Privacy Policy

1. Data we collect

• Identification: name and email address, when you create an account. If you sign in with Google, Google provides us with your name and email.
• Your content: the 3D models, images and other files you upload, and the results you generate (images, renders, 3D models and videos). It may contain personal data if people or identifying information appear in it.
• Photos of real people (avatars and references): if you upload photos showing people, we use them only to generate the result you ask for; we do not use them to identify anyone and we create no biometric data. You provide them with the permission of the person shown (see Terms). In the avatar creator we keep, as proof of your confirmation, the date, the accepted text and your IP address.
• Education data: if you use a student licence or a classroom, the institution or classroom you belong to and the credits you spend. The teacher who manages the classroom sees your name, email, credits used and your activity within the course.
• Usage and technical data: IP address, browser, operating system, pages visited, date and time of access and activity logs. We also use cookies, as explained in section 11.
• Payments: Stripe handles your card details and we never see them in full. We keep the amount, date, payment status, tax breakdown and, where applicable, the last four digits of the card, for invoicing and fraud prevention. If you buy as a business, your company name, tax ID and billing address.
• What you write to us: the content of the support or feedback messages you send us, including any screenshots you attach.

2. Why we use your data and on what legal basis

• Providing the service and managing your account (creating your profile, signing in, generating and storing your results): performance of the contract.
• Processing your content with AI (generating images, renders, 3D models and videos from your files): performance of the contract.
• Education licences and classrooms (creating classrooms, distributing credits and showing the teacher the usage of their classroom): performance of the contract with the institution or the teacher.
• Payments and invoicing (charging you and keeping the records required by tax and accounting law): performance of the contract and legal obligation.
• Service communications and support (purchase confirmations, important notices, replies to your questions): performance of the contract and legitimate interest.
• Analytics and service improvement (aggregated usage statistics): legitimate interest; for analytics cookies, your consent.
• Commercial communications: the newsletter only if you subscribe to it on the website (consent). If you are already a customer, we may send you news about our products similar to those you purchased (art. 21.2 of the Spanish LSSI); you can unsubscribe in every email.
• Security and fraud prevention (detecting unauthorised access, malicious automation or uses contrary to the Terms): legitimate interest.
• Legal obligations (responding to requests from authorities and tax obligations): legal obligation.

If we wanted to use your data for another purpose, we would tell you first and, where required, ask for your consent.

3. We do not train AI with your content

Neexis Render does not use your files or your results to train AI models, neither our own nor third parties'.

To generate images, renders, 3D models and videos we send your files to external AI model providers, only to obtain the result (inference). We work only with providers whose paid terms prevent them from training on your data. Some keep requests for a limited time to detect abuse and then delete them; what each one keeps is detailed in section 4.

4. Who we share your data with

We do not sell your data. The following providers process it on our behalf, and only for what we ask them to do:

• Google Cloud (hosting and storage): your account, files and results are stored in Google's data centres in the European Union (europe-west9 region, Paris). They do not leave the European Economic Area.
• Google (Gemini and Veo AI models): image, render and video generation and editing. We use Google's paid APIs, whose terms prohibit training their models on your content; Google may keep requests for a limited period to detect abuse. It may process data in the United States; transfers rely on the EU-US Data Privacy Framework and Standard Contractual Clauses.
• fal.ai (Features & Labels, Inc., San Francisco, USA): platform through which we run certain third-party image-editing models (currently Ideogram). We send the image and mask inside the request itself and ask fal.ai not to keep either the request or the result; anything stored transiently expires within minutes. It acts as a processor under its data processing agreement, which limits use of the data to providing the service. Transfers to the US rely on Standard Contractual Clauses.
• Scenario (Scenario Inc., Covina, California, USA): platform through which we run third-party 3D generation models (Tripo, Meshy, Hunyuan), video models (Seedance, MiniMax) and image models (GPT Image, Recraft, Ideogram, Photoroom, Topaz), plus its own retouching, upscaling and 360 environment models. Scenario is a pass-through: we send files only to obtain the result and delete them there as soon as the generation finishes. If you request your 3D model in another format (OBJ or FBX), we upload it temporarily to convert it and delete it afterwards. It is certified under the EU-US Data Privacy Framework and applies Standard Contractual Clauses.
• Stripe (payments): charging plans and credits; it processes your card details and billing address. EU and US; certified under the EU-US Data Privacy Framework.
• Billin (electronic invoicing, Spain): issuing and keeping our invoices. It processes the tax details shown on them (name or company name, tax ID and address) and keeps them for the periods required by tax law.
• Google Workspace (email): service emails (purchase confirmations, invitations, security notices) are sent from our own Google Workspace mailbox. Certified under the EU-US Data Privacy Framework.
• Brevo (newsletter): the newsletter and the commercial communications you have subscribed to; it processes your email, name and language. European Union.
• HubSpot (contact management; USA): commercial follow-up of accounts (name, email, subscription status) and workshop sign-ups. Certified under the EU-US Data Privacy Framework.
• Cloudflare (delivery network and protection; USA): website and editor traffic passes through its network, which processes IP addresses and technical connection data to serve content and block attacks. Certified under the EU-US Data Privacy Framework.
• Analytics and advertising (Google Analytics, Google Ads, Meta): measuring usage and campaigns, only if you accept those cookies. USA; EU-US Data Privacy Framework. Plausible (European Union) measures website visits without cookies.
• Error monitoring: technical errors on the platform are logged in a system we host ourselves on Google Cloud; no third party is involved.

