Privacy Policy

1. Introduction

Surface is a product of Tetrahedron LLC. Tetrahedron LLC (“Surface,” “we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our design tool and website at surface3d.ai.

All user data is kept secure and private. We do not sell your personal information.

2. Information We Collect

We may collect the following types of information:

• Account information — name, email address, and company name provided during registration or via our contact form.
• Usage data — how you interact with the Service, including features used, pages visited, and session duration.
• Design files — content you create, upload, or store within Surface.
• Device & technical data — browser type, operating system, IP address, and device identifiers collected automatically.
• Payment information — billing details processed securely through our third-party payment provider. We do not store credit card numbers.

3. How We Use Your Information

• To provide, maintain, and improve the Service
• To process your account registration and manage your subscription
• To respond to your inquiries and provide customer support
• To send service-related communications (e.g., updates, security alerts)
• To analyze usage patterns and improve our product
• To comply with legal obligations

4. Data Security

We implement industry-standard security measures to protect your data, including encryption in transit (TLS/SSL) and at rest, authentication, access controls, and security logging. Your design files are stored securely and are available only to authorized users, organization members, and recipients of links you choose to publish or share.

While no system is completely secure, we are committed to protecting your information and will notify you promptly in the unlikely event of a data breach.

Production database recovery points are created automatically each day and retained for seven days. Primary and identified legacy stored files are copied weekly on Sunday to a separate, private Google Cloud project using versioning, a 30-day retention policy, checksum manifests, recovery sampling, and failure monitoring. Files created and deleted between weekly runs might not reach the independent recovery copy.

5. Data Sharing & Third Parties

We do not sell, rent, or trade your personal information. We may share data only in the following circumstances:

• Service providers — trusted third parties that help us operate the Service, including hosting (Vercel), database and primary storage (Supabase), authentication, legacy storage, independent backups, and AI services (Google Cloud, Firebase, and Gemini), payment processing (Stripe), additional AI generation (OpenAI and Replicate), and email (Resend). A full list of sub-processors and the data shared with each is available on our Trust & Security page.
• Legal requirements — when required by law, court order, or governmental authority.
• Business transfers — in connection with a merger, acquisition, or sale of assets, with notice to affected users.

AI providers — your prompts, reference images, and uploaded assets are shared with AI providers only during an active generation request. Surface does not use this content to train models, and business API terms generally restrict provider training. Providers may retain limited content or metadata for security and abuse monitoring: OpenAI may retain abuse monitoring data for up to 30 days by default, Google may retain paid Gemini API prompts and responses for a limited abuse-monitoring period unless zero data retention is approved, and Replicate removes API prediction inputs, outputs, files, and logs after about one hour by default. See our AI Governance Framework for full details.

6. Cookies & Tracking

We use essential cookies to operate the Service and optional analytics cookies to understand usage patterns. You can control cookie preferences through your browser settings. The Service functions without optional cookies, though some analytics features may be limited.

7. Data Retention

We retain account and product data while your account is active or as needed to provide the Service. A verified account deletion removes the active authentication record, personal database records, and associated stored files. Organization-owned work may be preserved in anonymized or reassigned form, and limited financial, security, or legal records may be retained where required. Provider-held data expires according to the provider periods described above.

Database recovery points age out of the current seven-day window. Deleted or replaced stored-file generations are protected against early removal and scheduled to age out after the independent 30-day backup window, subject to provider lifecycle processing. Backups are restricted to continuity and security use. Recovery procedures replay hashed deletion tombstones before customer access is restored.

8. Your Rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Export your data in a portable format
• Opt out of non-essential communications
• Withdraw consent where processing is based on consent

To exercise any of these rights, contact us at support@surface3d.ai.

9. Children's Privacy

The Service is not intended for users under 16 years of age. We do not knowingly collect information from children. If we learn that we have collected data from a child, we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Service. The “Effective date” at the top indicates the latest revision.

11. Contact

If you have questions about this Privacy Policy or how we handle your data, contact us at support@surface3d.ai.