Privacy Policy

This page sets out what personal data we collect, why, who receives it, and what you can ask us for.

What we store

• The email address and name you give when you sign up.
• The prompt, the settings, and the result of every generation you make.
• Files you upload as references.
• Your balance history: every credit added or taken, and why.
• Your purchase history: invoice number, amount, and status.
• Images you submit to the community gallery, your choice about showing their prompts, and the outcome of the review.
• Modest technical records that keep the service running, such as when a request happened and how it went.
• Visits to xplor3.space through Google Analytics, only if you allow analytics cookies. The details are in Cookies and analytics below.

What we do not store

We do not store card numbers, bank details, or any other payment data. All of that is handled directly by the payment provider and never passes through our servers. We never store your password as you typed it either: only a hash of it is kept, which cannot be turned back into the password. If you sign in with Google, your Google password never reaches us at all.

Why we store it

To run the service you asked for: showing your generations back to you, showing images you submitted to the gallery yourself once they are approved, counting your balance correctly, charging and refunding credits, and answering you when something goes wrong. We do not sell your personal data, and we do not use it to train models.

Who receives it

• The third-party model provider that runs your generations. Your prompts and reference files are sent there, because without that there is nothing to produce.
• DOKU, the payment processor, when you buy credits.
• Brevo, the email sender, for verification codes, the welcome email, and notifications.
• Google, as the provider of Google Analytics if you allow analytics cookies, and as the sign-in provider if you choose to sign in with Google.
• Cloudflare, which delivers the images and videos on this site.
• The infrastructure providers the service runs on.
• Anyone who opens xplor3.space, but only for images you submitted to the gallery and that were approved: the image, the model's name, and its prompt if you chose to show it. Your name and email are not shown.

Beyond that, we may hand over personal data where the law requires it.

How long

Generations and reference files are kept while your account exists, or until you delete them yourself. Balance and purchase history is kept longer, because financial records need to remain auditable. After an account is deleted, the rest is erased or anonymised.

A gallery image stays up until you withdraw it, delete the generation it came from, or your account is suspended or deleted. The record of the submission is erased when that generation or your account is permanently deleted.

Your rights

Under Indonesian Law No. 27 of 2022 on Personal Data Protection, you have the right to:

• Ask for a copy of the personal data we hold about you.
• Ask us to correct data that is wrong.
• Ask us to delete your personal data.
• Withdraw consent you previously gave.
• Refuse certain processing, and object to it.

Requests like these can go to [email protected]. You can delete your account yourself from the settings page.

Cookies and analytics

A cookie is a small file a browser keeps for a site. We sort ours into two groups, and only the necessary group runs without your permission. The first time you open xplor3.space you are asked whether analytics cookies may be used; you can accept, reject, or choose group by group.

• Necessary, always on. xplor3_consent keeps your cookie choice for 6 months. In the studio (studio.xplor3.space), a session cookie keeps you signed in for 7 days and is extended while you use it, and xplor3_sidebar remembers for 1 year whether the side menu is expanded or collapsed. None of these is used to track you.
• Analytics, only with your permission. _ga and _ga_* from Google Analytics 4 tell one visit apart from another and last 13 months. Without your permission the Google Analytics script is not loaded at all.

Your light or dark preference is not kept in a cookie but in your browser's local storage, and it is never sent to a server. We use no advertising cookies and no cross-site trackers.

What Google Analytics records: the pages you open and where you came from (a search engine or a link on social media, for example), how long a visit lasts, your approximate country and city, language, device type, operating system, browser, and screen size, and interactions such as scrolling a page or following a link out. Google Analytics 4 does not log or store IP addresses.

What we use it for: we read these figures combined, to learn how many people visit, where they come from, which content helps, and which parts of a page need fixing. The data is not used for advertising, not sold, and not joined with your studio account. Google signals and ad personalisation are switched off.

The legal basis is your consent, under Indonesian Law No. 27 of 2022 on Personal Data Protection. Analytics data is processed by Google on servers that may be outside Indonesia. User-level and event-level data is kept for 2 months and then deleted automatically; aggregated reports that no longer point to a particular visit are kept.

You can change your choice at any time from Cookie settings at the bottom of every page. Withdrawing consent stops collection straight away and removes the _ga cookies from your browser. Data sent before that follows the retention above, or you can ask us to delete it at [email protected]. You can also block or clear cookies in your browser's settings.

Security

Connections to the service are encrypted, the session cookie cannot be read from JavaScript, and generated files are reachable only through short-lived signed links. The only exception is a file you chose to make public, such as an image showing in the gallery: anyone can open it while it is up, and a visitor's browser may keep a copy for a few minutes. No system is completely secure, and we will tell you if a breach affects your data.

Children

The service is not intended for anyone under 17. If we learn of an account belonging to a minor without a parent or guardian's permission, we will delete it.

Changes

This policy can change. The date of the last change is at the top of the page. Questions about it can go to [email protected].