Privacy Policy

1Who is responsible for your data

The operator of bricknity decides how your personal data is used. [OPERATOR — FOP details to be added] Write to [email protected] about anything on this page; we reply within 3 working days.

We run bricknity from Ukraine. [REPRESENTATIVES — EU and UK, to be appointed] You can always write to [email protected] directly, from anywhere.

You can complain to a data protection authority: in the EU or the EEA, the one in the country where you live or work, or where you think the problem happened; in the UK, the Information Commissioner's Office (ico.org.uk); in Ukraine, the Ukrainian Parliament Commissioner for Human Rights. We would like the chance to put things right first, so please write to us too.

2What we collect, and why

The law of the EU and the UK asks us to name the legal reason for each use. They are:

• To provide what you signed up for (performing our contract with you): your account and sign-in, your profile and its pictures, what you give a generator and what it makes, your builds and collections, your plan, credits and payments, the price for your country, notifications about your account, and answering what you write to us.
• Because the law requires it (a legal obligation): your date of birth for the age rules, payment and credit records for tax and accounting, handling notices of illegal content and explaining moderation decisions, and keeping data a court or an authority lawfully orders us to keep.
• Our legitimate interests, weighed against yours: keeping accounts and people safe — sign-in records, two-factor sign-in, limits on repeated attempts, the content check on descriptions, refused descriptions, reports, moderation and the record of what staff did; stopping starter credits being claimed twice; counting views once a day; the short list of signed-in events and screen tests that show us whether bricknity works; satisfaction answers; and help-centre searches that found nothing. You can object to any of these — see Your rights.
• Your consent, which you can withdraw at any time: Build Digest emails, other emails you switch on, and visit analytics and screen tests for signed-out visitors through the cookie choice.

3Cookies and your browser

The Cookie Policy lists every cookie and every piece of browser storage we use. Visit analytics for signed-out visitors are set only if you choose Accept all, and never for a teen account. The cookie choice governs what is stored in your browser; it does not stop the signed-in events in the table above.

If you fill in a generator before signing in — a description, photos, a 3D model — it is kept in your own browser while you sign in, so it is there when you come back. Nothing is sent to us until you press Generate; the browser's copy is deleted as soon as it is restored, or after thirty minutes the next time the site loads.

4Who else receives it

• The AI services listed below, for Capture 3D, Generate a 3D model, Generate image, Create minifig and Minifig from a photo. The one doing each kind of work receives the images and the words you wrote — never your name, your email address or your date of birth — and holds them under its own terms and its own retention period, not ours. Generate a 3D model can run on two listed services in turn: the first receives your words and draws a picture from them, the second receives only that picture and builds the model. Voxelise runs on our own brick engine and sends nothing to them.
• For Minifig from a photo, the service listed for that work receives the one photo of a person you upload. How long it keeps that photo and what it made from it is in its own privacy policy, linked below; we delete our copy as soon as your minifigure is delivered, and we cannot delete anything on its behalf.
• Paddle, our reseller and the merchant of record, when you buy a plan or credits. Paddle collects the payment details itself, under its own privacy notice. When you press buy we also pass Paddle your internet address, so the checkout is priced for your country exactly as Plans or Top up showed it; to show those pages we send Paddle only the country, never the address.
• Hosting and storage providers, who run the servers and keep the files.
• Email delivery services, which send our emails to you. Each email goes through one of them, which receives your email address and the email itself — including notification emails, which go only to a confirmed address: for your account, your money, moderation and security unless you switch those emails off, and for anything else only when you switch it on. A kind of notification we have paused, for everyone or for your account, is not sent while the pause lasts.
• Telegram, where our staff get short alerts in their own group. An hourly summary of satisfaction ratings: each score, its generator and any comment written with it, never your name, handle or address. An alert when a moderation case is opened or an appeal waits, without names or content. An alert when something about your payments needs a person: what kind of problem and a link to your account in our staff's tool, never an amount, your name or address. An alert when an account is closed at a third party's request (a parent or guardian, a report of a child under 13, an order): which kind of request and a link to the account in our staff's tool. A note when a subscription starts or is cancelled, with the plan only, never who; and a daily summary of totals. We delete our copy of a rating summary, a payment alert or a closure alert 14 days after it is sent; Telegram keeps it in our staff's group until they delete it.
• Google or Facebook, only if you choose to sign in with them.

