PRIVACY POLICY

1. Scope and who is responsible

This Privacy Policy applies to InkMee websites, upload and preview tools, account and checkout flows, customer support, creator or business programs, galleries, newsletters, and related online or offline services that link to it (collectively, the Services). It covers customers, prospective customers, visitors, uploaders, persons depicted in Uploaded Content, newsletter subscribers, business contacts, and other individuals whose personal data InkMee processes.

InkMee is a trade name. The data controller and contracting seller shown on the website and at checkout is the InkMee contracting entity identified at checkout and in your order confirmation, company/registration number available in the applicable order documentation, registered at the seller address shown at checkout or in the order confirmation (referred to as InkMee, we, us, or our). If an affiliate or local seller is shown at checkout, that entity may be an independent or joint controller for the transaction, as disclosed there.

Privacy contact: privacy@inkmee.studio. Data Protection Officer, if appointed: InkMee Privacy Team at privacy@inkmee.studio. EU representative, if required: contact privacy@inkmee.studio for current representative details. UK representative, if required: contact privacy@inkmee.studio for current representative details.

2. Key definitions

Uploaded Content. A photo, image, screenshot, artwork, reference sheet, text prompt, message, or other material submitted to the Services.

Creation Data. Project data generated or recorded while producing a figurine, including prompts, masks, landmarks, segmentation, pose estimates, depth information, texture maps, inferred unseen details, drafts, previews, 3D meshes, face/body geometry, print supports, revision history, quality-control notes, and final production files.

Personal Data. Information that identifies, relates to, describes, is reasonably capable of being associated with, or can reasonably be linked to an individual or household, including equivalent terms under applicable law.

Sensitive Data. Information treated as sensitive or specially protected by law. Depending on location and processing, this may include account credentials, precise location, children’s data, and facial or body geometry capable of functioning as biometric information.

3. Personal data we collect

3.1 Information you provide

• Identity and account data: name, username, password hash, age or adulthood confirmation, preferred language, and account settings.
• Contact data: email address, telephone number, shipping and billing address, country, and communication preferences.
• Order and transaction data: selected product, size, style, base, quantity, price, currency, tax, discounts, order status, payment token and limited payment details supplied by the payment provider, shipment and customs information, refund and chargeback records.
• Uploaded Content: photos of you, family members, children, partners, friends, pets, deceased persons, outfits, objects, locations, logos, or other references; text prompts and instructions; and metadata remaining in uploaded files unless removed.
• Creation Data: AI-generated previews, facial/body or pet-feature measurements used for artistic reconstruction, 3D geometry, textures, model versions, production settings, reviewer notes, production review records, and final outputs.
• Communications: emails, chat messages, support tickets, survey responses, reviews, copyright notices, privacy requests, and records of consent or permission.
• Gallery and marketing submissions: content and releases you separately choose to make public, together with attribution and campaign details.
• Business-program data: company, role, tax or payout information, portfolio, creator/referral code, performance records, and contractual communications.

3.2 Information collected automatically

• Device and network data: IP address, browser, operating system, device type, language, time zone, identifiers, approximate location inferred from IP, and security signals.
• Usage data: pages viewed, buttons selected, upload and preview events, referral URL, session timestamps, errors, interactions, cart activity, campaign attribution, and consent status.
• Cookies and similar technologies: cookies, pixels, SDKs, local storage, session storage, tags, and similar technologies, subject to the Cookie Policy and regional consent rules.

3.3 Information from other sources

• Payment providers, fraud-prevention providers, delivery carriers, marketplaces, social platforms, creator or referral partners, business customers, customer-authorized contacts, and public sources where permitted by law.
• An adult uploader may provide information about another person depicted in a photo. The uploader must have authority to do so. We may contact the uploader—not the depicted person— to verify authority unless law or risk requires otherwise.

4. How we use personal data and our legal bases

Purpose Data involved Legal basis where required Provide preview and custom creation Uploaded Content; Creation Data; account, contact, and project instructions Performance of a contract or steps requested before a contract; explicit consent where local law requires it for sensitive facial/body processing.

