ImageToSTL Privacy Policy
Last updated: October 15, 2026
Version: 2026-10-15
For new users, this version applies from publication. For existing users, material changes take effect only after the notice period described in Section 11. Processing that requires consent begins only after that consent is obtained.
1. Who controls your data
Kerwin, an individual operating ImageToSTL.dev in China, is the controller responsible for personal information processed through this website and Service ("ImageToSTL," "we," "us," or "our").
Privacy, support, and data-rights requests can be sent to support@imagetostl.dev.
2. Information we collect
We collect only information reasonably needed to operate, secure, support, and bill for the Service:
- Account information: email address, display name, account identifier, profile image, authentication-provider identifiers, and sign-in records. If you use email-and-password sign-in, we also store a password hash and password-reset verification records, rather than your plain-text password.
- User content: uploaded source images, prompts, revision instructions, generated four-view images, 3D models, textures, printable files, and related project metadata.
- Usage and entitlement data: generation requests, selected AI model, job status, credit debits and returns, download unlocks, subscription tier, feature usage, and support history.
- Transaction information: order number, purchased product, price, currency, payment status, refund status, billing email, and payment-provider identifiers. Complete card numbers and card security codes are processed by Waffo Pancake and are not stored on our servers.
- Technical and security data: IP address, browser and device information, timestamps, request logs, error records, fraud signals, and cookies or similar identifiers used for authentication, preferences, security, and optional analytics.
- Communications: messages and files you send to customer support, privacy, legal, copyright, or content-safety channels.
Please do not upload sensitive personal information that is unnecessary for creating your model.
3. Purposes and legal bases
The bases below apply where recognized by applicable law. Where consent is required, it is obtained according to the relevant local requirements.
| Purpose | Relevant data | Legal basis |
|---|---|---|
| Create and secure accounts; generation, preview, storage, and delivery | Account details, inputs and outputs, tasks and entitlements | Contract performance |
| Billing, credits, subscriptions, refunds, and billing support | Transactions, credit and entitlement usage | Contract performance; legal obligations for required records |
| Support and data-rights requests | Contact details, messages, related account or project information | Contract, legitimate interests, or legal obligations, depending on the request |
| Necessary billing, security, and Service-change notices | Contact details and event records | Contract, legitimate interests, or legal obligations |
| Security, fraud prevention, content safety, and Terms enforcement | Technical logs, inputs and outputs, account and usage records | Legitimate interests in protecting users and the Service; legal obligations |
| Troubleshooting and Service reliability | Necessary error records and aggregate usage | Legitimate interests in maintaining the Service |
| Google Analytics site measurement | Browser, page-access, and usage data with your permission | Consent |
| Marketing email, if separately enabled | Email address and marketing subscription choice | Separate consent |
| Tax, accounting, consumer protection, and regulatory requirements | Necessary transaction, support, and compliance records | Legal obligations |
You may withdraw consent for future processing without affecting prior lawful processing. Declining optional analytics or marketing does not affect core services. ImageToSTL does not use your inputs or outputs to train AI models without separate, explicit consent.
4. Your content and AI processing
We process the images, prompts, revision instructions, model files, and settings you submit to generate, modify, store, preview, and deliver the results you request. Processing is limited to the information needed for the relevant feature and necessary safety or support operations.
Inputs and outputs may undergo automated safety screening. Authorized personnel may review relevant content as necessary to troubleshoot a problem, respond to your support request, or investigate a reported violation.
Where necessary to carry out these purposes, we may provide relevant information to authorized processing services subject to confidentiality and data-protection obligations, or disclose information as required by law. We do not sell your personal information or use non-public projects in public advertising.
5. Cookies, analytics, and marketing choices
| Type | Purpose and controls |
|---|---|
| Necessary cookies or local storage | Sign-in, sessions, security, and saving privacy choices; browser controls are available, but disabling may affect core features |
| Preference storage | Language and interface settings; change through the interface or by clearing browser storage |
| Optional analytics | Google Analytics measures page visits and site use; loads only after explicit permission, which you may decline or withdraw |
Google Analytics may use cookies and identifiers and receive page URLs, device and browser details, network information, and interaction data. We do not intentionally send passwords, source images, model files, or prompts to analytics. See the Google Privacy Policy and partner-site explanation.
When analytics is configured, choose Necessary cookies only or Allow analytics cookies, and use Privacy choices on the page to change your selection anytime. Withdrawal stops subsequent analytics loading and clears analytics cookies accessible to this website. It does not automatically erase data already sent; deletion may be requested separately. The Google Analytics opt-out add-on is another available control.
