Privacy Policy

The controller of your data is Atovus (eenmanszaak), trading as Proppo, Nieuwstraat 110, 3732 DP De Bilt, the Netherlands (“Atovus”, “we”). For anything about your data, email support@proppo.com. More details are in our imprint.

• Account data: your email address, display name, a securely hashed password, your plan and preferences, and when you confirmed your email and accepted the terms.
• Your content: images you upload, prompts, titles and tags, the models, textures and thumbnails we create, and your likes and collections.
• Credits and billing: your credit history, jobs, plan, purchases and refunds. Stripe collects your card details, billing address and tax ID; we never see or store your full card number.
• Security data: for each signed-in session, the IP address, browser type and when it was last used. To stop people from inviting themselves for referral rewards, we also keep a one-way code of the networks you use while signed in (not the IP address itself).
• Usage statistics: cookieless page view counts, see section 5.
• Messages: what you send us by email, including reports and copyright notices.

• To provide Proppo (contract, GDPR art. 6(1)(b)): run your account, generate, store and deliver your models, manage credits and payments, and send service emails such as email confirmation, password resets and purchase confirmations.
• To publish public models (contract): Free-plan models, and models you make public, are shown on Explore.
• To keep Proppo safe (legitimate interests, art. 6(1)(f)): prevent abuse, fraud and free-credit farming, limit login attempts and secure accounts.
• To improve the site (legitimate interests): cookieless statistics about which pages are used.
• To meet legal duties (legal obligation, art. 6(1)(c)): keep tax and accounting records, and handle reports of illegal content and copyright notices.

We don't sell your data, show ads, send marketing emails or train AI models on your content (our AI provider's own use is explained in section 7).

Every model made on the Free plan is public. Its 3D preview, thumbnail, title, prompt, license, likes and downloads appear on Explore with your display name, can be found by search, and may be featured on our homepage. The same applies to models you make public on a paid plan.

Anyone can preview public models in 3D. Only signed-in users on a paid plan can download the ones marked CC BY, and they must credit you.

Your email address and the images you upload as input are never shown publicly.

• We count page views with our own first-party analytics. There are no third-party analytics or advertising scripts and no analytics cookies. Our server also sends these events to PostHog (see section 7) to analyze them; nothing from PostHog runs in your browser.
• We don't store your IP address. To count unique visitors we keep a one-way hash of your IP address and browser that changes every day, so visits can't be linked across days.
• We record the page, the referring site, campaign tags in the link, device type and country, and clicks on our main buttons. While you are signed in, these are linked to your account.
• If your browser sends Global Privacy Control or Do Not Track, no page views or clicks are counted and nothing is stored in your browser for analytics.
• When you sign up, we note which page or campaign brought you (the link's campaign tags, including utm_content and utm_term, and the ad network you came from, not the click id), and we log key account events (sign-up, log-ins, generations, downloads, purchases) with your account to run billing, prevent abuse and improve Proppo.

• One essential cookie, sid, keeps you signed in. It is httpOnly and expires after 30 days or when you log out.
• If you open a friend's invite link, a cookie, pp_ref, remembers their invite code for 30 days so we can credit the friend who invited you when you sign up. It holds only that code, is set only when you open such a link, and is deleted once you sign up. Your friend then sees your first name and how far you got (joined, confirmed your email, made a first model, made a first purchase), never your email or what you bought.
• If you confirm your email in a browser where you aren't logged in, an httpOnly cookie, pp_login_hint, keeps your email address for 10 minutes to fill in the log-in form, and is deleted when you log in.
• Your browser's local storage keeps viewer and workspace preferences. Analytics stores nothing in your browser. Only when you open the sign-up or log-in page, session storage keeps the page that brought you here for that tab (sent with your sign-up). Neither is used for tracking.
• We don't use advertising or cross-site tracking cookies, so there is no cookie banner.
• Our pages and the 3D viewer load their scripts, fonts and decoders from our own domain, not from third-party CDNs. The one exception is the sign-up check below, which Cloudflare serves.
• At sign-up, Cloudflare Turnstile checks that you are not a bot. It may read your IP address and browser signals for that check only.
• Stripe's checkout page sets its own cookies to process payments and prevent fraud.

These providers process data for us under data processing agreements, only on our instructions. Stripe is also responsible for its own processing to prevent fraud and meet its legal duties.

AI training by Meshy: under its terms for our plan, Meshy may also use prompts, input images and generated models to improve its AI. For that use Meshy decides itself and is responsible under its own privacy policy. Don't put personal data (such as photos of people or names) in prompts or images.

For providers outside the EU we use the EU Standard Contractual Clauses, and the EU-US Data Privacy Framework where the provider is certified. Email us for a copy. We update this list before we add a provider, for example if we switch to another AI generation provider.

• Account data, models and files: until you delete them or your account. Files are deleted from storage right away.
• Uploaded images that never became part of a model: deleted after at most 30 days.
• Session records (IP address, browser): until the session expires, at most 30 days.
• Network codes for the referral check: the last 20 networks you used while signed in, until you delete your account. A network not seen for 180 days is no longer checked and is dropped the next time you sign in.
• Email confirmation and password reset links: 7 days after they were used or expired.
• Page views: 400 days. Views made while signed out can't be linked to you.
• Account events (sign-ups, log-ins, generations, downloads, purchases): 730 days, for billing and statistics. Once you delete your account they are no longer linked to your email or name.
• Sign-up bonus record: a one-way hash of your email address (never the address itself), kept after you delete your account so the free sign-up credits go to each person only once (fraud prevention, legitimate interests).
• Server and network logs: at most 30 days.
• Backups: our managed database provider backs up the database continuously with point-in-time restore, plus nightly snapshots; files get a nightly backup copy. Backups are overwritten within 30 days. We never restore a deleted account from them.
• Purchases and invoices: as long as tax and accounting law requires (up to 10 years). If you delete your account, we keep these records without your name or email.

You can ask to access, correct, delete or receive a copy of your data, and to restrict or object to how we use it. You can change your profile and delete models or your whole account yourself in Settings. For everything else, email support@proppo.com from your account's email address. We reply within one month.

You can also complain to a data protection authority, such as Autoriteit Persoonsgegevens or the one in the country where you live.

Passwords are hashed, all traffic is encrypted (HTTPS), the session cookie can't be read by scripts, provider keys are encrypted at rest and only people who need it can access your data.

Proppo is not for children under 13. Users in the EU or UK under 16 need a parent or guardian's consent, and under-18s need one to buy anything. We don't profile users or send marketing. If you believe a child under 13 has an account, email support@proppo.com and we will delete it.

We update this policy when our processing changes. For important changes we email you or show a notice in the app before they apply. The date at the top shows the current version.