Process order, payment, tax, customs, and delivery Identity, contact, transaction, shipment, fraud and payment-token data Contract; legal obligation; legitimate interests in preventing fraud and enforcing transactions.

Human refinement and quality control Uploaded Content, previews, 3D models, reviewer notes, production review history Contract; legitimate interests in quality, safety, accessibility, and resolving defects.

Customer support, revisions, refunds, and disputes Account, order, communication, Uploaded Content and Creation Data Contract; legal obligation; legitimate interests in customer service and legal claims.

Security and abuse prevention Device, network, account, upload, moderation, and transaction signals Legal obligation; legitimate interests in protecting users, rights holders, systems, personnel, and the public.

Service analytics and improvement Aggregated or minimized usage, error and performance data; not private images for generalized AI training Consent for non-essential analytics where required; otherwise legitimate interests with opt-out where applicable.

Marketing and newsletters Contact, preference, engagement and campaign-attribution data Consent where required; otherwise legitimate interests and applicable softopt-in rules. Unsubscribe is always available.

Public gallery, testimonial, or campaign Only the content and attribution covered by a separate release Specific, optional consent or a separate written license; never inferred from purchase.

Legal compliance and corporate transactions Relevant account, transaction, security, communication and project records Legal obligation; public interest where recognized; legitimate interests in legal claims, audit, reorganization, financing, or sale.

Where we rely on legitimate interests, we consider the purpose, necessity, expected impact, sensitivity of the data, safeguards, and reasonable expectations of affected individuals. You may request information about a relevant balancing assessment where law provides.

5. Photos, facial/body processing, and sensitive data

InkMee may need to interpret visible facial, hair, body, pose, clothing, and pet characteristics to make an artistic 3D representation. This is creation processing, not identity recognition.

• InkMee does not use facial or body information to verify identity, unlock an account, compare a person against a watchlist, track a person across services, infer race, religion, health, sexual orientation, emotion, criminality, employability, creditworthiness, or other sensitive traits.
• Where a law treats a scan or record of face/body geometry as biometric or sensitive information, InkMee will provide a just-in-time notice and obtain the required written or express consent from the depicted person or legally authorized representative before processing.
• InkMee does not sell, lease, trade, or otherwise profit from biometric identifiers or biometric information. We do not disclose such information except to contracted processors needed to perform the requested creation, as directed by the customer, or where law requires.
• Face/body geometry and comparable derived files are retained only for the creation and support period described below, then permanently deleted from active systems and allowed to expire from backups.
• A customer may decline this processing by not uploading a photo. Because the service depends on interpreting the image, InkMee may be unable to provide the personalized preview or product without it.

6. How InkMee uses AI and human review

• AI systems may generate an artistic preview, estimate depth or unseen portions, segment image elements, reconstruct a 3D form, create or adjust textures, and detect whether a model is likely to print successfully.
• Human specialists may view private project content to assess likeness, revise hair, hands, clothing and supports, correct geometry, conduct quality checks, respond to revisions, prevent abuse, or investigate a problem.
• Generated content can be inaccurate, incomplete, stylized, or different from the uploaded image.

InkMee does not use solely automated processing to make decisions that produce legal or similarly significant effects about a person.

• InkMee does not use private customer photos, face/body geometry, prompts, or personalized models to train generalized or public AI models. Service providers must process them only on documented instructions and must not use them for independent training.

7. When we disclose personal data

• Service providers and processors: hosting, secure file storage, AI inference, 3D processing, human production specialists, payment, fraud prevention, email, customer support, analytics, security, printing, packaging, logistics, customs, and professional advisers. They receive only data needed for their role and are bound by contractual confidentiality, security, use, retention, deletion, and audit obligations.
• Affiliates and checkout sellers: when an affiliate is responsible for a region, order, production site, or support function and the relationship is disclosed.
• At your direction: for example, when you request shipment to another person, share a preview link, publish a gallery item, or connect a third-party service.
• Legal and safety reasons: when reasonably necessary to comply with law or valid process; protect users, depicted persons, children, rights holders, InkMee, or the public; detect fraud or security incidents; or establish, exercise, or defend legal claims.
• Corporate transactions: in a merger, financing, acquisition, restructuring, insolvency, or asset sale, subject to confidentiality and continued protection.

