🔒 Privacy Policy

1. Introduction

This Privacy Policy explains how [Platform Name] ("Platform," "we," "us," "our") collects, uses, stores, and protects personal data when you use our Blender file and digital asset exchange platform.

If you are located in the European Union (EU), European Economic Area (EEA), or United Kingdom, this policy complies with the General Data Protection Regulation (GDPR).

If you are a California resident, this policy complies with the California Consumer Privacy Act (CCPA), as amended by the CPRA.

By using the Platform, you agree to this Privacy Policy.

2. Information We Collect

We collect the following categories of personal information:

2.1 Information You Provide

• Account information (username, email address, password hash)
• Profile information (optional bio, avatar)
• Uploaded Assets and related metadata
• Communications sent to us (support requests, reports)
• Payment information (if applicable — processed by third-party providers)

2.2 Automatically Collected Information

• IP address
• Browser type and version
• Device information
• Operating system
• Referring URLs
• Log data
• Usage data (downloads, uploads, interactions)
• Cookies and similar technologies

2.3 User-Generated Content

Assets you upload may contain embedded metadata. You are responsible for ensuring your uploaded files do not unintentionally contain personal data.

3. Legal Bases for Processing (GDPR)

If you are in the EU/EEA/UK, we process your personal data under the following lawful bases:

• Contractual necessity – to provide the Platform
• Legitimate interests – to improve security, prevent fraud, and maintain service integrity
• Legal obligation – to comply with applicable laws
• Consent – where required (e.g., non-essential cookies)

4. How We Use Personal Information

We use personal data to:

• Provide and maintain the Platform
• Enable uploading and sharing of Assets
• Authenticate users
• Improve service performance
• Detect and prevent fraud, abuse, and malicious uploads
• Comply with legal obligations (DMCA, DSA, court orders)
• Respond to support inquiries
• Enforce our Terms of Service

We do not sell personal data.

5. Cookies & Tracking Technologies

We use:

• Essential cookies (authentication, security)
• Functional cookies
• Analytics cookies (if applicable)

EU users will be presented with a cookie consent mechanism where required.

You may disable cookies through your browser settings.

6. Data Sharing & Disclosure

We may share personal information with:

• Hosting providers
• Cloud storage providers
• Payment processors
• Analytics providers
• Legal authorities when legally required
• Professional advisors (lawyers, auditors)

All service providers are contractually obligated to protect personal data.

We do not sell personal data to third parties.

7. International Data Transfers (GDPR)

If you are located outside the country where our servers are hosted, your information may be transferred internationally.

Where required, we use:

• Standard Contractual Clauses (SCCs)
• Adequacy decisions
• Other legally approved safeguards

8. Data Retention

We retain personal data only as long as necessary to:

• Provide services
• Comply with legal obligations
• Resolve disputes
• Enforce agreements

Deleted accounts may have certain data retained for legal compliance or fraud prevention.

9. Data Security

We implement reasonable technical and organizational measures to protect personal data, including:

• Encryption in transit (HTTPS)
• Secure password hashing
• Access controls
• Monitoring for malicious activity

However, no system is completely secure.

10. Your Rights Under GDPR (EU/EEA/UK)

If you are in the EU/EEA/UK, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase data ("Right to be Forgotten")
• Restrict processing
• Object to processing
• Data portability
• Withdraw consent at any time
• Lodge a complaint with a supervisory authority

Requests may be submitted to: [Insert Privacy Contact Email]

We may verify your identity before responding.

11. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know what personal information we collect
• Request deletion of your personal information
• Correct inaccurate personal information
• Opt-out of sale or sharing (we do not sell personal data)
• Limit use of sensitive personal information (if applicable)
• Non-discrimination for exercising privacy rights

You may submit requests via: [Insert Privacy Email or Form Link]

We will verify your identity before fulfilling requests.

12. Categories of Personal Information Collected (CCPA Disclosure)

In the past 12 months, we may have collected:

• Identifiers (email, username, IP address)
• Internet activity (usage logs)
• Account-related information
• User-generated content
• Commercial information (if paid features exist)

We do not sell personal information.

13. Children's Privacy

The Platform is not directed at children under 13 (or the minimum legal age in your jurisdiction).

We do not knowingly collect personal data from children.

If we become aware of such data, we will delete it.

14. Data Related to Uploaded Assets

Uploaded Blender files may contain:

• Embedded metadata
• Embedded Python scripts
• Linked external resources

Users are responsible for ensuring uploaded content does not violate privacy laws.

We are not responsible for personal data embedded in user-uploaded files.

15. Automated Decision-Making

We may use automated systems to:

• Detect spam
• Detect malicious scripts
• Identify copyright violations
• Enforce platform quality standards

These systems assist human moderation and are not solely determinative where legally required.

16. Do Not Track Signals

We currently do not respond to "Do Not Track" browser signals.

17. Changes to This Policy

We may update this Privacy Policy from time to time.

Continued use of the Platform after updates constitutes acceptance.

18. Contact Information

For privacy-related inquiries:

[Company Name]
[Insert Address]
[Insert Privacy Email]

EU users may also contact their local Data Protection Authority.