Privacy policy

This policy explains what the RenderX 3D Jewelry Viewer app ("The RenderX", "we") stores, why, where, and for how long. It covers merchants who install the app, shoppers who visit those merchants' stores, and visitors to this website.

The RenderX is provided by therenderx, surat. Contact: italiyakeyur@gmail.com.

The short version

• Shoppers: the viewer sets no cookies and stores nothing on the shopper's device. Analytics are anonymous: we do not store IP addresses, names, emails or any customer data. The only identifier is a random session id that lives in the page's memory for one browser tab.
• Your design files: a .3dm original is stored on our server only if you choose "Upload file" and leave "Keep my original" ticked. Unticked, the file never leaves your computer.
• Links: with "From a link", we store only the link, encrypted. The file is fetched to convert it and never saved.
• 3D files shoppers see (the display model and its pictures) live in your own Shopify Files, on Shopify's CDN.
• Photos, videos and STL files you export are made in your browser and never stored on our server.
• Your designs are used only for your own viewer. They are never shown to other merchants, shared, sold or used to train anything.

What we store about merchants

When you install the app, we store:

• Store details from Shopify: the store's myshopify domain, name, contact email, owner name, primary domain, country, currency and Shopify plan name.
• Shopify access tokens that let the app work on your store. For staff who log in to the web dashboard, Shopify shares the staff member's name and email with the login; we keep them with that login session.
• Your app plan and subscription status, as reported by Shopify.
• Your settings (gallery mode, default metal, the position bar's views and default view, for your shop and for products that have their own, button style, analytics on or off, notification email; the export settings: whether shoppers may save pictures and videos and download photos, the background color; and your watermark: its style, text, font, position, size, amount, colour and where it applies, and the address and id of your watermark logo in your Shopify Files).
• Your 3D products: the Shopify product id, title and handle; the SKUs of its variants (so you can search and name exports by SKU); the product's description, its status (active, draft or archived) and whether it is on your Online Store (so an app catalog shows only products shoppers can buy); the ids, addresses and sizes of the files we created in your Shopify Files (including the photo pack); the metal mapping; the conversion status and version.
• Your app catalogs (Starter plan and up), described in "App catalogs" below.
• The theme name and id your storefront reports, so we can make sure the gallery works on your theme.
• Support messages you send us, and a log of the emails we've sent you.
• An audit log of important actions (for example uploads, deletions, plan changes, and that an export or an STL was made: its kind, size and count, never the file).

Your design files: three cases

Each product chooses one of these, and the app always shows which one applies.

1. "Upload file" with "Keep my original" ticked (the default). The .3dm file is uploaded to our server and stored privately, so we can re-convert it when the viewer improves. It is never public: our app sends it back only to your own signed-in admin, when you re-convert it or export an STL. You can delete it at any time from the product page. It is also deleted when you remove 3D from the product, and 48 hours after you uninstall (unless you reinstall within that time).
2. "Upload file" with "Keep my original" unticked. The .3dm is converted in your browser and never sent to our server. We store nothing of it except the results described below.
3. "From a link" (Google Drive, Dropbox, OneDrive, Box or a direct https link). Our server fetches the file and streams it directly to your browser for conversion. The file is never saved: not to disk, not to our storage, not anywhere; it passes through memory only. We store only the link, encrypted (AES-256-GCM), so we can fetch it again for re-processing. Once a week, and before re-processing, we read the first 64 bytes of the file to check the link still works; those bytes are not kept. Our logs record only the website's name, the size and the result, never the full link. No screen shows the full link, not even to our staff. Turn off sharing in your drive at any time to revoke our access.

What shoppers download: the converted 3D display model (a compressed .glb render mesh, keeping only the names of layers, objects and materials) and three pictures of the ring. These are uploaded to your own Shopify Files and served by Shopify's CDN. As with every web 3D viewer, shoppers' browsers must download the display model to show it. They never receive your .3dm file.

On hand (Growth and Pro plans): when a shopper taps the On hand button, their browser also downloads our 3D hand files (the same for every store) from our assets server, through Cloudflare's network. Nothing is downloaded before that tap. The assets server keeps no access logs, so we don't record shoppers' IP addresses there; Cloudflare, which delivers these files, processes the IP address of each request under its own terms.

Photos, 360° videos and STL files. Everything is rendered in the browser of the person who asks for it, from the 3D model already on the page; nothing is rendered on our servers and we keep no copy.

