Privacy policy

This policy explains what personal data Sleipner processes, why, who helps us, how long we keep it and what your rights are. It covers 3d.sleipner.ai (with its API and MCP server), sleipner.ai, design.sleipner.ai and the Sleipner 3D app for Shopify.

The short version

• We collect what we need to run the service: your email address, what you make, your credits and payments, and how the site is used.
• To make an object, we send your description and any photos or reference images you upload to the AI providers that build it. Your uploads stay private to your account.
• Your files and our database are stored in the EU. Some of the companies that help us are in the US or the UK, and some AI model makers we reach through them are in the US or China; see Transfers outside the EU.
• Analytics in your browser only if you choose Accept. Before that, and after Decline, your browser sends nothing to our analytics.
• Marketing email only if you turn it on. No tracking pixels in our emails.
• We don't sell your data, don't use it for advertising and don't train AI models on it.
• You can see, correct, download or delete your data: write to [email protected].

Who is responsible

The controller of your personal data is Sleipner, the business behind 3d.sleipner.ai, based in Sweden (contact: [email protected]). The legal entity's registered name and details will be added here.

We have no data protection officer: the GDPR (article 37) doesn't require one for a business of our size and kind. Write to the address above about anything in this policy.

What we collect and why

For each kind of data: what it is, why we use it, and the legal basis under the GDPR, article 6(1): contract (b), legal obligation (c), legitimate interest (f) or consent (a).

Your account and signing in

• What: your email address; the six-digit sign-in code we email you (valid for 10 minutes); your sessions (when each started, and the IP address and browser of the device); when your account was created.
• Why: to create your account, sign you in and keep you signed in across Sleipner's sites.
• Abuse limits: we limit how often sign-in codes can be asked for, per email address and per IP address. These counts are stored only as one-way hashes and deleted after 2 days. Other limits (for example on the API) are counted in memory only.
• Legal basis: contract; abuse limits, legitimate interest in keeping the service secure.
• Where you found us: if the link you arrived by had a short tag (for example ?ref=peek-sideproject, the same for everyone who clicked that link), we keep that tag with your account when you sign up and add it to the sign-up event in our analytics. The page holds it in memory only until you sign in or close the tab: no cookie, nothing stored in your browser. Legal basis: legitimate interest in knowing which places bring people to Sleipner. You can object at any time.

What you make

• What: the descriptions (prompts) and change instructions you write; photos you upload, with the size and notes you give; reference images you add (or the link we fetch one from); the objects we make for you (3D files, textures, renders and previews); and records of each job (its steps, status, timing and what the AI providers charged us).
• Why: to make, change, store and show your objects, let you download them, refund failed jobs, and find and fix problems.
• Legal basis: contract; fixing problems and keeping costs in check, legitimate interest.

Only upload images you have the right to use. Photos and reference images are stored privately with your account and used only to make your object. Before a job starts, an AI check looks at your description and any uploaded images for what our terms don't allow (for example someone else's protected character or logo, an identifiable person, or explicit content) and stops the job if it finds any; nothing is charged. Objects made from your uploads are never shared publicly. Photos should not show people; if they do, we process those people's images only to make your object.

People at Sleipner look at your objects or job records only when needed: to fix a failed job, answer your questions, or deal with a report or abuse. We don't use your descriptions, photos or objects to train AI models.

Sharing with the community

If you choose to share an object with the community (a lower price, see the Terms):

• What is published: the object, its renders, a title, description, category and tags we generate, the date, and the display name you chose (or nothing, if you stay anonymous). Your description (prompt) is published only when our review finds no personal data in it.
• The review: an AI model (Google Gemini, through Runware) looks at the object's renders and its description to check quality, safety, rights and personal data. A person at Sleipner looks when the AI is unsure or the object is reported. We keep the review's result, its reasons and who decided for as long as the object exists, to handle complaints and repeated abuse.
• Reports: when you report a model, we keep the reason and your note; if you are signed in, your account id, and if not, a one-way hash of your IP address, so one person counts once. Kept as long as the shared object exists.
• Legal basis: publishing and reviewing a shared object, contract; reports and abuse checks, legitimate interest in keeping the library safe and lawful.
• Stop sharing on the object's page takes it offline at once; so does deleting the object or your account.
• Others building on it: while it is published, other users can ask for a change of it or make something "in its style" (its renders guide their new object). Their object is theirs and links back to your model's page, with your display name if you chose one. We store only a link to the public page, never your account; the name is looked up live, so when the model goes offline the link and the name go too.