Creating an account does not automatically subscribe you to marketing email. If marketing email is sent in the future, it requires separate consent and an email unsubscribe method. You may also withdraw marketing consent through support@imagetostl.dev. Unsubscribing does not stop necessary billing, security, password-reset, or policy-update notices.
6. Retention
These periods describe operational and deletion arrangements. File-access periods and underlying retention are distinct; access expiry does not itself mean immediate physical deletion:
| Data | Retention and end-of-period action |
|---|---|
| Account details and sign-in credentials | While active; deleted or anonymized within 30 days of a verified deletion request, except required records |
| Source images, generated views, and project history | History access: 30 days for Free and Hobby, 180 for Creator, 365 for Studio; deletion within 30 days after the applicable period expires or a deletion request is approved |
| Archived model files | Normally retained for 90 days and deleted after expiry; temporary formats may expire earlier, as shown in the interface |
| Orders, payments, refunds, and tax records | Up to 7 years; longer where required by law or an unresolved dispute |
| Support, privacy, and safety reports | Up to 2 years after resolution, except records needed for legal claims or serious security incidents |
| Security and application logs | Normally up to 12 months |
| Backups | Deleted or overwritten through backup cycles, normally within 30 additional days |
At the end of retention, data is deleted or anonymized. Legally retained records have restricted purposes and access. Necessary records may be kept to resolve disputes, prevent fraud, or preserve legally required evidence, without extending ordinary use of unrelated content.
7. Your data rights and account deletion
Depending on applicable law, you may have the right to:
- be informed about how we process your information;
- access and obtain a copy of your personal information;
- correct inaccurate or incomplete information;
- request deletion of your account, uploaded images, generated assets, and other personal information;
- restrict processing in certain circumstances;
- receive portable data in a commonly used machine-readable format where applicable;
- object to processing based on legitimate interests or direct marketing;
- withdraw consent for consent-based processing;
- lodge a complaint with your local privacy or data-protection authority.
To exercise a right or close your account, email support@imagetostl.dev from your registered email address. Use the subject Data Rights Request or Delete My ImageToSTL Account, state the right you want to exercise, and identify the account or project involved. We may request reasonable information to verify identity and prevent unauthorized deletion.
We will acknowledge the request and normally respond within 30 calendar days. If a request is unusually complex or numerous, we may extend the period where permitted by law and explain the reason. Account deletion removes access and schedules account content for deletion, but transaction, fraud-prevention, safety, and legal records may be retained for the periods described above.
8. Security
We use reasonable technical and organizational safeguards, including encryption in transit, password hashing, account access controls, and security logging. Content delivery may use object links; someone holding such a link may directly access the corresponding file. Avoid unnecessary sensitive information and share file links carefully.
No network or storage system can guarantee absolute security. Where a breach must legally be reported, we notify regulators according to applicable law. Where GDPR applies and reporting is required, notification follows without undue delay and, where feasible, within 72 hours of awareness. Where affected users must be notified, we do so without undue delay and explain the impact and response.
9. International transfers
The operator is in China, while account databases and file storage are primarily in the United States. Site delivery, security, payment, sign-in, and AI services may operate in other processing locations. Your information may therefore cross borders into jurisdictions with different protection regimes.
For international processing, we take the measures required by applicable law, such as obtaining necessary consent, carrying out required assessments, or using applicable transfer safeguards. You may contact support for information about processing locations and safeguards relevant to your information.
10. Children's privacy
The Service is intended only for people aged 18 or older. We do not knowingly create accounts for children or knowingly collect personal information directly from children. Images depicting minors may be uploaded only by an adult who has the legal authority and consent required to process them. Any sexualized, exploitative, abusive, or otherwise child-unsafe content is strictly prohibited.
If you believe a child has provided personal information or that child-unsafe content is present, email support@imagetostl.dev immediately with the subject Urgent Child Safety Report. We will investigate and delete or preserve/report information as legally required.
11. Changes to this Policy
We update this Policy when our services, data practices, or legal obligations change. Material changes are announced through the Service or your registered email at least 15 days before taking effect, with an updated date, except where urgent legal or security requirements need an earlier change, with notice as soon as practicable. Continued use does not replace separate consent where consent is required.
12. Contact
- Service and data controller: Kerwin, individual operator of ImageToSTL.dev
- Country of operation: China
- Privacy and support email: support@imagetostl.dev
- Service hours: requests accepted 24 hours a day, 7 days a week; responses generally within 48 hours, with Section 7 deadlines applying to data-rights requests
- Website: https://imagetostl.dev
Version history: Version 2026-10-15 simplifies the content-processing and international-transfer explanations and consolidates the policy structure.
© 2026 ImageToSTL.dev. All rights reserved.