With each of them there is a data processing agreement (art. 28 GDPR) or equivalent terms of service. When a provider processes data outside the European Economic Area, the transfer relies on the EU-US Data Privacy Framework or, if the provider is not certified, on the European Commission's Standard Contractual Clauses. You can request the up-to-date list at hola@neexisrender.com. We may also disclose data to public authorities when the law requires it.

5. Minors

Neexis Render is only for people aged 18 or over. We do not allow minors to register and do not knowingly process their data: if we detect an account belonging to a minor, we delete it together with its data.

6. Your rights

Under the GDPR you have the right to:

• Access: know which data we hold about you and receive a copy.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask us to delete your data when it is no longer needed, you withdraw consent or the processing is unlawful.
• Restriction: ask us to stop using your data temporarily in certain cases.
• Portability: receive your data in a structured, commonly used format and take it to another controller.
• Objection: object to processing based on legitimate interest and to direct marketing at any time.
• Withdraw consent: for cookies or marketing, without affecting prior processing.
• Not be subject to automated decisions: we make no automated decisions with legal or similar effects about you.

To exercise them, write to hola@neexisrender.com from your account email. We may ask you to prove your identity. We will reply free of charge within one month, extendable by two more in complex cases. You can also complain to the Spanish Data Protection Agency (www.aepd.es).

7. How long we keep your data

• Account and preferences: while the account is active.
• Files and results: while the account is active. What you delete goes to a trash from which you can restore it; permanent deletion happens when you close your account or when you ask us.
• Photos of real people: not kept once the result has been generated.
• Invoicing: between 4 and 6 years, as required by tax or commercial law.
• Security logs (sign-ins, failed attempts): 90 days.
• Newsletter and commercial communications: until you unsubscribe.
• Backups: we make encrypted backups of the database every day, kept for 35 days, and a monthly copy kept for 5 years. Deleted data may remain in those backups until they expire; they are not used to restore individual accounts.

During legal retention periods the data is blocked: it is only used if a judge or an authority requests it (art. 32 LOPDGDD). Afterwards we delete or anonymise it.

8. Security

We apply technical and organisational measures to protect your data:

• TLS encryption in transit and AES-256 at rest, including your files and results.
• Each user's files are only accessible from their own account: every download checks the session and the owner of the file.
• Sessions expire automatically and you can close them from your account on all devices.
• Sign-in attempt limits and security event logging.
• Encrypted backups in a different region from the data.
• The team accesses systems with named accounts and only what they need.

If a security breach puts your rights at risk, we will notify the AEPD within 72 hours and you without undue delay. More details on the Security page.

9. Links to other sites

The platform may link to third-party sites. This policy does not apply to them: check each one's own policy.

10. Deleting your account

You can ask us to delete your account at any time by writing to hola@neexisrender.com from your account email with the subject "Delete account". If you have a subscription, cancel it first so it does not renew.

We will delete your files and results and anonymise the account within one month at most, and confirm it by email. Invoices are kept for as long as the law requires, and backups expire as described in section 7. After that it cannot be recovered.

11. Cookies

Cookies are small text files stored on your device so the website works, remembers preferences or measures usage.

• Necessary: essential for core functions (session, language, your cookie choice).
• Analytics: aggregated data about website usage (Google Analytics 4, loaded through Google Tag Manager) and Plausible, which measures visits without cookies. Only activated if you accept them.
• Marketing: measure the effectiveness of our campaigns and allow us to show you ads on other websites (Meta and Google Ads, loaded through Google Tag Manager). Only activated if you accept that category.

Google Tag Manager stores no information on your device by itself: it loads the tags according to the category you accepted, with all categories denied by default until you decide.

Google and Meta may process this data outside the European Economic Area; those transfers rely on the EU-US Data Privacy Framework and, failing that, on Standard Contractual Clauses.

The first time you visit, the banner lets you accept all, reject non-essential or choose by category. You can change your choice at any time under "Cookie preferences" at the bottom of every page, or delete them from your browser.

12. Contact

For any question about your data: hola@neexisrender.com. We will reply within one month at most. Include your account email so we can handle the request securely.