Which service does which kind of work can change. A service receives your work only once the list above names it, and a service that stops taking new work stays listed while it may still hold what it was sent. Every edition of the list is in the change log at the end of this page. If the first service cannot be reached before it has accepted your work, a second listed service may do it instead — never both, and the price you were shown does not change.

The country lookup uses IP Geolocation by DB-IP, a database we keep on our own server (licensed under Creative Commons Attribution 4.0). Nothing is sent to DB-IP.

We do not use your data for advertising, and there are no advertising cookies on bricknity.

Training. Whether a service may use what it receives to train its models is set by its own terms, linked in the list above. We read those terms before a service is listed. The terms of the service listed for Minifig from a photo allow it to use what it receives to improve its services; we have asked it to confirm in writing whether that applies to the work we send it, and this page will say what it answers.

The companies, by name. Cloudflare (USA) stores our files and carries traffic to the site. Resend (USA) and Brevo (France) deliver our emails. Paddle (UK) sells plans and credits. Google and Facebook sign you in only if you choose them. Telegram carries our staff's alerts. The AI services are in the list above, with their countries.

Data outside the UK and the EEA. Some of these companies are outside the UK and the EEA. Where the country has an adequacy decision — the UK for people in the EU, for example — that decision covers the transfer. Anywhere else, the transfer is covered by the standard contractual clauses in that company's data processing terms, with the UK addendum for people in the UK. Write to [email protected] for a copy of the safeguard that applies.

5What other people can see

What you upload and generate is private until you publish it. Your public profile shows your handle, display name, bio, links, the photo and cover you uploaded, the builds you pinned and your public builds. Under your name it shows how many builds you have, your followers and the people you follow, the views, likes and downloads added up across your public builds, and when you joined; a teen account's profile shows only when it joined. A photo and cover are shown only on an adult account others can see, and never while an account is suspended. Your description is shown on a public build only if you choose that in Settings → Privacy. You can keep your profile out of search and creator pages there too; that does not hide your public builds from anyone who has a link.

A public collection shows its name, description, captions, tags, cover and the builds in it that are public, with your handle; an unlisted one shows the same to anyone with its link. Its page shows how many people saved and liked it, never who. A build's creator is told when their build goes into your public collection.

The person you report is never told who reported them, and never sees your note or screenshot; you are told only whether we acted or found no breach. The accounts you block are visible only to you, in Settings and in your data export, and the person you block is not told.

6Who at Bricknity can see your account

A small number of Bricknity's owners can open your account in our admin tool, to answer you or to keep the service safe. They see your email address, handle, age, account state, plan and credits, your generations, the titles of your builds and collections, your sessions — by network, never your exact internet address — and whether the emails we sent you went out, never what they said. A private build's description, pictures and files open only when one of them asks to see them, and that is recorded each time. A private collection's description, tags, captions, the list of its builds and its uploaded cover open only when one of them asks to see them, and each look is recorded on the collection's admin page and from any moderation case that concerns it. In the same way, a generation's description, the names of the photos it used and — for Generate a 3D model made in two steps — the picture made on the way open only when one of them asks to see them, each time recorded, and opening a generation in the admin tool is recorded too. A pipeline run’s descriptions and photos open in the same way, only when one of them asks to see them, and each look is recorded.

They never see your password, the key behind your authenticator app or your recovery codes, and they cannot sign in as you. Every time one of them opens your account, and everything they do on it, is recorded with who did it and when, and that record cannot be changed afterwards.