InkMee does not disclose private Uploaded Content or Creation Data to data brokers, advertising networks, or social platforms for cross-context behavioral advertising. If InkMee later uses advertising technologies that constitute a sale, sharing, or targeted advertising under applicable US law, we will update the notice, display the required opt-out link, and honor Global Privacy Control before enabling that use.

8. International transfers

InkMee operates a cross-border service. Personal data may be accessed or processed in the countries where InkMee, its affiliates, AI and cloud providers, production partners, payment providers, support providers, and logistics providers operate. These countries may have privacy laws different from those where you live. The current countries and key recipient categories are listed at /privacy-policy#section-8 and in any just-in-time upload notice required by local law.

Production and fulfillment access. Because InkMee’s creation, production, quality-control, support, or

fulfillment operations may be located in China, the minimum personal data, Uploaded Content, Creation Data, and shipping information needed for an order may be accessed or processed in China. InkMee limits access to the relevant purpose, requires confidentiality and security, and uses any cross-border safeguards required by the privacy law applicable to the customer.

• For EEA, UK, and Swiss data, InkMee will use an adequacy decision where available, approved Standard Contractual Clauses or the UK transfer addendum/agreement, supplementary technical and organizational measures, or another lawful transfer mechanism.
• For Canada, InkMee remains accountable for personal data transferred to service providers and uses contractual or other means to provide a comparable level of protection while data is processed.
• For Brazil, InkMee will use a mechanism permitted by the LGPD and ANPD rules, including an adequacy decision, approved standard clauses, specific clauses, or another permitted basis, and provide required Portuguese transfer information.
• For Australia, Japan, South Korea, Singapore, Hong Kong, and other sales jurisdictions, InkMee will provide notices, obtain separate consent, conduct assessments, appoint representatives, localize data, or execute transfer terms where required.

9. Data retention and deletion

InkMee keeps personal data only for a disclosed business or legal purpose, taking into account the sensitivity, volume, context, risk, contractual needs, warranty/support period, legal claims, and recordkeeping rules. The standard retention schedule is:

Record Standard active retention Reason / deletion rule Abandoned image upload or unsubmitted preview 30 days from last activity Allows the user to resume creation; then delete from active systems and expire backups.

Private Uploaded Content and Creation Data for an order Through delivery or cancellation, plus 90 days Supports revisions, defects, delivery issues, chargebacks, and deletion verification. A separately selected reorder archive may keep identified files for up to 12 months.

Facial/body geometry or data treated as biometric Only until the creation purpose is satisfied; normally no later than 90 days after delivery/cancellation Delete earlier on a valid request unless retention is legally required. In all cases follow any shorter law; do not exceed a statutory outer limit.

Gallery/marketing content Until consent is withdrawn, campaign ends, or the agreed license expires, plus up to 30 days for removal Public copies already lawfully shared by others may remain outside InkMee’s control; InkMee stops new use after withdrawal where consent is the basis.

Account profile While active, then up to 24 months after closure/inactivity Account recovery, fraud prevention, dispute handling; minimal suppression records may remain.

Support and production review records 24 months after case/order closure Quality, complaints, warranty, consent and dispute evidence.

Transaction, tax, customs and accounting records 7 years, or longer/shorter if local law requires Financial reporting, tax, customs, audit and legal obligations. Payment card numbers are retained by the payment provider, not InkMee, unless expressly stated.

Security and access logs 12 months, up to 24 months for investigated incidents Security monitoring, fraud, abuse and legal claims.

Analytics identifiers Up to 13 months unless a shorter consent setting applies Trend and performance measurement; aggregated statistics may be retained if no longer personal data.

Consent and privacy-request records 5 years or the applicable limitation period Demonstrate choices, compliance, identity verification, appeals and suppression.

Backups Rolling expiry, normally within 90 days after active deletion Backups are isolated, access-restricted and not restored except for disaster recovery; deletion reapplies after restoration.

If a legal hold, fraud investigation, safety concern, unresolved dispute, or statutory obligation applies, relevant records may be isolated and retained only for that purpose. InkMee documents each exception and deletes the data when the exception ends.

