newsletter/contact-form data: retained until you unsubscribe or request deletion.
• Analytics events: kept in PostHog only as long as they’re useful for understanding and improving the Service. Events linked to your account are deleted when your account is permanently deleted. View statistics are anonymous and aren’t linked to anyone.
• Push tokens: kept until you sign out of that device or your account is deleted, or until Apple reports the token is no longer valid.

9. Your Privacy Rights

9.1 If you’re in the EEA, UK, or a similar jurisdiction, you have the right to:

• access the personal data we hold about you;
• request correction of inaccurate data;
• request erasure (“right to be forgotten”);
• restrict or object to certain processing;
• request data portability; and
• lodge a complaint with your local data protection authority.

9.2 If you’re a California resident, you have the right to:

• know what personal information we’ve collected, used, and disclosed about you;
• delete personal information we hold about you;
• correct inaccurate personal information;
• opt out of the sale or sharing of personal information (we don’t sell or share personal information, so there is nothing to opt out of); and
• not be discriminated against for exercising these rights.

California “Shine the Light”: we don’t share personal information with third parties for their own direct marketing purposes.

9.3 Other U.S. states. If you reside in a state with its own comprehensive privacy law (e.g., Virginia, Colorado, Connecticut, Utah, or others), you may have similar rights to access, correct, delete, or obtain a copy of your personal information, and to opt out of certain processing. We’ll honor valid requests under applicable state law.

9.4 How to exercise your rights. Contact us at support@spatiorama.com. We may need to verify your identity before fulfilling a request. You can also delete your account and most associated content directly, or by asking us to do it for you.

10. Children’s Privacy

The Service is not intended for anyone under 18, and we do not knowingly collect personal information from anyone under 18 — largely because our AI-processing partner, World Labs, also prohibits use by minors. If we learn we’ve collected information from someone under 18, we will delete it promptly. If you believe a minor has provided us information, contact support@spatiorama.com.

11. Security

We use commercially reasonable technical and organizational measures — including relying on Cloudflare’s infrastructure protections — to protect your information. No method of transmission or storage is completely secure, and we can’t guarantee absolute security.

12. Do Not Track

Our Service does not currently respond differently to browser “Do Not Track” signals, since we don’t operate cross-site tracking or advertising technologies to begin with.

13. Links to Other Services

The Service links to or integrates with third-party services — including the App Store, Google Play, World Labs, PostHog, and Apple’s and Google’s sign-in, payment and notification systems — that have their own privacy policies. We encourage you to review those policies; we’re not responsible for their practices.

14. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we’ll revise the “Last Updated” date and, where appropriate, provide additional notice. Continued use of the Service after an update means you accept the revised Policy.

15. Contact Us

Questions, requests, or concerns about this Privacy Policy or your data? Contact us at support@spatiorama.com.

This Policy describes our own data practices. Section 5 also describes World Labs’ handling of your content under its own, independently maintained policies — please review those directly for full details.