Privacy Policy
What Zetta 3D collects, why, who else touches it, and what you can ask us to do with it.
Last updated
What this covers
This policy covers the Zetta 3D website, 3D Studio, Game Studio, the developer API and the MCP integrations. It explains what we hold about you, why we hold it, and how to get it changed or removed.
It does not cover the third-party tools you connect Zetta 3D to. Once an asset lands in your Blender file, your Unity project or your own storage, it is governed by whatever terms apply there.
Who we are
Zetta 3D is operated by Behzadi's Holding B.V., registered in the Netherlands at Vlamingstraat 4, 2712 BZ Zoetermeer, the Netherlands (KvK 74516612, VAT NL859931997B01). For the purposes of the GDPR we are the controller of the personal data described here.
Anything in this document — questions, requests, complaints — goes to legal@zetta3d.ai.
What we collect
Only what the service needs to run. In practice that is six things:
- Your account
- Your email address, and — if you sign in with Google — the display name and profile picture Google returns. We also store whether your email is verified, whether the account is a business account, your plan, your subscription status, and the date you signed up.
- Sign-in material
- Single-use, short-lived magic-link tokens, and a session cookie once you are signed in. There are no passwords on Zetta 3D, so we never hold one — not even hashed.
- What you send us
- The prompts you write and the files you attach: reference images, 3D models, PDFs and other documents you upload to guide a generation.
- What we generate for you
- The models, textures, images and other output produced from your inputs, along with the job records that tie each result to your account so you can find it again.
- Metering and billing
- Your 3D credit and AI token balances — monthly, purchased and bonus are tracked separately — what each generation consumed, your plan, and your invoices. Card details go directly to Stripe; we never receive or store them.
- Technical records
- IP address, browser and device information, timestamps, and request and error logs. These exist for security, abuse prevention and debugging.
If you create API keys or connect an MCP client, we log which key made which call, so you can audit your own usage and so we can enforce rate limits.
What we do not collect
Worth stating plainly, because it is unusual:
- No analytics or product-telemetry scripts. There is no Google Analytics, no Segment, no session recording, no heatmaps.
- No advertising cookies, no tracking pixels, and no cross-site tracking of any kind. We do not sell or rent personal data, and we do not share it for advertising.
- No passwords, because the service does not use them.
- No data brokers. We do not buy contact lists or enrich your profile from third-party sources.
If that ever changes, this section changes with it and we will say so before it takes effect.
Signing in with Google
Google sign-in is used for one thing: creating and accessing your Zetta 3D account. If you use it, Google confirms who you are and returns your name, your email address and your profile picture. That is the whole of what we ask for and the whole of what we receive.
What Zetta 3D never does, and cannot do with what you have granted:
- Read, send, delete or modify anything in your Gmail.
- Access your Google Drive files, your Calendar or your Contacts.
- Post, share or publish anything on your behalf.
- Use your Google account information to build an advertising profile, or sell it.
Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Note that this is separate from the previous section: your name, email address and profile picture are account details and are never used to train or evaluate models.
You can skip Google entirely. Choosing the emailed sign-in link instead gives us your email address and nothing else, and it reaches the same account.
Why we use it, and on what legal basis
- To run the service you asked for
- Signing you in, taking your prompt, generating the asset, storing the result, metering what it cost and billing you for it. Without this there is no product. Legal basis: performance of our contract with you.
- To keep it working and keep it safe
- Debugging failures, investigating abuse, enforcing rate limits, and preventing fraud and account takeover. Legal basis: our legitimate interests in a secure and functioning service.
- To improve the models
- Described in full in the next section. Legal basis: our legitimate interests in improving the service, and you have the right to object.
- To support you
- Answering your questions, which sometimes means looking at the job that failed. Legal basis: performance of our contract, and our legitimate interests.
- To meet our legal obligations
- Keeping invoices and records for as long as Dutch tax law requires. Legal basis: legal obligation.
If we ever send marketing email it will be separately opted into, and unsubscribing will be one click.
We use your content to improve our models
Stating this plainly, because a vague answer to this question is read as a yes anyway: your prompts, the files you upload and the assets Zetta 3D generates for you may be used to train, fine-tune and evaluate the models behind the service.