10. Security

• Encryption in transit and at rest where appropriate; private-by-default project access; role-based permissions; least-privilege access; multi-factor authentication for privileged accounts; and access logging.
• Vendor due diligence and written processing terms; secure development and vulnerability management; malware scanning; incident response; backup controls; deletion verification; and staff confidentiality and training.
• Separation between private customer projects and public gallery assets, and prohibition on transferring private uploads into marketing or training repositories.

No system is completely secure. If a breach affects personal data, InkMee will investigate, mitigate, preserve evidence, notify regulators and affected individuals when required, and provide information reasonably necessary to reduce harm. Security concerns may be reported to security@inkmee.studio.

11. Your privacy rights and choices

• Know whether and how personal data is processed; access or obtain a copy; correct inaccurate data; delete data; restrict processing; object; withdraw consent prospectively; and receive portable data where applicable.
• Opt out of sale, sharing, targeted advertising, certain profiling, or marketing; limit use of sensitive personal information; and appeal a denied request where local law provides.
• Close an account; request deletion of a project; remove gallery permission; unsubscribe from marketing; and change cookie choices through the Privacy Preferences link.
• Use an authorized agent where allowed. InkMee may require proof of the agent’s authority and may verify the request directly with the individual.

Submit requests at /contact or privacy@inkmee.studio. Describe the account, order, photo, depicted person, and right you wish to exercise. InkMee will verify identity proportionately, avoid collecting unnecessary identity documents, respond within the legal deadline, explain any denial, and provide appeal or regulator information where required. You will not receive discriminatory treatment for exercising a right, although deletion of data needed for an unfinished order may prevent completion.

12. Marketing, cookies, and Global Privacy Control

Marketing emails include an unsubscribe method. Transactional messages about an order may continue.

Non-essential cookies and similar technologies are controlled under the Cookie Policy. Where legally required, InkMee obtains prior consent and offers equally prominent Accept all, Reject non-essential, and Manage choices controls. InkMee will recognize legally required opt-out preference signals, including Global Privacy Control, as a request to opt out of sale/sharing or targeted advertising for the associated browser or device.

13. Children and family uploads

InkMee is not directed to children and does not permit a child to create an account, upload content, request a preview, or purchase.

• A person ordering must be at least 18 and have reached the age of majority where they live.
• An adult may upload a child’s image only if the adult is the child’s parent or legal guardian, or has documented permission from the parent/guardian and any other authority required by law.
• InkMee does not knowingly use a child’s image for targeted advertising, generalized AI training, public display, or commercial promotion without a separate valid authorization that satisfies applicable child and publicity laws.
• If InkMee learns that data was submitted directly by a child or without appropriate adult authority, it may suspend the project, request verification, and delete the data. Report concerns to privacy@inkmee.studio.

A separate Children’s Privacy Notice will be introduced before InkMee offers child accounts, childdirected experiences, school services, or knowingly collects personal data directly from children.

14. Regional privacy supplements

14.1 EEA, United Kingdom, and Switzerland

Individuals in these regions have GDPR/UK GDPR rights described above and may complain to their local supervisory authority. The controller, lawful bases, recipients, retention, transfer mechanisms, and representatives appear in this Policy. Consent may be withdrawn without affecting earlier lawful processing. You may object to legitimate-interest processing, including direct marketing. InkMee does not make solely automated decisions with legal or similarly significant effects. If InkMee’s targeting or scale triggers Article 27 or DPO obligations, the applicable representative or DPO details will be published in this Policy.

14.2 United States state privacy notice

This section applies to the extent a state privacy law covers InkMee. Even where a statutory threshold is not met, InkMee intends to provide core access, correction, deletion, and opt-out controls where reasonably feasible.

US category collected Examples / source Business purpose and disclosure Identifiers and customer records Name, email, phone, addresses, IP, account ID; from you and devices Accounts, orders, delivery, support, security; disclosed to operational service providers.

Commercial information Products, orders, prices, returns, preferences; from transactions Fulfillment, accounting, customer service, analytics; disclosed to payment, production and logistics providers.

Internet/electronic activity Usage, interactions, referral, cookies, device data; automatically Security, functionality, consented analytics and attribution; disclosed to hosting, security and consented analytics providers.

