This Privacy Policy explains how 3DVizi Ltd, trading as 3DVizi (Limited Company), collects, uses, shares, and protects personal information. In this policy, "we", "us", and "our" mean 3DVizi.

We are the data controller for the personal information described in this policy, except where we state that we act as a processor on behalf of one of our customers. "Our Two Roles: Controller and Processor" below explains the difference and when each role applies.

• Postal address: Stone, Staffordshire, United Kingdom
• Privacy enquiries: privacy@3dvizi.com
• General support: support@3dvizi.com
• Website: https://www.3dvizi.com
• ICO registration number: 17372934

We have not appointed a statutory Data Protection Officer, because we are not required to do so. Privacy questions are handled directly by us at the address above.

Representative in the European Union. Because we offer the Services to people in the EU and EEA but are not established there, we have appointed a representative under Article 27 of the EU GDPR. Individuals in the EU or EEA may contact that representative on any matter relating to the processing of their personal data: S Draper

This policy applies to:

• our marketing website at https://www.3dvizi.com, including the help centre and any landing or demonstration pages;
• the 3DVizi web application used to create, manage, and publish 3D presentations;
• the published viewers, share links, and embedded viewers that display our customers' 3D content on their own websites;
• our CAD add-ins and integrations, including those for SOLIDWORKS and Onshape, and the device pairing they use; and
• our public API and any email, chat, or support channel we operate.

We refer to all of these together as the "Services". This policy does not apply to third-party websites, products, or services that we do not control, even where we link to them or where our viewer is embedded in them.

Data protection law distinguishes between a controller, who decides why and how personal data is processed, and a processor, who processes personal data on a controller's instructions. We act in both roles, and the distinction determines who you should contact about your data.

We are a controller for information about our own users and visitors: people who visit our marketing website, create an account, take a trial, subscribe, contact support, or use our CAD add-ins. Most of this policy describes that processing, and you can exercise your rights with us directly.

We are a processor for information generated when a member of the public views one of our customers' published or embedded 3D presentations. In that situation our customer is the controller: they decide to publish the presentation, they choose whether to place it on their website, and they decide what to do with the resulting statistics and any enquiry forms. "Embedded Viewers and Published Presentations" below describes this in detail.

If you interacted with a 3D viewer on somebody else's website and want to exercise your rights over that data, the organisation whose website you were on is the right place to start. If you contact us instead, we will help identify the relevant customer where we reasonably can, and we will pass the request on, but we cannot decide the outcome on their behalf.

Account and profile information.

• your email address, which is also your sign-in identifier;
• your first and last name, where you provide them;
• a profile image, where you choose to add one;
• the organisation or workspace you belong to, its name, its plan, and your role within it, such as owner, editor, or viewer;
• authentication identifiers held for you in Amazon Cognito, our identity provider, and a rotating session identifier we use to enforce a single active session per account; and
• invitations you send or receive when adding people to an organisation.

We do not store your password. Authentication is handled by Amazon Cognito, and we never receive your password in a readable form.

Billing and subscription information.

• your subscription plan, status, trial start and end dates, renewal date, and any additional seats or project packs you have purchased; and
• customer and subscription identifiers issued by Stripe, our payment processor, together with a record of billing events affecting your account.

We never receive or store your full card number. Card details are collected and processed directly by Stripe. We hold only the identifiers and status information Stripe returns to us.

Content you upload.

• CAD models, geometry, textures, images, and other files you upload or import;
• project configuration, including scenes, views, exploded states, alternative part sets, materials, overlays, actions, and any text or labels you add; and
• any personal information contained inside those files, which we process only as part of storing and displaying your content.

Technical and usage information.

• IP address and approximate location derived from it, browser and device type, operating system, referring page, and pages viewed;
• server and application logs, including request metadata, error reports, and security events; and
• API activity, including the API keys used and the requests they make, and add-in activity logs recording when a paired CAD device connects and what it does.