On your request, support can send you a password-reset link, sign you out of every device, take you off Build Digest, send a link to a copy of your data to your account's own email address, close your account when you ask from its own email address (with the same 30 days to change your mind), and turn off two-factor sign-in once we have checked it is you — never on the strength of an email alone. About money, support can add credits or take back ones added by mistake, give back the credits of a generation whose result was wrong, cancel your plan at the end of its period when you ask from your account's own email address, and lift a pause on spending once a lost payment dispute leaves nothing to settle. About generations, support can stop one before it finishes — its credits come back as they do when a generation fails — run one again free of charge, or set your own daily number of generations (one or more). About pipelines, support can stop a run — steps that finished stay paid, a step that has started keeps its price, the rest comes back — and give back, once, credits a finished run kept, within 90 days. Our owners can correct a wrong date of birth when you show proof of your age — we note what proof we saw, never a copy of it; you cannot change it yourself. Pausing your generating is no longer something support does: it is a moderation decision, explained and appealable on Account standing. A line support writes in your credit history is in your data export and is erased with your account; the credit movements are kept as financial records.

If someone else asks us to close an account — a teen's parent or guardian, a report that it belongs to a child under 13, or a court's or an authority's order — one of our owners checks the request before anything happens, and the request and the checks are kept in the record of what staff did. An account closed this way cannot be restored from the account itself; one of our owners can restore it — except an account that belongs to a child under 13, which is erased at once rather than after 30 days, and cannot be restored by anyone. When a relative or someone close tells us that the person has died, and we see a death certificate or an obituary, one of our owners can close the account the same way; it is erased after 30 days, and we give nobody its data unless the law requires it.

7How long we keep it

• Your photos: as Settings → Privacy says — kept for as long as the build exists (the starting choice), or deleted sooner if you choose. Without the originals, a build cannot be regenerated.
• A photo for Minifig from a photo: deleted from our storage shortly after its generation ends — finished, failed or cancelled — whatever Settings → Privacy says. It is never published.
• A picture made on the way to your 3D model, when Generate a 3D model runs on two services: never shown to you or published, stored privately, and deleted 7 days after the generation ends — finished, failed or cancelled. Until then one of our owners can look at it, to check a failed or poor result, and each look is recorded.
• The rights line for that photo: kept exactly as long as the figure — deleted when you discard the figure, when the generation ends without one, and when you close your account. It is included in your data export.
• A generation you delete from your list: it leaves Your generations, but its record — what it was, what it cost and what was refunded — stays with your credit history for as long as that history is kept.
• Your notifications: kept for 90 days and then deleted, and deleted at once when you close your account. They include your own switches for which ones reach you, and any pause we set on a kind of notification for your account, kept until we lift it; those pauses are erased with the rest when you close your account. A notice that somebody liked or followed you names that person; a sign-in alert names the browser and system from the sign-in, never its IP address. Both are in your data export, without anybody else's name. Deleting one in your inbox takes it out of view at once; it is erased with the rest at the end of that period.
• That we told you about a price change: which change, when, and whether in the words for a teen account — kept with the record of the change, as proof that notice was given, and erased when you close your account. The notice itself is a notification like the others above.
• A description the content check refused: kept for 30 days and then deleted, and erased sooner when your account is erased.
• A screenshot attached to a report: stored privately, seen only by moderators, and deleted after 90 days — sooner if you close your account.
• A notice of illegal content: the name, email address, link and explanation you gave are kept for 180 days, only to handle the notice, and never shown to the person it is about. If you gave an email address, we send you a receipt; our copy of that address in the sent-mail record is removed 30 days after it goes. The record that a notice was received stays.
• Moderation records: a decision about you, its statement of reasons, your appeal and the case's timeline are kept as the record of that decision, which cannot be changed afterwards — a later decision is added beside it, never written over it. A notifier is emailed the outcome only while their address is still kept. A suspended person's private link to their Account standing page works for 30 days.
• A banned email address: if an account is banned, we keep a salted one-way key of its email address for two years from the ban — even after the account is erased — so the same address cannot be used to open a new account. It cannot be turned back into the address. We keep it on the basis of our legitimate interest in keeping the people on bricknity safe; it is erased when the two years end, or sooner if the ban is reversed or lifted.
• Help centre searches that found nothing: we keep the words only when at least 3 searches for the same words found nothing on the same day, so we can write the missing answer. Anything searched fewer times is deleted within a day, and digits and email addresses are removed before anything is kept. Kept words go after 90 days, and none of it is linked to you.
• “Did this answer your question?”: we keep the article, its language, your yes or no and the reason you picked. Nothing that identifies you is stored with it.
• Satisfaction answers: 730 days from when you answered, then deleted — sooner if you delete your account. They are in your data export.
• Your account: until you delete it. Then, for 30 days, it is hidden and can be restored; after that, your builds, files, photos, profile and events are erased, together with your sign-in history, your date of birth and the language you chose.
• Two-factor sign-in: the encrypted key and the recovery-code hashes until you turn two-factor off or delete your account, whichever is first; a used recovery code until you make new ones; the record between password and code for ten minutes; a trusted browser for 30 days, or until you change your password, sign out everywhere else, turn two-factor off or delete your account.
• Staff notes about you, and a limit support set on your generating: until your account is deleted. The record of what staff did on your account: kept as a security record.
• A change of your email: the new address and its code (kept only as a one-way digest) while you confirm it, and your old address with a one-time link to take the account back for 7 days. Both are deleted 30 days after the change, and with your account.
• What survives deletion: apart from a banned address's key above, only a one-way hash of your email address — and of your payment fingerprint where one exists — plus the fact that the starter credits were issued. It cannot be turned back into your address, and it exists only so the one-time starter credits cannot be claimed twice.