The library

• What: the models you save to "My library", the files you download (model, format and detail level), and your download preferences.
• Why: to show your saved models, remember your preferred format, and know which models people use.
• Legal basis: contract; download statistics, legitimate interest.

Credits, codes and payments

• What: your credit balance and every change to it (free credits, purchases, spending, refunds); the free-credit codes you redeem (which code, how many credits, when); and for each purchase, the pack, the amount, the currency, refunds and disputes, and Stripe's references for the payment and for you as a customer.
• Stripe handles the payment itself: it receives your card or other payment details and your email address. We never see your card details.
• Email: a "credits added" confirmation after each purchase; Stripe sends the receipt.
• Why: to sell and add credits, stop a code being used twice, handle refunds and disputes, and keep our accounts.
• Legal basis: contract; accounting records, legal obligation (the Swedish Bookkeeping Act, bokföringslagen).

API keys and connected apps

• What: for each API key you make: its name, a SHA-256 fingerprint of the key (never the key itself), its first few characters so you can recognise it, and when it was made, last used and revoked. For each app you connect through the MCP server (for example an AI assistant): the app's registration (name and return address), your permission, and the access tokens we issue to it.
• Why: to let the software you choose act for you, and to let you see and disconnect it.
• Legal basis: contract.

What you type into a connected app is handled by that app's provider under its own terms; we receive only the calls it makes to Sleipner.

Email

• What we send: sign-in codes, one welcome email when you create your account, a confirmation when credits are added, and, only if you turn it on, news such as "New in the library". We store whether marketing email is on or off and where you changed it.
• When an object is ready: we email you once when an object you make or change is ready, or didn't work and your credits came back, unless you watched it finish on its page. Its picture in the email loads through a private link that works only while the object exists. We store whether this email is on, when the object's page was last open while it was being made, and when we handled the email. Legal basis: contract (it is about something you asked us to make). Turn it off in your settings or with the link in the email.
• No tracking: no tracking pixels, no rewritten links; open and click tracking is off at our email provider.
• Legal basis: sign-in codes, welcome and purchase emails, contract; marketing email, consent. Turn it off at any time with the link in every marketing email or in the studio.

"Keep me updated"

• What: when you ask us to tell you once something we can't make yet is ready (for example animation), we store your account, which update you chose, the exact words you agreed to and their version, where and when you chose it, and, if you withdraw, when and where. We send it to your account's email address.
• Why: to email you about that one thing when it's ready, and to count how many people want each thing.
• Legal basis: consent. It is separate from marketing email. Withdraw it at any time under "My updates" in the studio, on the "Keep me updated" page, or with the link in the email.

Waitlists

• What: your email address and which waitlist you joined (today only Sleipner for Shops, on /for/shops). Nothing else.
• Why: to tell you once when that release opens. It stays in our own database until then.
• Legal basis: consent. To be removed, write to us.

Analytics

We use PostHog, in its EU cloud, to understand how the site is used and to find errors. Your browser reaches it through our own address (/ingest); we remove our sign-in cookies from those requests, and PostHog is set to discard IP addresses.

• Before you choose, and if you choose Decline: nothing is sent to PostHog from your browser, and nothing is stored on or read from your device for analytics. Our analytics code doesn't start until you choose Accept.
• If you choose Accept: PostHog sets cookies and uses your browser's storage, and records the pages you visit (the page, the page you came from, browser and screen type), clicks (autocapture), heatmaps, session recordings, page speed, errors and browser console messages. In recordings, everything you type and your email address are hidden, and the page where you allow an app to connect is never recorded; other text on the page, such as your objects' titles, can appear. If you are signed in, PostHog links this to your account by an internal user id. It never receives your email address.
• On our servers, whatever you choose: we record events such as sign-up, sign-in, objects made, credits bought and spent, downloads and app connections, under your internal user id, and errors in our code. For calls through the MCP server we also record the tool called, how long it took, whether it worked, the app's name and the AI model, but not what was written: no descriptions, arguments, results or reasons. These never include your email address or IP address.
• Legal basis: server events, legitimate interest in running, securing and improving the service; everything your browser sends after Accept, consent. Change your choice at any time with Privacy choices at the bottom of every page.

Security and running the service

• What: every request passes through Cloudflare (which protects and speeds up the site) and our server. Our web server logs each request: time, address requested, IP address and browser.
• Legal basis: legitimate interest in a secure, working service.

When you contact us

• What: your emails to us and our answers. Our email is hosted by Google Workspace.
• Why: to answer you. Legal basis: legitimate interest, or contract if it is about your account.

The Sleipner 3D app for Shopify

The app is not public yet. This section applies to shops that install it.