Viewer statistics for published presentations. When someone views a published or embedded presentation, we record an event containing:

• the type of interaction, such as a view, an embed load, an applied configuration, or an augmented reality launch;
• a randomly generated session identifier for that viewing session;
• approximate location derived by our content delivery network, at country, region, city, and timezone level;
• the referring page address and whether the view was inside an embed; and
• the date and time.

We do not store the viewer's IP address against these events. Location is resolved by our content delivery network before the event reaches us, and we keep only the resulting approximate location. We do not use these events to identify individuals, and we do not combine them with other data to build a profile.

Enquiry forms in published presentations. Our customers can add an enquiry form to a presentation. When a visitor submits one, the content is sent by email to the customer. In our own records we deliberately store only:

• an irreversible cryptographic hash of the submission, used to detect duplicate and retried submissions;
• the delivery state, attempt count, and any provider error code; and
• the recipient address, the project name, and the page address the form was submitted from, retained so that a retried delivery is identical to the original.

We do not retain the content of the enquiry itself — not the name, message, email address, or any other field the visitor typed. That content passes through our email provider to our customer and is not stored in our database.

Integration and connection information. If you connect a CAD or third-party account, such as Onshape, we store the access and refresh tokens needed to maintain that connection, the account identifier at the provider, and records of export jobs run through it. We request the narrowest scope that makes the integration work.

Support and correspondence. If you email us, use our support chat, or report a problem, we keep that correspondence and any information you include in it.

Special category data. We do not seek and do not knowingly collect information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health data, or data about sex life or sexual orientation. Please do not upload such information unless it is strictly necessary and lawful, and tell us first if you need to.

We obtain personal information from three sources.

• Directly from you — when you create an account, subscribe, upload content, configure a project, contact us, or fill in a form.
• Automatically — through cookies and similar technologies, server logs, and the viewer statistics described above, when you use the Services.
• From third parties — from Amazon Cognito when you sign in; from Stripe when you pay, including your subscription status and billing events; from CAD platforms such as Onshape when you authorise a connection; and from our analytics and advertising providers where you have consented to them.

We use personal information to:

• provide, operate, maintain, and improve the Services;
• create and manage accounts, organisations, invitations, and authentication;
• store, process, convert, and display the content you upload;
• publish and serve presentations, share links, and embedded viewers;
• produce viewer statistics and analytics for the customer who owns a presentation;
• deliver enquiry-form emails to the customer who owns a presentation;
• process payments, manage subscriptions and trials, and apply plan limits;
• provide customer support and respond to enquiries;
• operate our CAD add-ins, device pairing, and API access;
• monitor performance, diagnose faults, and improve reliability;
• protect the Services, detect and prevent fraud, abuse, spam, and unauthorised access, and enforce usage and fair-use limits;
• send service-related messages such as verification, billing, and security notices;
• measure how our website is used and how effective our advertising is, where you have consented;
• comply with legal obligations and enforce our Terms; and
• establish, exercise, or defend legal claims.

We do not sell personal data. We do not share personal data with third parties for their own independent marketing, and we do not display third-party advertising on our website or inside our viewers.

Under the UK GDPR and the EU GDPR we must have a legal basis for each purpose. Ours are as follows.

Where we rely on legitimate interests, we have considered the impact on your rights and freedoms and concluded that the processing is proportionate and would be reasonably expected. You can object to processing based on legitimate interests — see "Your Rights" below. You can ask us for more detail on any of these assessments at privacy@3dvizi.com.

We use necessary cookies or local storage where required to operate, secure, and provide the Services. This includes a first-party local storage record named 3dvizi-cookie-consent, which records whether you allow optional services, the version of the choice, and when you made it. This record is how we remember your decision, so it cannot be switched off.

Optional analytics, advertising measurement, and support tools are managed through Google Tag Manager, container GTM-NCWQBC8N. The container loads on every page, but it starts with every category of storage set to denied under Google Consent Mode, so no cookies and no advertising or analytics identifiers are created before you decide. Accepting allows all three purposes below together; there is a single choice rather than one per service.

