Privacy policy

Version 2026-10-12 · applies to www.ex3d.com and EX3D Studio (www.ex3d.com/studio/)

1. Who is responsible

The controller of your personal data (in Colombian law, the responsable del tratamiento) is FE3O4 S.A.S., trading as EX3D, NIT 901.004.672-6, Calle 72 # 9-55, Bogotá D.C., Colombia. Contact for anything about your data: [email protected].

We follow the Colombian data protection law (Ley 1581 de 2012 and its regulations, Decreto 1074 de 2015) and, for people in the European Union, the General Data Protection Regulation (GDPR). Where they differ, you get the stronger protection.

2. What we collect, why, and for how long

The mailing list ("I'm interested")

If you join it we keep your email address, the name, profile (architect, student…) and message you choose to give, where you signed up (website or showcase), your language, and a record of your consent (the text version and the time). We use it to write to you about EX3D: beta invitations, new features, showcases.

• Legal basis: your consent (GDPR art. 6(1)(a)). You confirm it twice: the box on the form and the link we email you ("double opt-in").
• Retention: until you leave the list. An unconfirmed request is deleted after 30 days.
• Leaving: every email carries a link that deletes your record at once. Or write to [email protected].
• When you confirm, a copy of your details is sent to our mailbox [email protected] so we can answer you personally; when you leave, we are told so that copy is deleted too.

Public showcase rooms

In a public showcase project you can choose to meet the other visitors. If you do, the name you type, where you are in the model (your camera) and the chat lines you send are passed to the other people in the room live.

• Nothing of it is stored. The server relays it and keeps only a record of the open connection (your name and an anonymous id) while you are connected, at most a few hours. Chat lines are never saved; on screens they disappear after 5 minutes.
• Chat is moderated automatically (offensive words and links are masked). If someone reports a line, the reported line and the two names are emailed to [email protected] so we can act; nothing else is kept.
• Legal basis: your request to join (art. 6(1)(b)) and our legitimate interest in keeping the room safe (art. 6(1)(f)). You can stay invisible: just do not join, or switch "Visible to others" off.

Anonymous visit counting (everyone, no cookie)

To know how many people visit and from roughly where, each visit to www.ex3d.com and to a public showcase sends: the page, your device's time zone (for example "America/Bogota" — a region, not a location), language, device type (phone / tablet / computer), browser and system names, the website that sent you (its name only, not the page), and simple actions (went into 3D, opened the list form, the coffee or social links). No cookie is set, nothing is stored on your device, no IP address is kept and no identifier is created, so we cannot recognise you or follow you. Counts are kept 400 days, the list of recent visits 30 days. Basis: our legitimate interest in understanding our audience (art. 6(1)(f)) in a way that does not identify you. Nothing is sent if your browser asks for Do Not Track or Global Privacy Control.

Supporting EX3D ("Buy me a coffee")

If you send a contribution, the payment is handled entirely by the platform you use (Ko-fi and PayPal). We never see your card or bank details; the platform tells us your name, email and any message you leave, under its own privacy policy. We use them only to thank you and keep the accounting records the law requires (Colombian tax rules: up to 10 years).

Accounts (signed-in users)

Your username, the projects and files you save, who changed what and when (version history). Basis: providing the service you signed up for (art. 6(1)(b)). Retention: while your account exists; version history follows the rules shown in the app.

Usage statistics (optional, signed-in users only)

Only if you allow statistics in the cookie choice: how long the app is used, which tools and features, renders and exports (kind and duration), errors. Never the content of your projects. Basis: consent. You can withdraw it at any time on the cookie page.

Technical data

Like every website, our servers see your IP address and browser when you connect. Server logs are kept 14 days for security and troubleshooting (legitimate interest). To stop abuse of the forms we count requests per address for one hour, using a one-way hash of the address — never the address itself.

3. Who processes it for us

Data goes to the USA, which means it leaves Colombia and, for visitors from Europe, the European Economic Area. By joining the list or a room you accept this transfer (Ley 1581 de 2012, art. 26). These providers are certified under the EU–US Data Privacy Framework and bound by the European Commission's Standard Contractual Clauses. We never sell your data and never use it for advertising.

4. Your rights

You may ask for access to your data, correction, deletion, restriction, a copy to take elsewhere (portability), and you may object to processing based on legitimate interest. Where we rely on consent you may withdraw it at any time — it does not affect what was done before. Write to [email protected]; we answer within one month. You may also complain to a data protection authority: in Colombia the Superintendencia de Industria y Comercio (www.sic.gov.co), after first writing to us as Colombian law asks; in Europe the authority where you live (in Portugal: CNPD, www.cnpd.pt).

Under Colombian law (habeas data) you may know, update and correct your data, ask for proof of your consent, be told how it is used, revoke your consent and ask for deletion. We answer questions within 10 working days and claims within 15 working days.

5. Children

EX3D is not meant for children under 16. We do not knowingly collect their data.

6. Changes

When this policy changes we update the version date above; a change that needs your consent again (for example a new kind of optional statistics) is asked again in the app.