Every period above can be longer when a court or an authority lawfully requires us to preserve data: while such a demand stands, neither our automatic clean-ups nor closing your account delete what it covers, and we delete it once the demand ends. We may be unable to tell you about such a demand while it stands.

• Payment and credit records: what you bought, what it cost, and every credit movement are kept for five years after the end of the year they happened in, because tax and accounting rules require such records to be kept — even after your account is erased, without your profile or your work. Paddle keeps its own records as the seller.
• Backups: we keep copies of our databases for up to 30 days, so the service can be recovered after a failure. Something you deleted is gone from the backups within 30 days. If we ever have to restore a backup, we delete again what had been deleted.
• Reports, moderation records and a reporter's record: a report's reason and note, a decision, its statement of reasons, an appeal and the case's timeline are kept for three years after the case is closed, then deleted. A screenshot goes sooner, as above.
• The record of what staff did: kept for two years after each entry, so any look at your account stays accountable.

8Your rights, and where to use them

If you live in the EU, the EEA or the UK, the law gives you these rights: to get a copy of your data and to have it given to you in a form you can take elsewhere; to have wrong data corrected; to have your data erased; to have its use restricted; to object to a use based on our legitimate interests; to withdraw a consent at any time, without affecting what was done before; and to complain to a data protection authority, as described at the top of this page. Wherever you live, we give everyone the same rights.

We answer a request within one month. If it is complicated or there are many, we may take up to two months more, and we tell you within the first month. We may ask you to write from your account's email address so we know it is you. It is free, unless a request is clearly unfounded or excessive.

9Teens and children

bricknity is for people aged 13 and over. Under 13, sign-up creates no account and does not save the details. A teen account (13 to 17) publishes privately, is not listed in search or on creator pages, asks search engines not to list its profile, cannot buy anything, cannot upload a profile photo or a cover, and is never counted by the visit-analytics cookie. See For teens and For parents.

Minifig from a photo is not offered to a teen account, or to any account whose age we cannot confirm.

If you believe a child under 13 has an account, write to [email protected] and tell us the handle if you know it.

10Automated processing

Turning your photos, files and descriptions into models is automated, and sign-up asks you to confirm you understand that. Two other things are automated: descriptions are checked before a generation starts, and a reported build is usually hidden at once while a person reviews the report. Every moderation decision itself is made by a person.

None of these is a decision that has a legal or similarly significant effect on you: a refused description costs nothing and you can change it, and a hidden build comes back when its hold lifts unless a person decides otherwise. If you think an automated step got it wrong, write to [email protected] and a person looks at it.

11Changes to this policy

Every version has a version number and the date it takes effect, shown at the top of this page, with a line saying what changed. The English text is the binding one.