What happens if you decline. Nothing is stored on your device. However, the tags still send Google a basic signal recording that a page was viewed and that permission was not given — this is how they are instructed to hold back. That signal includes the page address, the referring page, and general device, browser, and language information. It is not written to your device, it is not used to recognise you on a later visit, and it is not used to build a profile.

• Analytics. Google Analytics (property G-657H5NQJ3R) helps us understand page visits and how the website is used. It creates identifiers including _ga and _ga_ cookies, typically lasting up to two years.
• Advertising, marketing, and retargeting. We work with advertising partners so we can tell which advertisements led to a visit, measure whether our advertising works, and include you in audiences that may later show you our advertisements on other websites. These partners set cookies and similar identifiers, typically lasting up to a year. They are currently Google Ads (account AW-18351292915, identifiers including _gcl_), LinkedIn (identifiers including li_fat_id, bcookie, and UserMatchHistory), and Reddit (identifiers including _rdt_uuid). We do not display third-party advertising on this website, and we do not sell your personal information.
• Support chat. We load our support-chat provider, Clixoni, so you can contact us while browsing. As well as keeping a conversation open, the widget stores visitor and session identifiers in your browser's local storage and records the pages you view, so that a conversation can be resumed and answered in context. Anything you type into the chat is sent to the provider so we can reply.

Inside published and embedded viewers we do not set analytics or advertising cookies. Viewer statistics use a session identifier that lasts only for that viewing session, as described in "Information We Collect" and "Embedded Viewers and Published Presentations".

The consent banner makes rejecting optional cookies as direct as accepting them. You can change or withdraw your choice at any time through Cookie settings in the website footer. We also ask again roughly every six months so a choice you made once does not stand indefinitely, and we ask again if the purposes covered by the choice change.

Withdrawing permission immediately returns every storage category to denied, so the tags stop creating or reading cookies and identifiers. We also delete the cookies set on our own domain that we are able to reach, which covers the Google analytics and advertising identifiers, Reddit's _rdt_ identifiers, and LinkedIn's li_fat_id, and we reload the page so that anything already running is torn down. Some identifiers are stored by those providers on their own domains rather than ours, including LinkedIn's bcookie, bscookie, lidc and UserMatchHistory; we cannot delete those from your browser, and you can remove them through your browser settings or the provider's own controls. Withdrawing consent does not affect processing that took place before you withdrew it.

You can also block or delete cookies through your browser settings, and use browser or operating system controls that limit tracking. Blocking necessary storage may stop parts of the Services working.

We currently send only service-related messages — for example account verification, billing notices, security alerts, and replies to your enquiries. You cannot opt out of these while you hold an account, because we need them to provide the Services.

We intend to introduce marketing emails, such as product announcements and onboarding guidance. When we do:

• we will rely on your consent, or on the soft opt-in where you have bought from us or enquired about our products and the law permits it;
• we will only send you information about our own similar products and services;
• every message will contain a clear unsubscribe link, and unsubscribing will take effect promptly; and
• we will never sell or rent your details to another organisation for its own marketing.

You can tell us at any time that you do not want marketing, before or after we introduce it, by emailing privacy@3dvizi.com.

We do not sell your personal data. We share it only where necessary, with:

• service providers who process data on our behalf, listed below;
• the customer who owns a presentation, where you interact with their published or embedded viewer;
• other members of your organisation, who can see the projects, content, and statistics belonging to that organisation;
• professional advisers, auditors, insurers, and legal counsel where necessary;
• law enforcement, regulators, courts, or other authorities where required by law or to protect our rights or the safety of others; and
• a buyer, investor, or successor entity in connection with a merger, acquisition, financing, reorganisation, or sale of assets, subject to equivalent protections.

