Privacy Notice
Who operates the service
The AI3D API is operated by AIMagical, Inc. Contact yc@aimagical.com or write to AIMagical, Inc, 2021 Fillmore St, San Francisco, CA 94115 for privacy questions or requests.
Information we handle
- API key digests and prefixes, job requests, model selection, uploaded inputs or input URLs, generated outputs, and usage information.
- Credit balances, job charges, and Stripe customer, Checkout session, payment-intent, and event identifiers. Stripe processes payment details and sends payment receipts; the API stores payment references and billing records rather than card numbers.
- If email sign-in is enabled, the email address you provide, a salted password hash, account verification status, and the Terms version you accepted. We also keep hashed one-time verification and password-reset tokens, short-lived login/mail throttling records, and expiring browser-session records.
- Messages you send to the support contact and technical records needed to protect and operate the service.
How we use it
We use this information to issue and secure API keys, deliver generation jobs and artifacts, administer prepaid credits, reconcile provider charges, prevent abuse, provide support, and meet legal and accounting obligations.
Service providers and sharing
We use Google Cloud for the API, database, task processing, logs, and artifact storage; Stripe for Checkout and payment events; and model providers to deliver generation jobs. The model provider receives the request data needed to run the model you select. Provider names and current model availability are shown in the model catalog. Each provider handles data under its own terms and privacy practices.
When email sign-in is enabled, Resend receives your address and the verification or password-reset message needed to operate your account. The one-time link token is stored as a digest by AI3D.
Completed 3D outputs and the retained source image for image jobs supported by the public viewer can be retrieved by anyone who has the job ID. Do not submit content for a job if access through that viewer would be inappropriate.
Storage and retention
Temporary uploaded input objects are configured to expire after two days. Image jobs store a copy of the source image with the job before provider submission. For completed image jobs, that copy remains available through the public viewer to anyone with the job ID. API key, job, generated artifact, and billing records are retained as needed to operate the service, settle charges, handle disputes, and meet legal obligations. Contact us to request key revocation or data deletion, subject to records we must retain.
The Cloud Run API service is hosted in Google Cloud's us-central1 region. Other data storage and provider processing locations can vary by service.
Security and choices
API keys and email action tokens are stored as digests, and browser sign-in uses a Secure, HttpOnly, SameSite cookie that expires after 30 days. Signing out revokes the current session; resetting or changing a password revokes existing sessions. If you enter an API key in the browser dashboard, it is held in that tab's session storage until the tab session ends and is sent to the AI3D API for authenticated requests. You can revoke a key using the authenticated API. Depending on where you live, you may have rights to access, correct, delete, or restrict use of personal information. Contact yc@aimagical.com to make a request.
Changes
We may update this notice as the service changes. We will publish the current version at this address and update its effective date.