• Your exports (photos, 360° videos, STL files, and bulk photos of many products) are made in your browser and downloaded straight to your computer. An STL is made from the meshes in your stored original or a fresh read of your link (or from the display model), in your browser; it is never stored on our server or anywhere public. Unfinished 360° videos and bulk exports are kept only in your own browser's storage until they finish or you delete them. We record in the audit log that an export or an STL was made (its kind, size, part and triangle count), never the file.
• Add to product media (when you tick it): your photos or video are uploaded from your browser to Shopify and added to that product's own media, through Shopify's upload service. They don't pass through our server, and we keep no copy or record of them beyond the audit log entry.
• Shoppers' photo downloads (Starter and up, when you leave them on): on a computer, the camera button renders four pictures of the metal the shopper is looking at in the shopper's browser and draws your watermark on them there. Shoppers always get a mark, and no unmarked picture is published for them. Phones don't show the button. Nothing is uploaded and nothing is stored on the shopper's device.
• Pictures and 360° videos from the Save button (Growth and Pro): made in that browser from the 3D view on screen and handed straight to the person who asked for it. Shoppers' copies carry the store's watermark.
• Your watermark logo, if you upload one, goes to your own Shopify Files (an SVG is first turned into a PNG in your browser); we keep its address and id, and delete it from your Files when you remove or replace it. Shoppers' browsers download it from Shopify's CDN only when they save or download a picture.

Your designs are yours. We use them only to show your own viewer on your own store. We never show them to other merchants, never share or sell them, and never use them for any other purpose, including training any model.

What we store about shoppers

When the merchant has analytics on (the default), the viewer sends anonymous events through Shopify's App Proxy:

• the event type (for example: picture shown, 3D loaded, metal changed, position chosen, the piece laid down or stood up, full screen, On hand turned on or off, skin tone chosen, a picture or 360° video made, photos downloaded (the metal, how many, and whether they came from the photo pack), add to cart after viewing 3D, an error);
• which 3D product it was, and the time;
• a random session id, created per browser tab and held only in the page's memory. It is not stored in a cookie or in the browser's storage, and it is gone when the tab closes;
• the device type (desktop, mobile or tablet), worked out from the browser's user agent, which we don't keep;
• the country, worked out from the request (from a country header added by the network, or a local GeoLite2 database lookup). The IP address is used only in memory for that lookup and is never stored or logged;
• viewer load time and, for errors, a short error message and the theme name.

We do not set cookies, use local or session storage, store IP addresses, or receive names, emails, addresses or orders. Shopify adds a logged-in customer id to App Proxy requests; we ignore it and never store it. Merchants can switch analytics off in the app's settings; the viewer then sends no events.

App catalogs

App catalogs are part of the Shopify app (Starter plan and up): you build a catalog in the app and show it on a page of your store with the "The RenderX catalog" app block. They are separate from the RenderX Catalog on this website (see "Catalog" below).

What we store. For each catalog: its name, its public catalog ID (the one you paste into the block), its categories, and for each item the product or upload it shows, its category and order, and your overrides (title, details and custom thumbnail). A custom thumbnail is uploaded to your own Shopify Files; we keep its address and id.

Uploaded pieces. A .3dm you upload into a catalog follows exactly the same rules as a product's file: the display model and pictures go to your own Shopify Files; the original is stored on our server only with "Upload file" and "Keep my original" ticked; with "From a link" we store only the link, encrypted, and the file is never saved. Removing an uploaded piece from its last catalog (or deleting that catalog) deletes it, its stored original and its files in your Shopify Files.

On your store. Store visitors' browsers load the catalog through Shopify's App Proxy. It sends the category names, the items' titles and details, and the addresses of the files in your Shopify Files, and never an email address. The block and the popup set no cookies and store nothing in the visitor's browser.

Inquiries. When a store visitor sends an inquiry, their name, email, optional phone and message are emailed to your store's email from Shopify, or to a custom address you set for that catalog once it is confirmed (we email it a single-use link, valid for 24 hours, and store the address, a hashed token and when it was sent and confirmed; these emails are limited to ten an hour per store and three an hour per address, the latter counted under a keyed one-way hash of the address). The visitor's email is the reply-to address. Inquiries are emailed and not stored: we log only the store, the catalog and the recipient address of each email sent. To limit spam, inquiries are counted per visitor with a keyed one-way hash of the IP address Shopify forwards with the request, kept only in memory for 10 minutes; no IP address is stored. Each catalog also has an hourly count, stored under the catalog's ID only.

What we store about website visitors

This website uses no analytics and no tracking. Fonts and images load from this site and from Shopify's CDN.

If you use the contact form, we store your name, email, optional store address and message, and email them to our team. To limit abuse, we count messages per connection using a keyed one-way hash of your IP address; the counter expires after one hour and expired counters are deleted. The form uses one strictly necessary cookie (see our cookie note).

Catalog

The RenderX Catalog is a separate service on this website: you sign up, upload rings and paste one embed code into a page of your store. It is not linked to the Shopify app or to any Shopify store.

