Privacy Policy

Last updated: August 2026

1. Information We Collect

We collect information to provide and improve our services. The types of information we collect depend on how you interact with Geometry Labs.

1.1 Information You Provide

  • Account Information: When you create an account, we collect your email address, username, and authentication credentials. You may also sign in via Discord OAuth or Google OAuth, in which case we receive your email address and public profile information from those providers.
  • Payment Information: If you purchase a paid subscription, our payment processor (Stripe) collects your payment card details and billing address. We do not store full credit card numbers on our servers.
  • Communication Information: When you contact us via the support form, email, or Discord, we collect the information you provide to respond to your inquiry.
  • Uploaded Files: Files you upload for conversion or processing are handled as described in Section 2.

1.2 Information Collected Automatically

  • Usage Data: We track which tools you use, conversion counts (for free tier limits), file format types, and feature interactions to operate the Service and enforce usage limits.
  • Technical Data: IP address, browser type and version, operating system, device type, referring URL, and timestamps are collected via server logs and analytics tools.
  • Cookies and Tracking: As described in our Cookie Policy, we use essential cookies and analytics services. For complete details, see our Cookie Policy.

2. How We Use Your Files

Your intellectual property is paramount. All files uploaded to Geometry Labs are:

  • Encrypted in transit via TLS 1.3 during upload and download
  • Processed in isolated, temporary environments with no persistent storage
  • Automatically deleted within 1 hour of successful processing
  • Never stored, analyzed, reviewed, or shared with any third party

We do not train machine learning models on your data. We do not mine or analyze the content of uploaded files for any purpose other than performing the requested conversion or generation.

3. Legal Basis for Processing

We process your personal data on the following legal bases, depending on your jurisdiction:

  • Performance of a Contract: Processing necessary to provide the Service you have requested, including account management, file conversions, and subscription management.
  • Consent: Where you have given clear consent, such as for marketing emails or non-essential analytics cookies. You may withdraw consent at any time.
  • Legitimate Interests: Processing for fraud prevention, information security, service improvement, and enforcement of our Terms of Service, where these interests are not overridden by your data protection rights.
  • Legal Obligation: Processing necessary to comply with applicable laws and regulations.

4. How We Share Information

We do not sell your personal information. We may share information with:

  • Service Providers: Third parties that help us operate the Service, including:
    • Supabase — Authentication and database infrastructure
    • Stripe — Payment processing (Stripe's privacy policy applies to payment data)
    • AWS (Amazon Web Services) — Cloud infrastructure and file storage (S3)
    • Google Analytics — Anonymous usage analytics
  • Legal Compliance: If required by law, court order, or governmental authority, or if we believe disclosure is necessary to protect our rights, property, or safety, or that of our users or the public.
  • Business Transfers: In connection with a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred as part of that transaction.

5. Data Retention

We retain personal data only as long as necessary to fulfill the purposes described in this policy:

  • Account Data: Retained for the life of your account plus 30 days after account deletion, unless a longer period is required by law.
  • Uploaded Files: Files uploaded for tool processing (conversions, texture generation, mesh operations) are automatically deleted within 1 hour of successful processing. User-managed content such as profile pictures or uploaded assets explicitly stored to your account remain until you remove them or delete your account.
  • Usage Data: Anonymized usage analytics may be retained indefinitely. Non-anonymized usage data is deleted 90 days after account deletion.
  • Payment Records: Retained for the period required by tax and accounting laws (typically 7 years).
  • Support Communications: Retained for 2 years after your last interaction to maintain continuity of support.

6. International Data Transfers

Mitsuki Labs is based in the Netherlands (EEA). However, to operate the Service, we use third-party infrastructure providers (such as AWS, Supabase, Google, and Stripe) that process and store data in the United States and other countries outside the EEA.

Whenever we transfer your personal data outside the EEA or UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

  • Transfers to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission.
  • Standard Contractual Clauses (SCCs) approved by the European Commission, or EU-U.S. Data Privacy Framework certification, with our third-party service providers.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including encryption in transit (TLS 1.3), encryption at rest, access controls, and regular security assessments. However, no method of electronic storage or transmission over the Internet is 100% secure. We cannot guarantee absolute security. In the event of a data breach that affects your personal data, we will notify you and relevant authorities as required by applicable law.

8. Your Privacy Rights

8.1 GDPR Rights (EEA, UK, Switzerland)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, you have the following rights:

  • Access: Request a copy of the personal data we hold about you.
  • Rectification: Request correction of inaccurate or incomplete data.
  • Erasure: Request deletion of your personal data ("right to be forgotten").
  • Restriction: Request restriction of processing under certain circumstances.
  • Portability: Receive your data in a structured, machine-readable format.
  • Objection: Object to processing based on legitimate interests or direct marketing.
  • Withdraw Consent: Withdraw consent at any time where processing is based on consent.

To exercise these rights, reach us via our contact form or Discord server. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

8.2 CCPA / CPRA Rights (California)

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) grant you the following rights:

  • Know: Request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, the business purpose, and the categories of third parties with whom we share it.
  • Delete: Request deletion of your personal information.
  • Correct: Request correction of inaccurate personal information.
  • Opt-Out: We do not sell personal information as defined under CCPA. We do not share personal information for cross-context behavioral advertising.
  • Non-Discrimination: We will not discriminate against you for exercising your CCPA/CPRA rights.

To exercise your CCPA/CPRA rights, reach us through our contact form or Discord server with the subject "California Privacy Rights Request." We will verify your identity before processing your request.

9. Children's Privacy

The Service is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us through our contact form or Discord server. If we become aware that we have collected personal information from a child under 13 without verification of parental consent, we will take steps to remove that information from our servers.

10. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to maintain sessions, remember preferences, enforce usage limits, and analyze site usage. Third-party analytics services (Google Analytics) may set their own cookies. For detailed information on the types of cookies we use and how to manage them, please review our Cookie Policy.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. For significant changes, we will also notify you via email (if you have an account) or through a prominent notice on the Service. We encourage you to review this Privacy Policy periodically.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact the Data Controller:

Data Controller: Mitsuki Labs
KvK Number: 99239795
Establishment No. (Vestigingsnummer): 000064335836
VAT ID: NL005377046B56
Address: Wethouder van Rooijenweg 8, 3991 DP Houten, Netherlands
Privacy Email: [email protected]
Contact Form: geometrylabs.com/contact
Community Discord: discord.gg/eBpS5rtRar