Our main providers are:

Where a provider processes personal data on our behalf, we put a written contract in place requiring them to act only on our instructions, to keep the data secure and confidential, and to delete or return it when the service ends. We keep this list current; if you want the position as at a specific date, email privacy@3dvizi.com.

We are based in the United Kingdom, and some of our providers are based in or operate from the United States and other countries. This means your personal data may be transferred outside the UK and the EEA.

Where we transfer personal data internationally, we rely on one or more of the following safeguards:

• an adequacy decision by the UK government or the European Commission covering the destination country;
• the UK International Data Transfer Agreement, or the UK Addendum to the European Commission's Standard Contractual Clauses;
• the European Commission's Standard Contractual Clauses; or
• certification under the EU–US and UK–US Data Privacy Framework, where the provider participates in it.

We carry out a transfer risk assessment where required, and apply additional technical measures such as encryption in transit. You can request a copy of the relevant safeguard by emailing privacy@3dvizi.com.

We keep personal data only as long as we need it. Where we can state a definite period, we have done so.

Where no fixed period is stated, we decide how long to keep data based on how sensitive it is, why we hold it, whether we can achieve the purpose another way, and any legal, accounting, or reporting requirement. Backups are held for a limited period and overwritten on a rolling basis, so deleted data may persist briefly in backups before being removed.

When personal data is no longer required, we delete it, anonymise it, or securely dispose of it.

We implement technical and organisational measures appropriate to the risk, including:

• encryption of data in transit using TLS, and encryption at rest for stored files;
• authentication handled by Amazon Cognito, so we never hold your password, with a rotating session identifier that enforces a single active session per account;
• role-based access control within organisations, and scoped API keys that can be revoked;
• a strict Content Security Policy on our website, limiting what code can run and where data can be sent;
• logging and monitoring of security-relevant events;
• least-privilege access for our own staff and contractors, granted only where needed to operate or support the Services; and
• regular patching and dependency updates.

You also have a part to play: use a strong, unique password, keep your sign-in details confidential, remove people from your organisation when they no longer need access, and revoke API keys you are not using.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We maintain procedures to detect, investigate, and respond to suspected personal data breaches.

Where a breach is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner's Office, and to any other competent supervisory authority, without undue delay and within 72 hours of becoming aware of it where feasible. Where a breach is likely to result in a high risk to you, we will tell you directly and without undue delay.

Where we act as a processor for one of our customers, we will notify that customer without undue delay after becoming aware of a breach affecting their data, so that they can meet their own obligations.

If you are in the UK, the EU, or the EEA, you have the following rights over your personal data. Many of these also apply, in similar form, elsewhere.

• Access — to be told whether we hold your data and to receive a copy.
• Rectification — to have inaccurate or incomplete data corrected.
• Erasure — to have your data deleted where there is no good reason for us to keep it.
• Restriction — to have our use of your data limited in certain circumstances.
• Objection — to object to processing based on our legitimate interests, and to object to direct marketing at any time, which we will always honour.
• Portability — to receive data you gave us in a structured, commonly used, machine-readable format, and to have it sent to another provider where technically feasible.
• Withdraw consent — at any time, where we rely on consent. This does not affect processing carried out before you withdrew it.
• Complain — to a supervisory authority, as described in "Complaints" below.

To exercise any of these, email privacy@3dvizi.com. We will respond within one month. If your request is complex, or you have made several, we may extend that by up to two further months and will tell you if we do. We may need to verify your identity first, and we will not charge a fee unless the request is manifestly unfounded or excessive.

Some rights are qualified. For example, we may be unable to delete data we must keep for tax purposes, or to defend a legal claim. Where we cannot meet a request in full, we will explain why.

If you live in California, or in another US state with comparable privacy legislation, you may have additional rights, including the right to know what personal information we collect and why, the right to access and delete it, the right to correct it, and the right not to be discriminated against for exercising those rights.

