Privacy Policy

1. Controller and contact

ProductBackground is operated by 3DOfficeAT e.U., registered proprietor Marcel Hermann Hofer, Sebastian-Schrott-Straße 2, Tür 30, 6112 Wattens, Austria. For privacy requests, email [email protected] or call +43 676 9449899.

2. ChatGPT and Codex skills plugin

The public ProductBackground skills-only plugin contains instructions and visual-style guidance. It does not connect to a ProductBackground account, call our image servers, or transmit your conversation, product references or style briefs to ProductBackground. Native image generation and conversation storage are handled by the client and its providers under their own terms and privacy notices. If you separately visit our website or install our Shopify app, the applicable website or Shopify processing described in this policy applies. Requests to our setup page and package download are subject to the website's existing hosting and security processing.

3. Accounts and security

We process account identifiers, contact details, authentication records, preferences and technical security information to provide and protect your account. Authentication providers receive information needed for your chosen sign-in method. The legal bases are service contract performance (Article 6(1)(b) GDPR) and our legitimate interests in preventing abuse and securing the service (Article 6(1)(f)). Optional telemetry is not a condition of service.

4. Creations and AI processing

We process uploaded references, prompts, scene instructions, generated images, settings and usage records to perform your requests. Depending on the feature and the selected product image provider, external processing includes RunPod, Replicate, OpenAI and Google's paid Gemini API. Product Studio can send reference images, backgrounds and art direction to the selected provider. Provider request identifiers and usage information are retained when available so that access, deletion and billing requests can be handled. The legal basis is contract performance (Article 6(1)(b) GDPR).

5. Hosting, storage and integrations

Railway hosts the application and workers; Supabase provides the database and object storage; Cloudflare protects administrative access; and Upstash provides rate limiting and related security analytics. Authentication can use Google, GitHub or Discord. Connected integrations can include Shopify, Google Drive and Dropbox; they receive the information needed for operations you request. Discord can receive operational notifications. Files exported to a workspace that you control are not removed by deleting your ProductBackground account.

6. Shopify app

When you connect Product Background Studio, we store the shop and installation identifiers, the linked ProductBackground account, encrypted Shopify access credentials, verified subscription periods and credit records. We verify the acting Shopify staff member's permissions. We import the product media you select and optional product information needed for scene planning; chosen images and instructions are processed by the image providers named above. Imported and generated assets, plans and export records are associated with the shop installation. Shop staff do not gain access to unrelated private website images through the app. We do not request customer or order access. Generated results are added to Shopify only after a staff member explicitly approves export; existing Shopify media remains under the merchant's control. Uninstall blocks new shop actions and exports, while a separately linked ProductBackground account and legally retained financial records are handled separately. Shopify privacy requests are processed through verified webhooks.

7. Payments and agreement evidence

Stripe processes website payments and subscriptions. Shopify App Pricing handles subscriptions purchased through the Shopify app. We retain purchase, subscription, credit, transaction and checkout agreement records, including agreement version, acceptance time and checkout status. Checkout evidence can include IP address and browser information. The legal bases are contract performance (Article 6(1)(b)), applicable accounting obligations (Article 6(1)(c)), and legitimate fraud-prevention and dispute-handling interests (Article 6(1)(f)). Records required by Austrian tax and business law are restricted and retained for the applicable statutory period.

8. Optional analytics, diagnostics and recordings

PostHog provides analytics and session recordings; Sentry provides error diagnostics. Both providers are disabled for the initial release. If either purpose is enabled later, each requires a separate opt-in in Privacy settings. Login and checkout acceptance do not grant permission. Withdrawal stops future collection but does not automatically erase earlier provider records. The legal basis for enabled optional telemetry is consent (Article 6(1)(a)). Browser Do Not Track disables analytics and recordings. Sensitive plugin routes and embedded Shopify surfaces do not run optional telemetry.

9. Cookies and local storage

Necessary session and request-protection cookies support sign-in and security. A first-party privacy preference cookie stores a signed reference to your server-side choices for six months; minimal consent receipts record choices and time without IP addresses or fingerprints as evidence. Changed purposes or expiry require a new choice. Optional PostHog identifiers require the corresponding permission. Support conversation storage is used when you open support chat. Access to device information that is not technically necessary requires consent under Section 165(3) of the Austrian Telecommunications Act 2021.