Audio, electronic, visual or similar information Uploaded photos, previews, messages and figurine models; from you and creation process Custom creation, review, support, rights protection; disclosed only to contracted creation/production providers or as you direct.

Inferences Style, size and content preferences; created from activity and selections Personalize the requested creation and improve navigation; not used for high-impact profiling.

Sensitive personal information Credentials and, where legally classified, facial/body geometry or children’s data Security and the requested custom service only; no sale, advertising use, or unrelated profiling.

InkMee does not sell private Uploaded Content, Creation Data, or facial/body data. InkMee does not knowingly sell or share personal information of persons under 16. If advertising cookies later constitute sale, sharing, or targeted advertising, users will receive a Do Not Sell or Share My Personal Information / Opt Out of Targeted Advertising link and opt-out preference signals will be honored.

California residents may request categories, specific pieces, sources, purposes, and recipient categories for the applicable lookback period, and may use an authorized agent. Residents of states providing appeals may appeal at privacy@inkmee.studio and may contact their attorney general if dissatisfied.

14.3 Canada

InkMee will obtain meaningful consent by presenting key image, AI, sharing, cross-border, and retention facts at the point of upload and purchase, not only inside this Policy. InkMee remains accountable for information transferred to processors and uses contracts or other means to require comparable protection. Canadian users may request access or correction, challenge compliance, withdraw consent subject to legal/contractual limits, and contact the Office of the Privacy Commissioner of Canada or the applicable provincial regulator. Quebec users may also exercise rights under Quebec private-sector privacy law, including rights relating to access, rectification, deletion/de-indexation where applicable, portability, automated decisions, confidentiality incidents, and cross-border assessments.

14.4 Brazil

Under the LGPD, processing may rely on consent, contract, legal obligation, legitimate interests, protection of credit, or another lawful basis. Brazilian data subjects may request confirmation, access, correction, anonymization/blocking/deletion, portability where regulated, information on sharing, review of certain automated decisions, and withdrawal of consent, and may petition the ANPD. Contact the person in charge at privacy@inkmee.studio. Required international-transfer information and mechanisms will be available in Portuguese.

14.5 Australia and New Zealand

InkMee will maintain an open privacy policy, notify individuals of collection and likely overseas disclosures, take reasonable steps to protect information sent overseas, provide access and correction, and handle complaints. Australian users may complain to the Office of the Australian Information Commissioner after first giving InkMee a reasonable opportunity to respond. New Zealand users may complain to the Office of the Privacy Commissioner.

14.6 Japan

InkMee will specify purposes of use, security measures, procedures for retained personal data requests, and information concerning foreign transfers as required by the APPI. Japanese users may request notification of purpose, disclosure, correction, cessation of use, erasure, or cessation of third-party provision where applicable. Contact privacy@inkmee.studio.

14.7 South Korea

Where the PIPA applies, InkMee will publish required processing and destruction details, obtain and record consent for overseas transfers where required, disclose recipient, country, purpose, items, timing/method and retention, obtain guardian consent for children under 14 where data is collected directly, and honor access, correction, deletion, suspension, and transmission-related rights. A domestic representative will be appointed if required: contact privacy@inkmee.studio for current representative details.

14.8 Singapore and Hong Kong

Singapore users may withdraw consent, request access or correction, and contact the designated Data Protection Officer at privacy@inkmee.studio. InkMee will provide comparable protection for overseas transfers. In Hong Kong, InkMee will follow the Data Protection Principles on purpose, notification, accuracy, retention, use, security, openness, access and correction, and will use contractual or other safeguards for cross-boundary transfers.

15. Changes to this Policy

We may update this Policy to reflect service, vendor, legal, or security changes. We will post the revised date and provide additional notice or obtain renewed consent when a change is material or required. A change will not retroactively expand public use, model training, sale, or advertising use of private Uploaded Content without a new valid permission.

16. Contact and complaints

Contact privacy@inkmee.studio, use /contact, or write to the seller address shown in your order confirmation. We aim to acknowledge complaints promptly, investigate fairly, explain the result, and provide appeal or regulator information required by local law.