• What Shopify lets the app see: your products and files only (Shopify's write_products and write_files permissions), to read product photos and titles and add the 3D model to the product. No access to your customers, orders or payments.
• What we keep: your shop's myshopify address; your Shopify session, including the access token Shopify gives the app (encrypted); the Sleipner API key you connect (encrypted); install and uninstall times; and for each model made for a product: the product's id and title, the photos chosen (their Shopify ids, a thumbnail link and which side they show), the size you typed, any note, its status, and the id of the file it was published as and when. Stored in our database in Germany.
• Photos: the photos you choose are sent to Sleipner 3D and stored in the Sleipner account whose key you connected, like any other photo job (see What you make); for accurate product models they also go to fal.ai. Use product-only photos where you can.
• Your customers: the app doesn't collect any data about your store's customers. Shopify's customer data requests are answered with "nothing stored".
• Deletion: uninstalling deletes the app's sessions at once. When Shopify asks us to delete the shop's data (48 hours after uninstall), we delete the stored key, sessions and model records. Models you published stay on your products, and objects and photos in your Sleipner account stay until you delete them there.
• Legal basis: contract with the merchant. Shopify is a separate controller of your store's data; its own privacy policy applies.

Who helps us

These companies process personal data for us as processors, under data processing agreements, except where we say otherwise. Each entry: who, where, what they do and what they receive, and the safeguard when data leaves the EU (see Transfers outside the EU).

• Hetzner Online GmbH, Germany. Our servers, database and database backups, in Falkenstein, Germany. Stays in the EU.
• Cloudflare, Inc., USA. Carries every request to our sites (protection and speed) and stores files in Cloudflare R2, set to the EU jurisdiction: your photos, reference images and objects. Safeguard: EU-US Data Privacy Framework, and standard contractual clauses.
• Runpod, Inc., USA. Runs our GPU generation worker in a data centre in Romania: for each job it receives your description and photos, makes the object and deletes its working copy afterwards. Safeguard: standard contractual clauses.
• Runware Ltd, United Kingdom. Runs the AI models that check requests and make objects. It receives your descriptions, change instructions, photos and reference images, and pictures and models made from them. Its servers are in Germany, Romania and the US. Some models are run by their makers, who may then receive the request too, such as Google (Gemini: checks, titles and reviews), OpenAI (concept pictures), Tripo (VAST) and Tencent (Hunyuan 3D) (3D shapes). Runware says it never uses API data to train models. Safeguard: the EU's adequacy decision for the UK; standard contractual clauses for the US.
• fal.ai (Features & Labels, Inc.), USA. Only for accurate product models: it receives your product photos and the measured size and passes them to the 3D models of Tripo, Hitem3D and Hyper3D (Rodin), which run with their makers. We ask fal not to store requests; pictures uploaded to its file storage are kept for a limited time. Safeguard: standard contractual clauses.
• PostHog, Inc., USA. Analytics, session recordings and error tracking, stored in its EU cloud in Frankfurt; PostHog may also process data in the US. Safeguard: EU-US Data Privacy Framework, and standard contractual clauses.
• Resend (Plus Five Five, Inc.), USA. Sends our emails from Ireland; it keeps a log of sent emails (recipient, subject, delivery) for 30 days, in the US. Safeguard: EU-US Data Privacy Framework, and standard contractual clauses.
• Google Cloud EMEA Limited, Ireland (Google Workspace). Our own mailbox, if you write to us. Safeguard for Google's US processing: EU-US Data Privacy Framework, and standard contractual clauses.
• Stripe Payments Europe, Limited, Ireland. Takes payments when you buy credits. Stripe is our processor for the payment, and a separate controller for its own fraud prevention, anti-money-laundering and legal duties (Stripe's privacy policy). Safeguard for Stripe's US processing: EU-US Data Privacy Framework.
• Shopify (merchants using the app only): a separate controller of your store's data, under its own privacy policy.

We don't sell personal data and don't share it with advertisers. We may disclose data when the law requires it, to protect our rights or users' safety, or to a company that takes over Sleipner (we would tell you first).

Transfers outside the EU

Our database, your files and the generation worker are in the EU. Some data leaves the EU and EEA:

• To the UK (Runware): covered by the EU Commission's adequacy decision for the UK.
• To the US (Cloudflare, PostHog, Resend, Google, Stripe): these companies are certified under the EU-US Data Privacy Framework (dataprivacyframework.gov), and their agreements also include the EU Commission's standard contractual clauses. Runware's US servers, Runpod and fal.ai are covered by standard contractual clauses in their agreements.
• To the AI model makers behind Runware and fal.ai (Google, OpenAI, Tripo, Tencent, Hitem3D, Hyper3D): they receive requests under Runware's and fal's own agreements with them. We have no direct contract with them and can't confirm where each one processes data; some of them are based in the US or China.

