Privacy Notice

1. Who handles your data

DINGXIN INFORMATION TECHNOLOGY CO., LIMITED operates Studio3D and is the data user for personal data we control. Our registered office is Room 03, 24/F, Ho King Commercial Centre, 2–16 Fa Yuen Street, Mong Kok, Kowloon, Hong Kong. Send privacy, access, correction and account-closure requests to our Data Protection Contact at horiebin@foxmail.com. This notice applies to website, account, billing and link-access services.

2. Information and purposes

We collect name, email, password for secure hashing, account identifiers and account/verification timestamps to create and authenticate accounts, provide support and send essential service notices. We do not store readable passwords.

We process session cookies/tokens, login IP addresses, browser/device information and rate-limit records to maintain sessions, protect accounts and investigate misuse. Asset link-reveal records, times, entitlement and monthly counts help deliver licensed access, enforce allowances, establish licence history and assess refund/support requests. They do not establish every download from a public link outside our site.

Registration uses Cloudflare Turnstile to detect automated abuse. Cloudflare processes network and browser/device signals, including IP information, to perform this security check. A short-lived verification token is sent to our server and validated with Cloudflare before account creation. We do not store these verification tokens in your account or contractual acceptance records. This security check is not marketing consent.

For subscriptions we keep Stripe customer, checkout, subscription and invoice references, plan, amount, currency, status, paid-through dates and cancellation information. We record the accepted policies and their content fingerprint, acceptance action and server time, and the associated account/order to administer contracts and resolve disputes. Stripe collects payment credentials in its hosted form; our application does not store full card numbers or security codes.

Support correspondence includes your email, order/model reference and details you choose to provide. Send only what is needed; do not send passwords, full card details or unrelated sensitive information.

3. Collection statement and choices

Name, email and password are required to register. Without them we cannot create or authenticate your account. Required payment-form details are needed to process a subscription. Account, session, usage and acceptance records described above are necessary to provide and protect the requested services. Optional support details are voluntary, but missing details may prevent us resolving a particular request.

We use data for the stated and directly related purposes. We obtain consent required by law before a new purpose. Acknowledging this notice is not consent to unrelated uses or direct marketing. There is currently no marketing newsletter signup. If introduced, we will give the required purpose/data/category notice, obtain required consent separately and provide a free opt-out.

4. Recipients and overseas processing

Data may be handled by authorised support personnel; hosting, database, security and infrastructure providers including Cloudflare; Stripe for payment, fraud prevention and billing; email/support providers used to respond to you; professional advisers; and authorities or other parties where disclosure is required or permitted by law for a necessary purpose. Website font files are served from our own site rather than requested from Google Fonts by your browser. We do not sell personal data. Access and disclosure are limited to the relevant purpose.

Providers may process data outside Hong Kong. We use contractual or other practicable safeguards for processor retention, permitted use and security, and remain responsible for our legal obligations. Opening Google Drive or Stripe pages interacts with those services, which may collect technical information under their own privacy notices. We do not intentionally publish account/billing data in model files or public links.

5. Retention and security

Account data is retained while needed to operate the account. Transactions, invoices and related contract evidence are generally kept for at least seven years where Hong Kong record-keeping law applies, and longer only for another legal obligation or unresolved claim. Model-licence history is retained while reasonably needed to establish continuing licensed rights or resolve claims. We review necessity on account closure and erase or anonymise data no longer needed; closure does not immediately destroy legally required records.

Expired sessions and verification records are removed after an operational buffer, normally within 30 days after expiry. Rate-limit entries older than seven days and expired temporary link tickets older than one day are removed by scheduled cleanup. Licence and contractual records are separate from temporary tickets. We use access controls, secure transport, password hashing, signature checks and restricted credentials. No system is perfectly secure; report suspected misuse promptly.

6. Cookies and your rights

Essential cookies maintain login and account security. Payment providers may use their own security/payment cookies. We do not currently run advertising or optional analytics cookies. Blocking essential cookies can prevent login or payment. Future optional tracking will require an updated notice and any legally required consent.

Request access to or correction of your data at horiebin@foxmail.com. We may require proportionate identity verification. We handle valid requests within the statutory period, normally 40 days, or provide the legally required notice if unable to comply in time or a lawful exception applies. Any lawful access fee will not be excessive. You may request account closure; necessary legal/transaction records may remain as explained above.

You may complain to the Hong Kong Privacy Commissioner for Personal Data. We publish dated material privacy changes and give additional notice where appropriate.