Privacy Policy

1General provisions

The Site is a 3D model library operated under the name Buta3D. The Site and the processing of personal data described in this policy are managed by Buta3D (the “Operator”).

By using the Site or creating an account you confirm that you have read this policy. If you do not agree with it, stop using the Site.

2Key terms

• Personal data — any information that directly or indirectly identifies a person.
• User — a person who visits the Site or creates an account.
• Account — a personal profile created with an e-mail and password or through Google.
• Premium — a paid subscription that raises the daily download allowance.
• Epoint — the payment service of “Global Innovations” LLC that accepts payments (epoint.az).

3Collection of personal data

We collect only what is needed to provide the service:

• At registration: full name, e-mail address and password. The password is stored only as a one-way cryptographic hash (scrypt), never in plain text. When you sign in with Google, your name and e-mail come from Google (through an identity provider); your Google password is not sent to us.
• Account activity: account status and role, subscription plan and period, daily download allowance and usage, download history (which model and when), favourites, personal boards and their visibility settings, last-seen time.
• Student Premium application: full name, institution, country, student status and the document you upload (only to review that application).
• Support and contact: messages you write in live chat and the account details linked to them.
• Region check: the Site is offered for Türkiye, Azerbaijan, the United States and Canada. During the check the browser’s location is read once, but coordinates are not stored; only the time of the check and the country of the connection (from the IP address) are recorded.
• Technical data: the IP address is processed temporarily to apply request limits and prevent abuse. When a visitor from abroad submits an access request, the IP address, country and request code are stored.
• Anonymous audience indicator: a random visitor number created in the browser and (if signed in) your account number are kept with a last-activity time for 24 hours and then deleted.
• Payment data — see sections 6 and 7.

4Purposes of processing

• creating, authenticating and securing your account;
• providing model downloads and applying the daily allowance;
• selling, activating, renewing and cancelling Premium;
• reviewing Student Premium applications;
• answering support requests and sending necessary service notices;
• keeping the Site secure and preventing abuse and fraud;
• meeting accounting and reporting obligations required by law.

We do not use your data for other purposes and we do not sell it for advertising.

5User registration and account data

An account is required to download models. Your account data (name, e-mail, password hash, subscription and download data) is stored in the Operator’s database. Use a strong password and do not share it.

You can see your account details on the “My account” page. To correct or delete data, use the procedure in sections 13 and 14.

6Premium subscriptions and payment transactions

Premium is sold for a monthly or yearly period and gives a daily download allowance of 50, 100 or 150 models. Prices are shown in US dollars; payment is taken in Azerbaijani manat (AZN) at the exchange rate applied at the time of payment.

After the payment is confirmed as successful, the subscription is activated on your account. Records kept by Buta3D about a payment: order number, plan, amount and currency, payment status and date, Epoint transaction number, bank reference number (RRN), the masked card (for example only the last digits) and your account e-mail.

Automatic renewal applies only if you give a separate consent (checkbox) for it at payment and uses Epoint’s recurring-payment feature. A renewal uses the plan, limit, period and price you accepted; if the price rises, a higher amount is not charged without your consent. You can cancel renewal at any time on the “My account” page; after cancellation your Premium rights continue until the end of the period you have paid for. The card is registered only on Epoint’s side; Buta3D stores only the card identifier issued by Epoint and the masked card.

7Payments through Epoint

All payments are accepted only through the Epoint payment system (“Global Innovations” LLC). The payment page belongs to Epoint and Epoint’s own privacy policy applies during payment.

Data sent from Buta3D to Epoint: amount, currency (AZN), order number, a short description (plan and period), interface language and the return addresses after payment. Your name, e-mail or password are not sent in the payment request.

Data received from Epoint: payment status, transaction number, bank reference number, the masked card and (if automatic renewal was chosen) the card identifier for recurring payments. Epoint’s notification is checked by signature and the subscription is activated only after the payment status has been separately confirmed with Epoint.

In case of a refund (reversal), Buta3D sends Epoint the transaction number and the amount.

Epoint official Privacy Policy ↗

8Security of bank card data

The bank card number, expiry date and CVV/CVC are entered only on Epoint’s payment page. This data does not reach Buta3D servers, is not stored there and is not written to logs.

Buta3D stores only the masked card returned by Epoint and (for automatic renewal) the card identifier issued by Epoint; a card cannot be used with these. The security of card data processing is provided by Epoint. For information on Epoint’s compliance with security requirements, see its official privacy policy.

9Cookies and user analytics

The Site uses only technical cookies and local storage items needed for it to work:

• session cookie — keeps you signed in;
• buta3d_locale — your chosen language;
• buta3d_location_verified — signed proof of the region check;
• b3d_ref — a token with no personal data used to credit an invitation when you arrive through an invite link;
• buta3d_visitor_id (localStorage) — a random number for the anonymous audience indicator described in section 3.

The Site does not use Google Analytics, Meta Pixel or any other advertising or tracking tools. You can delete or block cookies in your browser settings, but features such as sign-in, language choice and model downloads may then not work properly.

10Storage and protection of data

• Account data — while your account exists;
• payment and subscription records — for the period required by law for accounting and reporting;
• Student Premium document — deleted 24 hours after approval, 7 days after rejection, or 30 days after an information request goes unanswered; deleted immediately if you withdraw. The approval record (12 months) remains;
• region-check record — valid for 30 days, after which the check is asked again;
• anonymous audience indicator — 24 hours.

To protect your data we use technical and organisational measures such as password hashing, HTTPS, restricted access rights, request limits and separate private storage for Student documents. No system is absolutely secure.

11Disclosure to third parties

We do not sell your data. We share it only where necessary to provide the service:

• Epoint (“Global Innovations” LLC) — to accept payments (section 7);
• Google (identity service) — only if you choose to sign in with Google;
• e-mail delivery service — your e-mail address and the message text are passed to it when system e-mails, such as Student Premium notices, are sent;
• Cloudflare — only to synchronise IP addresses approved for access from abroad, and only if this feature is configured;
• competent public authorities — only where required by law.

12Processing on servers abroad

The Site’s files (3D models and private storage for Student documents) are kept with Hetzner, and the Site itself runs on a Hostinger server in Frankfurt, Germany. Your personal data may therefore be stored and processed on servers outside the Republic of Azerbaijan. Epoint, Google and the e-mail service also process data on their own infrastructure. Data is transferred only for the purposes of this policy and with the measures listed above.

13User rights

In accordance with the law you have the right to:

• learn what data about you is processed and obtain a copy;
• request correction of inaccurate or incomplete data;
• request deletion or restriction of processing (except records that must be kept by law);
• withdraw the consent you gave;
• cancel automatic renewal at any time;
• apply to the competent authority or a court if your rights are violated.

Requests are handled through the contact e-mail given in section 16. Additional information may be requested to confirm your identity.

14Deletion and archiving of data

You can request deletion of your account and personal data by writing to the contact e-mail given in section 16. After the request is verified, the data is deleted or anonymised so that it can no longer identify you. Data that must be kept for a period set by law, such as payment and accounting records, is archived in a restricted way until that period ends.

Data in technical backups disappears when the backup reaches the end of its life.

15Updates to this policy

This policy may be updated when the Site’s features or the law change. The new version is published on this page and the “Last updated” date changes. Significant changes may be announced on the Site or by e-mail. Continuing to use the Site after an update means you accept the new version.

16Contact and complaints

You can send questions and complaints about personal data, this policy or your rights to the Buta3D team through the live chat on the site or from your account.

For questions about personal data processing by Epoint during payment, contact Epoint as described in its official privacy policy.