Privacy notice
Version 1, 6 November 2026
In short: we collect very little. Your 3D work stays in your own browser and never reaches us. We see your email address if you are a tester, if you join the waitlist, or if you write to us. We do not sell your data, show ads, or track you across websites.
1. Who is responsible
Rigami is run by Baris Atas, a private individual in Dubai, United Arab Emirates. Rigami is not a company yet. Baris Atas is the "controller" of your personal data: the person who decides how it is used.
- Email for privacy questions: [email protected]
2. What we collect, why, and for how long
2.1 When you visit rigami3d.com
- We count visits with Cloudflare Web Analytics. It uses no cookies, and Cloudflare says it does not collect your personal data for these counts and does not follow you across websites.
- We see only totals: how many visits, which pages, the websites people came from, the country, the type of device and browser, and how fast pages load.
- Why: to see whether the website works and is useful. Legal basis: our legitimate interest (GDPR Art. 6(1)(f)).
- How long: Cloudflare keeps these reports for a limited time.
2.2 When you join the waitlist
- We keep your email address, your answer to our one question, and when you signed up.
- Why: to email you when Rigami opens, and to learn whether people would pay for it.
- Legal basis: your consent (GDPR Art. 6(1)(a)). You can take it back at any time (section 5).
- We email you when Rigami opens, and at most two times before that. Nothing else.
- How long: until we have told you that Rigami is open, and 3 months after that; or until you leave the list. If Rigami never opens, we delete the list after 24 months at the latest.
2.3 When you are a tester (sign-in)
- We keep the list of invited email addresses in Cloudflare Access, the gate in front of the studio.
- When you sign in, Cloudflare sends a one-time code to your email. Cloudflare keeps a short sign-in log: your email address, the time, your IP address, your country and your browser. On our plan these logs are kept for 24 hours.
- Cloudflare puts a sign-in cookie in your browser so you stay signed in for 24 hours.
- Why: to let only invited testers in, and to keep the studio safe.
- Legal basis: giving you the test you asked for (GDPR Art. 6(1)(b)), and our legitimate interest in security (Art. 6(1)(f)).
- How long: the invite list until the test ends; we delete it within 30 days after.
2.4 Your work in the studio
- Everything you make is kept only in your browser (in its storage called IndexedDB). It is not sent to us. We cannot see it, open it, or restore it.
- You delete it by clearing your browser's data for app.rigami3d.com.
- We never use your work to train AI.
2.5 When you send feedback
- With Send feedback we receive: your text, your email address (so we can reply), your browser type and screen size, the studio version, and, only if you tick the box, a picture of the 3D view (not your whole screen; it may show your model).
- It is kept in our database at Cloudflare, with the email address you signed in with at the invite gate. Only we can read it. If you email [email protected] instead, it arrives in our mailbox at Zoho Mail.
- Why: to fix bugs and improve Rigami. Legal basis: our legitimate interest (GDPR Art. 6(1)(f)); you choose to send it.
- How long: until 6 months after the test ends. After that we may keep short bug notes with no name or email.
2.6 When you email us
- We keep your email and what you write, to answer you.
- Legal basis: our legitimate interest in answering (GDPR Art. 6(1)(f)), or steps you asked for (Art. 6(1)(b)).
- How long: 12 months after the matter is closed.
3. Who helps us (and gets your data)
We do not sell or rent your data, and we do not share it for advertising. Only these service providers handle it for us, under contracts that oblige them to protect it and to use it only for us:
| Who | What they do | Where |
|---|---|---|
| Cloudflare, Inc. | Hosts the website and the studio, runs the sign-in gate and one-time codes, runs our domain's DNS, counts website visits, runs the small functions behind the waitlist and feedback | United States and Cloudflare's worldwide network |
| Zoho Corporation (Zoho Mail) | Our email inbox, where your emails arrive | United States (Zoho's US data centre) |
Cloudflare may also use limited technical data to keep its network secure, as its own privacy policy explains.
We may disclose data if the law requires it, for example to a court or the police, and only as far as required.
4. Data sent to other countries
We are in the United Arab Emirates. Cloudflare works worldwide and mainly from the United States. When your data goes to a country without the same level of protection as yours, it is protected by contracts:
- Cloudflare: its Data Processing Addendum with the EU Standard Contractual Clauses, the UK Addendum, and Cloudflare's certification under the EU-US Data Privacy Framework.
- Zoho: its Data Processing Agreement with the EU Standard Contractual Clauses.
You can ask us for a copy of these safeguards (section 7).
5. Your rights
You can ask us, free of charge:
- for a copy of your personal data, and how we use it;
- to correct it;
- to delete it;
- to limit how we use it, or to object to our use based on legitimate interest;
- to get it in a portable form;
- to take back your consent (the waitlist) at any time. This does not affect what we did before.
Email [email protected]. We answer within one month. We may ask you to confirm it is you, for example by writing from the same email address.
These rights come from the EU GDPR, the UK GDPR, and the UAE's Federal Decree-Law 45 of 2021 on personal data. People in other countries (for example California) may have similar rights; we give them to everyone.
You can complain to a data protection authority, for example where you live or work:
- in the EU: your country's authority;
- in the UK: the Information Commissioner's Office (ico.org.uk);
- in the UAE: the UAE Data Office.
We would like the chance to help first, so please write to us too.
6. What is stored on your device
We use no advertising or tracking cookies and no cookie banner, because we only store what the service needs:
| What | Where | Why | How long |
|---|---|---|---|
Sign-in cookie (Cloudflare Access, for example CF_Authorization) | Studio | Keeps you signed in | 24 hours |
Security cookies Cloudflare may set when it checks for bots (for example __cf_bm, cf_clearance) | Website and studio | Protects against abuse | Short, set by Cloudflare |
| Your work (IndexedDB) | Studio | Keeps your models, collections and versions | Until you delete it |
| Your settings (localStorage) | Website and studio | Remembers choices you make, such as a style, recent colours, where a panel sits, or "pause motion" | Until you clear it |
| An image you pick on the website to start with | Website, then studio (IndexedDB) | Hands your picture to the studio on this device only | Until the studio takes it |
Do Not Track and Global Privacy Control: we do not track you across websites, so we treat every visitor the same way, whatever these signals say.
7. Security
- Rigami is served only over encrypted connections (HTTPS).
- Only invited testers can open the studio.
- Your work is not on our side, so it cannot leak from us.
- Our accounts are protected with passkeys or security keys.
- If a data breach puts you at risk, we will tell you and the authorities as the law requires.
8. Age
Rigami is for people 18 or older. We do not knowingly collect data from children. If you think a child gave us data, tell us and we will delete it.
9. No automated decisions, no AI on your data
We make no automated decisions about you. AI features are not part of this test, and your data is not used to train AI.
10. Changes
When Rigami changes (for example when sign-in and storage on our side come in a later phase), we will update this notice. If a change matters, we will tell testers and the waitlist by email before it applies. The date at the top shows the version.
11. Contact
Baris Atas, Dubai, United Arab Emirates. Email: [email protected]