Write to us for a copy of the safeguards.

How long we keep it

• Your account, objects, photos, reference images, saved models and download history: as long as your account exists. To delete an object or your account, write to us from your account's address; we do it within a month, usually the same day. Doing it removes the data from our database, file storage and analytics; backups follow as they expire.
• Sessions: a session lasts 7 days from your last visit, or until you sign out. The record of a session that expired without a sign-out can stay with your account until the account is deleted.
• Sign-in codes: 10 minutes. Abuse-limit counts: 2 days.
• App access tokens: 1 hour; refresh tokens 30 days, or until you disconnect the app.
• Purchases and the credit ledger: 7 years after the end of the year they relate to, as the Bookkeeping Act requires, even if you delete your account (the rest of the account is deleted).
• Community reviews and reports: as long as the object exists.
• Marketing email and "Keep me updated" choices: as long as your account exists, so we keep respecting them.
• Waitlists: until we have told you the release is open; then deleted.
• Server logs: overwritten once they reach a fixed size (normally within weeks), and kept up to 7 days longer in server backups.
• Analytics: session recordings 30 days; other analytics events and errors 1 year.
• Backups: our database is backed up every night. Backups are kept for up to 30 days; deleted data disappears from them as they expire.
• The Shopify app: see its section.

Your rights

Under the GDPR you have the right to:

• access your data and get a copy of it;
• correct data that is wrong;
• delete your data, unless we must keep it (for example accounting records);
• restrict how we use it while a question about it is being settled;
• data portability: get the data you gave us in a common, machine-readable format;
• object to processing based on our legitimate interest, and to direct marketing at any time;
• withdraw your consent at any time, without affecting what was done before: Privacy choices for analytics, the unsubscribe link or the studio for marketing email, "My updates" in the studio for "Keep me updated".

Write to [email protected] from your account's email address, so we know it is you. We answer within one month, free of charge.

Do you have to give us your data?

You need an email address to have an account, and we need your description or photos to make an object; without them we can't provide the service. Everything else is optional: analytics cookies, marketing email, "Keep me updated", waitlists, a display name and sharing.

Automated decisions

Our pipeline uses AI to choose the best result among several attempts and to check quality. Before you make something, an AI check compares your description with what we can make and may say we can't guarantee it or can't make it yet; you can still go ahead, except for what our terms forbid. AI checks also decide whether an uploaded image is within our terms; a refused request is not charged, and you can change it and try again. When you share an object, an AI model reviews it first and may decline to publish it; a person looks whenever the AI is unsure or a model is reported, and you can ask us to look again. These decisions are about the object, not about you, and have no legal or similarly significant effect on you (GDPR article 22).

Cookies

We use only these cookies, all on .sleipner.ai:

• Sign-in (__Secure-sleipner.session_token and related cookies from our sign-in system): keep you signed in. Strictly necessary; set when you sign in.
• Your privacy choice (sleipner_consent, 1 or 0): remembers whether you chose Accept or Decline, so one choice covers all of Sleipner's sites. Strictly necessary.
• Your currency (sleipner_currency, usd, eur or sek): remembers the currency you picked for prices, for a year. Set only when you pick one; strictly necessary for showing what you asked for. Without it we show prices in your country's currency, worked out from the country Cloudflare reports for your connection; we don't store that country.
• Analytics (ph_…_posthog, and PostHog's data in your browser's storage): only after you choose Accept. Removed if you later choose Decline.

No advertising cookies or trackers. Change your choice at any time with Privacy choices at the bottom of every page.

Children

Sleipner is not meant for children under 13, and we don't knowingly collect their data. If you believe a child under 13 has given us personal data, write to us and we will delete it.

Security

Encrypted connections (HTTPS); files stored privately in the EU and shared only through links that expire; API keys stored only as fingerprints; the Shopify app's tokens and keys encrypted; servers closed to the internet behind a firewall; and access limited to the people who run Sleipner.

Changes to this policy

We update this policy when what we do changes. If a change matters to you, we tell you by email or in the studio before it applies. The date at the top shows the latest version.

Questions and complaints

Write to [email protected] with any question about your data.

You can also complain to the Swedish data protection authority, Integritetsskyddsmyndigheten (IMY), Box 8114, 104 20 Stockholm, Sweden, imy.se, or to the authority in the EU country where you live or work.