We do not sell personal information, and we do not share it for cross-context behavioural advertising as those terms are defined under California law. If you have consented to advertising cookies on our website, Google may use the resulting identifiers for measurement and remarketing; you can withdraw that consent at any time through Cookie settings in the footer, which is also how we honour opt-out preference signals such as Global Privacy Control where your browser sends them.

We do not knowingly collect or sell the personal information of anyone under 18.

To exercise these rights, email privacy@3dvizi.com. You may use an authorised agent, in which case we will ask for proof of their authority.

This section is for members of the public who encounter a 3D presentation produced with 3DVizi — either on one of our customers' websites or through a share link.

Our role. We host and serve the presentation on behalf of the organisation that created it. That organisation is the controller. We are their processor and act on their instructions, under a written contract.

What is recorded. We record that a view took place, the type of interaction, a session identifier that lasts only for that viewing session, the approximate location resolved by our content delivery network at country, region, city, and timezone level, the referring page, and the date and time. The results are shown to our customer as aggregate statistics.

What is not recorded. We do not store your IP address against these events. We do not set analytics or advertising cookies inside the viewer. We do not track you across different customers' websites, and we do not build a profile of you or sell any of this data.

Enquiry forms. If a presentation includes an enquiry form and you submit it, what you type is sent by email to the organisation that owns the presentation. We do not keep the content of your enquiry. We keep only an irreversible hash of it plus delivery information, for 92 days, so that a retried delivery cannot become a duplicate. How the organisation then uses your enquiry is governed by their privacy policy, not ours.

Cookie banners. Where our viewer is embedded in someone else's website, that website's own cookie banner and privacy policy govern the page you are on.

Exercising your rights. Contact the organisation whose presentation you viewed. If you do not know who that is, email us at privacy@3dvizi.com with the page address and approximate time, and we will help identify them and pass your request on where we reasonably can.

We do not make decisions producing legal or similarly significant effects about you by automated means alone, and we do not carry out profiling of that kind.

We do use automated checks for operational purposes — for example enforcing plan limits, detecting duplicate form submissions, rate limiting, and flagging suspected abuse. These may temporarily restrict a feature or an account. If an automated check affects you and you think it is wrong, email privacy@3dvizi.com and a person will review it.

The Services are intended for business use and are not directed at children. You must be at least 18 years old to create an account, and we do not knowingly collect personal data from anyone under 18.

If you believe a child has provided personal data to us, contact us at privacy@3dvizi.com and we will take appropriate steps to delete it.

The Services contain links to, and integrations with, third-party websites and platforms, including CAD providers, our payment processor, and sites where our viewers are embedded.

We do not control those third parties and are not responsible for their content, security, or privacy practices. When you follow a link or authorise an integration, that third party's own privacy policy applies. We encourage you to read it.

If you are unhappy with how we have handled your personal data, please tell us first at privacy@3dvizi.com. We would rather put things right directly.

You also have the right to complain to a supervisory authority.

• United Kingdom — the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113, ico.org.uk.
• EU or EEA — the supervisory authority in the country where you live, where you work, or where the issue arose. Our Article 27 representative, named in "Who We Are and How to Contact Us" above, can also receive your complaint.
• Elsewhere — your local data protection or privacy regulator, where one exists.

Complaining to a regulator does not affect any other legal remedy you may have.

We may update this Privacy Policy to reflect changes to the Services, to our providers, or to legal requirements.

When we do, we will post the updated version here and revise the "Last updated" date. Where a change materially affects how we use your personal data, we will give you prominent notice — for example by email or an in-product message — and, where the change concerns processing based on consent, we will ask for your consent again.

Previous versions are available on request from privacy@3dvizi.com.

For any question about this policy or your personal data:

3DVizi Ltd trading as 3DVizi

Stone, Staffordshire, United Kingdom

Privacy enquiries: privacy@3dvizi.com

General support: support@3dvizi.com

https://www.3dvizi.com

ICO registration number: 17372934

EU representative: S Draper