Privacy policy
Last updated 3 November 2026
This policy explains what personal information ShotBox3D keeps, why, and what you can do about it. We collect only what we need to run ShotBox3D. We don't show ads, we don't use tracking or analytics tools, and we never sell your information.
1. Who we are
ShotBox3D is provided by HRLytic Private Limited, a company registered in England and Wales. We are the “controller” of your personal information under UK data protection law (the UK GDPR and the Data Protection Act 2018). For anything about your data, email hello@shotbox3d.com.
2. What we keep and why
| Information | Why we keep it | Legal basis |
|---|---|---|
| Account: email address, password (stored only as a one-way hash, never readable), whether your email is confirmed, sign-up date | To create your account, sign you in and send account emails (confirmation, password reset) | Contract |
| Projects: your saved lighting designs and snapshots | To save your work and show it to you | Contract |
| Uploads: backdrop images and 3D models you add, your confirmation that the person shown is 18 or older and consented, and whether you marked a file as sensitive | To store and show your files to you only, and to show that each upload of a person was confirmed as consensual | Contract; legitimate interests (preventing abuse) |
| Billing: your plan, storage packs, renewal and end dates, and Stripe's customer ID for you. Card details are held by Stripe, never by us. | To give you what you paid for, and keep the records tax law requires | Contract; legal obligation |
| Messages: what you send through the contact form (name, email, topic, message) and the IP address it came from | To reply to you, and to block spam | Legitimate interests |
| Technical: IP address, browser type and request times in our server logs | To keep ShotBox3D secure and working, for example limiting repeated sign-in attempts | Legitimate interests |
The 3D studio runs in your browser. Lighting, posing and rendering happen on your own device, and only what you save is sent to us.
3. Sensitive uploads and the people in them
- Uploads are private to the account that uploaded them. There are no public galleries or sharing links, and other users can't see them.
- Files marked as sensitive stay blurred in the editor until you choose to show them.
- We don't look at uploads, except when you ask us to help, when we investigate a report of a rule being broken, or when the law requires it.
- If you upload an image or model of someone else, you are responsible for having their consent. If you are that person and didn't agree, email hello@shotbox3d.com and we'll deal with it promptly.
4. Who helps us run ShotBox3D
We use a few trusted providers. Each one may only use your information to provide its service to us, under a contract that protects it:
- Amazon Web Services: hosting, database and file storage, in the UK (London).
- Stripe: payments, invoices and the billing portal. Stripe keeps your card and payment details. Where Stripe acts as the reseller (merchant of record) for a purchase, it is a separate controller for that payment information, and its own privacy policy applies.
- Our email provider: sends account and payment emails on our behalf.
Some of these providers may handle data outside the UK, for example Stripe in the United States. When they do, the transfer is protected by safeguards UK law accepts, such as the UK–US data bridge or the UK International Data Transfer Agreement.
We may also share information when the law requires it, to protect people from harm (for example reporting child sexual abuse material to the authorities), or as part of a sale or reorganisation of our business, in which case this policy continues to apply.
5. Cookies
We use one cookie, which keeps you signed in. It's essential for your account to work, so it doesn't need your consent, and it lasts up to 30 days. Stripe sets its own cookies on its checkout and billing pages, to process payments and prevent fraud. We use no advertising or analytics cookies.
6. How long we keep it
| Your account, projects and uploads | While your account is open. When you delete an upload, it's removed straight away, and any stored backup copy within 30 days. |
| After you ask us to delete your account | Deleted within 30 days. Database backups that still contain it expire within 90 days. |
| Billing records and invoices | 6 years after the payment, as UK tax law requires |
| Contact messages | Up to 2 years after the conversation ends |
| Server logs | Up to 90 days |
7. How we protect it
- Connections are encrypted (HTTPS), and stored files are encrypted at rest.
- Passwords are stored only as strong one-way hashes.
- File storage is private, and each file is served only to its owner, through links that expire.
- Changing your password signs out every other device.
- Access to our systems is limited to the people who need it to run ShotBox3D.
8. Your rights
Under UK data protection law you can ask us to:
- give you a copy of the personal information we hold about you;
- correct anything that's wrong;
- delete your information or your whole account;
- restrict or object to how we use it;
- send it to you or another service in a machine-readable format.
Email hello@shotbox3d.com from your account's email address. We'll reply within one month, and it's free. You can also delete individual uploads and projects yourself, at any time, from your account page.
If you're unhappy with how we've handled your information, please tell us first. You also have the right to complain to the Information Commissioner's Office: ico.org.uk or 0303 123 1113.
9. Children
ShotBox3D is for adults: you must be 18 or older to create an account. If we learn that an account belongs to someone under 18, we close it and delete its information.
10. Changes to this policy
If we change this policy in a way that matters, we'll email account holders before the change applies. The date at the top shows when it last changed. See also our terms of service.