10. Email and support

Resend delivers service emails such as authentication, receipts and requested notifications. Marketing requires an affirmative request followed by email confirmation. Withdraw in account settings or through an email unsubscribe link. Existing account defaults are not marketing consent. Support chat loads when explicitly opened. Messages and optional contact details may be routed through the ProductBackground chat service to Telegram, with an opaque local credential for continuity. Do not submit passwords or payment-card details. Support processing is necessary to answer your request and serves our legitimate interest in resolving service problems.

11. Retention, export and deletion

Gallery items remain recoverable in Recently Deleted for 30 days; failed storage cleanup is retried. Account settings provide a personal-record export with an image inventory, excluding image binaries and secrets; export artifacts expire after 24 hours. Account deletion suspends access and provides 30 days for recovery, which a separate confirmation can waive. Uninstalling the Shopify app blocks new shop actions but does not automatically delete a separately linked ProductBackground account or images already added to a merchant-controlled Shopify product. Contact us for Shopify installation data requests; verified Shopify privacy webhooks are also processed. Subscription renewal cancellation is requested and its status must be checked. Recovery does not automatically restore renewal, credentials, schedules or public visibility. Erasure completion depends on jobs, storage cleanup, provider tasks and justified retention exceptions. Accounting records remain restricted for approved periods. Backup expiry and restoration procedures require operational verification; deletion is not a promise of immediate erasure from every backup.

12. Your rights

Subject to applicable conditions, you may request access, correction, erasure, restriction, portability, or object to processing, especially processing based on legitimate interests. Marketing objections stop direct marketing. Consent may be withdrawn without affecting the lawfulness of earlier processing. Use the account privacy tools or contact [email protected]. Proportionate identity verification may be needed. The application export identifies separately operated services and is not automatically a complete response to every access request. GDPR generally requires a response within one month; permitted extensions must be explained within that first month. You may complain to the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, Austria, [email protected], or another competent supervisory authority.

13. Recipients and international transfers

Authorized personnel and the providers described above receive only the data needed for their roles. Some providers and their subprocessors may process data outside the European Economic Area. Where required, transfers rely on an applicable adequacy decision, including the EU–US Data Privacy Framework for certified recipients, or the European Commission's Standard Contractual Clauses with supplementary safeguards. You may request information about the safeguard applicable to a particular transfer through the privacy contact above.

14. Discover image permission

Administrators may invite selected accounts to allow curation of existing and future account images for the public Discover gallery and its preview areas on this website. Invitations respect your optional-email permission. Selection and receiving or opening an invitation do not grant image permission: you must sign in to the invited account and expressly confirm the versioned permission and required third-party rights. This permission does not cover other advertising or marketing uses. Foreign-account curation does not publish private prompts, account names or email addresses. We record the accepted text, version, hash, scope and acceptance or withdrawal time, without IP addresses or device fingerprints. Permission records are included in your account export and account deletion. You can withdraw in Discover permission settings without affecting other account features. Withdrawal or account-deletion start removes related public previews; recovery does not automatically restore permission or publications. Other people's saved copies cannot be recalled. Necessary confirmation emails record your choice; their delivery does not decide whether it is effective.

Cookie and browser storage inventory

• discovery-consent-token: necessary, tab-scoped session storage retains the invitation token through sign-in. It is removed after confirmation or withdrawal, or when the tab closes. The server rejects expired invitation tokens after seven days. Manage Discover permission.
• privacy_consent: necessary first-party, HttpOnly preference reference, up to six months.
• privacy-preferences-change: necessary local storage for tab synchronization and keeping optional processing off after a failed save; replaced after a successful choice.
• next-auth.session-token or __Secure-next-auth.session-token: necessary HttpOnly authentication cookie, configured for 30 days. NextAuth also manages CSRF and sign-in callback cookies.
• pb-recent-auth or __Secure-pb-recent-auth: necessary HttpOnly proof of recent authentication, 15 minutes.
• product-background:tour-progress:*: first-party local storage for tutorial invitations, completion and editable resume checkpoints, separated by guest or account. Account progress is also saved with your account and included in its data export. Browser site-data controls remove local copies.
• pb-tour-guest-claim: first-party tutorial transfer marker, up to one year. It contains a random cycle and an opaque account digest so guest progress is transferred only once; it contains no tutorial text and is also stored locally.
• Legacy PostHog ph_* and __ph_opt_* storage: optional provider identifiers removed on withdrawal. Current event persistence is memory-only.
• Support conversation storage: created by the separately operated support widget only after you open support chat; remove it through browser site-data controls or request deletion through the privacy contact.

This inventory describes ProductBackground-owned browser storage. Providers can use their own storage as described in their notices. You can reopen Privacy settings from the footer.