Your catalog account. We store your name, your account email and your password (hashed, never in plain text). Your account email is confirmed by a link we send at sign-up. You can add extra contact emails for inquiries; each one is verified by link and gets no inquiries until it is confirmed. We also store your catalog settings, your categories, and for each product its title, details, category, contact details and the name of its .3dm file. The phone and WhatsApp numbers you enter are shown to store visitors in the popup. Each login session keeps the browser's IP address and user agent, as our login system records them; the session is deleted when you log out or delete your account. To limit abuse, catalog sign-up and log-in count attempts per connection using a keyed one-way hash of your IP address; these counters last 15 minutes and expired counters are deleted. Log-in also counts attempts per account email, and confirmation emails (at sign-up, at log-in before confirming, and for contact emails) are limited to three an hour per address, both counted under a keyed one-way hash of the email address; the log-in counter lasts 15 minutes, the email counter one hour, and expired counters are deleted. Confirmation emails do not include your account name. Logging in uses one strictly necessary cookie (see our cookie note).

Your files. The 3D model, pictures and custom thumbnails are stored on our servers, so the catalog can show them on your store. The .3dm original is never uploaded: it is converted in your browser, and only the 3D display model, three pictures and an optional custom thumbnail you choose are sent to us. Store visitors' browsers download the display model and pictures to show them, as with every web 3D viewer.

Store visitors. Store visitors get no cookies from the catalog, and it stores nothing in their browser. To limit spam, the inquiry form counts messages per visitor with a hashed key kept only in memory; no IP address is stored.

Inquiries. When a visitor sends an inquiry, their name, email, optional phone and message are emailed to the catalog owner, with the visitor's email as the reply-to address. Inquiries are emailed to the catalog owner and not stored: only that an email was sent, and to which owner address, is logged.

Deleting. Deleting a product or account removes its files at once. Deleting your account (in Settings) also removes every product, category and contact email, and the log of inquiry emails sent to you, and your catalog stops showing on your store straight away. Deleted data leaves our backups within 14 days.

Operator switch. An operator can disable a catalog (for example after abuse). A disabled catalog shows nothing on the store, and its owner can no longer use the catalog area.

How we use data

Only to provide and support the app: to show your viewer, to show you analytics about it, to enforce your plan, to send you service emails (with an unsubscribe link for the non-essential ones), to answer support messages, and to keep the service secure. We do not sell data and do not use it for advertising.

Retention

Data	Kept
Raw shopper events	90 days. They're deleted in monthly blocks, so an event is gone at most about four months after it happened
Daily analytics summaries	While your store uses the app; deleted on shop/redact
Stored .3dm originals	Until you delete them or remove 3D from the product; deleted 48 hours after uninstall unless you reinstall
Encrypted links and 3D product records	Until you remove them; deleted 48 hours after uninstall unless you reinstall
Store details, settings, support messages, email log, audit log	While your store uses the app; deleted on shop/redact
App catalogs, their items and the log of inquiry emails	Until you delete them; deleted on shop/redact
Catalog accounts, products and their files	Until you delete them; deleting a product or your account removes its files at once
Website contact messages (not linked to a store)	As long as needed to answer you; ask us to delete them at any time
Backups	Nightly, kept for 14 days

Uninstalling. 48 hours after you uninstall, Shopify sends a shop/redact request. We then delete everything we hold for your store, including events and daily summaries, keeping only a one-line record that the deletion happened. Deleted data leaves our backups within 14 days. Files in your Shopify Files are yours: they stay in your Files until you delete them, or until Shopify removes your store's data.

GDPR and Shopify's privacy webhooks

We implement Shopify's mandatory privacy webhooks:

• customers/data_request and customers/redact: we hold no data about your customers, so there is nothing to export or delete. We acknowledge the request.
• shop/redact: we delete all data for the store, as described above.

Where data is processed and who helps us

Sub-processor	What for	Where
Hostinger	Hosting of the app, database, stored originals and catalog files	Mumbai (India)
Shopify	The platform the app runs on: login, billing, App Proxy, and Shopify Files/CDN for the 3D files shoppers see	Shopify's infrastructure
Cloudflare	Delivers the On hand 3D hand files to shoppers' browsers (content delivery network)	Cloudflare's global network
zoho CPaaS	Sending service and alert emails, and catalog inquiries (SMTP)	Per the provider

We'll update this list before adding a sub-processor.

Security

All traffic uses TLS. Links are encrypted at rest. Stored originals are private and are served only to their own store's signed-in admin. Every merchant query is limited to that merchant's store. Webhooks and App Proxy requests are signature-checked. Our admin area requires two-factor authentication. When staff open a store's dashboard to help you, that view is read-only and recorded in the audit log, as is every change staff make.

Your rights

Depending on where you live (for example under the GDPR or UK GDPR, or Californian law), you can ask to access, correct, export or delete your personal data, or object to how we use it. Merchants can delete most data themselves in the app. For anything else, write to italiyakeyur@gmail.com. You can also complain to your data protection authority.

For shoppers' data, the merchant is the controller and we act on their behalf; see our data processing addendum.

Children

The app and this website are for businesses and are not directed at children.

Changes

We'll post changes here and update the date above. For important changes, we'll tell merchants by email or in the app.

Contact

therenderx, surat. Email: italiyakeyur@gmail.com.