That is how the output gets better at the things our customers actually ask for. It is also a real trade, so here is the other side of it honestly:
- We do not sell your content, publish it, or show it to other customers.
- We do not use it to build a profile of you or to target advertising.
- Content used for model improvement is stripped of account identifiers wherever it is technically possible to do so.
- A trained model is not a copy of your file, but it is shaped by it, and that influence cannot be surgically removed after the fact. If your work is confidential or covered by a client NDA, take that into account before uploading it.
We rely on our legitimate interests for this, which means you have the right to object under Article 21 of the GDPR. Email legal@zetta3d.ai and we will exclude your content from model improvement. Objecting does not degrade the service and does not cost you anything.
Who else processes it
We use other companies to deliver parts of the service. Each one receives only what it needs, and each is bound by a data-processing agreement.
- AI model providers
- The generation itself runs on third-party AI models. Your prompt and any attached files are sent to those providers to produce the result. We will name them on request.
- DigitalOcean
- Our cloud infrastructure, including the object storage and CDN that hold your uploads and generated assets. Everything runs in their Amsterdam region.
- If you use Google sign-in, Google confirms your identity and returns your email address, name and profile picture. Google also serves the site’s typefaces — see the note above.
- SendGrid
- Sends your sign-in links and account email, and therefore sees your email address and the contents of those messages.
- Stripe
- Handles subscriptions and credit purchases. Stripe holds your payment details; we hold the invoice and the plan.
We will also disclose data where the law requires it, and to our accountants and professional advisers where necessary. If the business is ever sold or merged, account data would transfer with it, and we would tell you before that happened.
Where it goes
Your account data, your uploads and your generated assets are stored and processed in Amsterdam, in the European Union.
Some of the companies above are established in the United States, so certain data reaches them there. Where a transfer leaves the European Economic Area it relies on the European Commission’s Standard Contractual Clauses, or on an adequacy decision including the EU–US Data Privacy Framework where the recipient is certified under it. Ask us and we will tell you which applies to which.
How long we keep it
- Your account and content
- For as long as your account is open. After you delete it, your prompts, uploads and generated assets are removed within 30 days, apart from anything we are required to keep.
- Technical and security logs
- Kept for 12 months, then deleted.
- Invoices and accounting records
- Kept for 7 years, because Dutch tax law requires it. This one we cannot shorten on request.
- Backups
- Deleted content persists in encrypted backups for up to 30 days before those rotate out.
If you cancel rather than delete, we keep your assets so you can come back — see the Terms for how long a cancelled or dormant account is kept.
Your rights
Under the GDPR you can ask us to:
- Give you a copy of what we hold about you, in a portable format.
- Correct anything that is wrong.
- Delete your account and its content.
- Restrict or object to a particular use — including, specifically, the use of your content to improve our models.
- Withdraw consent where consent is what we relied on.
Email legal@zetta3d.ai and we will respond within one month, which is the deadline the GDPR sets. We will not charge you for it and we will not make the service worse because you asked.
If you are not satisfied with how we handled your request, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or to the authority where you live.
Deleting your account is not reversible, and it takes your generated assets with it. Export anything you want to keep first.
How we protect it
Traffic is encrypted in transit and data is encrypted at rest. Sign-in links are single-use and expire quickly. The session cookie is httpOnly, so a script injected into a page cannot read it, and sessions can be revoked. Access to production data is limited to the people who need it.
No system is perfectly secure, and we would rather say so than imply otherwise. If a breach affects you we will tell you, and we will notify the Autoriteit Persoonsgegevens within 72 hours as the GDPR requires.
Age
You need to be at least 16 to hold a Zetta 3D account — the age the Netherlands sets for consent to online services. If we learn that an account belongs to someone younger, we will delete it.
Changes to this policy
When we change something material we will update the date at the top and email account holders at least 30 days before it takes effect. Continuing to use Zetta 3D after that means the new version applies.
Contact
legal@zetta3d.ai, or by post to Behzadi's Holding B.V., Vlamingstraat 4, 2712 BZ Zoetermeer, the Netherlands.