Privacy policy.

This policy explains what personal data Bake3D collects, why, and what happens to it. Short version: we keep what we need to run your account and your jobs, we do not sell it, and we do not train on your content.

What we collect

• Account data: email, name (starts as the part of your email before the @ until you change it), short-lived magic-link tokens, plan, credit balance. Accounts created before September 2026 may also hold a hashed password.
• Content: images you upload, and the meshes, rigs, animations and text prompts generated from them.
• Billing: handled by Stripe. We store a Stripe customer id and invoice metadata, never card numbers.
• Usage: job logs (timings, stage, credits, errors), API request counts, and standard server logs with IP address and user agent, kept for 30 days.

Why

To provide the service, bill you, prevent abuse, and improve reliability. Legal bases under GDPR: performance of contract, legitimate interest (security, diagnostics), and consent where you opt in to product emails.

Where it goes

• Cloudflare hosts the application, database (D1), file storage (R2) and queues.
• GPU compute subprocessors run the geometry and rigging stages; they receive the image and intermediate files for the duration of a job and do not retain them.
• Model-inference subprocessors run the vision and motion stages; they receive rendered images, skeleton descriptions and your motion prompts. None of it is used for training under our contracts. We can name the current subprocessors on request.
• Stripe for payments; Resend for transactional email.

We do not sell personal data and do not use advertising trackers. Our analytics are aggregate and cookie-free.

Retention

Projects stay in your account until you delete them; deleted assets are purged from storage within 30 days. Closing your account deletes personal data within 30 days except invoices, which tax law requires us to keep.

Your rights

You can export or delete your data from the account page. You may also ask us to access, correct, port or erase your data, or object to processing, by emailing hello@bake3d.ai. If you are in the EU/EEA you may complain to your local supervisory authority.

Cookies

We set one session cookie for authentication and one for CSRF protection. No third-party cookies.

Children

The service is not directed at children under 16 and we do not knowingly collect their data.

Changes

We will post changes here and email account holders about material ones.